<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="1343">
<package pkgid="de737a0a6ec33128ce0ee0d910f38e13b4e7daebc383b6dbf475a8ead133b464" name="Mesa" arch="src">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="8cf24653ef89b8756f236bff5c548f4ef16fbe721c25ecf27b5fe22bef3fe4c0" name="Mesa" arch="src">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="62179929170ee1c83bdce4c7c0e10d016526dc8034784e47bb969096cadc32c2" name="apparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="739ba6f7c3a7ab330ee1592a71023ae80e92c272586620f2f014dfc895c5c402" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="00aadc46dfa2a1a94297a1e1cf56c3c05bb978a73619e9e8640ea3aa579bf282" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="3f8d6ec4e48152f7efbf6a716b5edfdacf1634c1a99ee939d39ec92f32ea7ca1" name="avahi" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="40c8a7e25f54a5a3def66045e2fbb5f726e5c772c175c121531ec54c3425e6fb" name="avahi" arch="src">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="92e7271e4d6996f4f353857e3bbd1527de38be4308976b86831b502a5c74371d" name="avahi" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="eaac712c518a57a4b5327b5c9a69aed036d9a2ff97eb6597d3c46c4c6943a7d1" name="aws-cli" arch="noarch">
  <version epoch="0" ver="1.24.4" rel="150200.30.8.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1618315200">- Update to version 1.19.50
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.50/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621598400">- Update to version 1.19.75
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.75/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623844800">- Update to version 1.19.86
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.86/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Update to version 1.19.112
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.112/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473600">- Update to version 1.20.7 (bsc#1189649)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473601">- Update to version 1.20.7
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="mvyskocil@opensuse.org" date="1631275200">- Update to version 1.20.32
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.32/CHANGELOG.rst
- Fix rpmlint warnings
  + use defattr for default permissions
  + mark zsh completion file as a config file
- Use github download url as a Source0
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635508800">- Update to version 1.21.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.21.6/CHANGELOG.rst
- Relax upper version dependency for python-docutils in Requires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1639656000">- Update to version 1.22.24
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.24/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1641470400">- Update to version 1.22.28
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.28/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642161600">- Update to version 1.22.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.35/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1643716800">- Update to version 1.22.46
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.46/CHANGELOG.rst
- Add missing python-rpm-macros to BuildRequires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646222400">- Update to version 1.22.65
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.65/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1649073600">- Update to version 1.22.87
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.87/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1651060800">- Update to version 1.23.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652356800">- Update to version 1.23.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.11/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652788800">- Update to version 1.24.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1653048000">- Update to version 1.24.4 (bsc#1199716)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.4/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="93cede7a5faa828620f6f96ad50684bd53dc96d48d577d2cebcf6bc1f4512e9c" name="aws-cli" arch="src">
  <version epoch="0" ver="1.24.4" rel="150200.30.8.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1618315200">- Update to version 1.19.50
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.50/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1621598400">- Update to version 1.19.75
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.75/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623844800">- Update to version 1.19.86
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.86/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Update to version 1.19.112
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.112/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473600">- Update to version 1.20.7 (bsc#1189649)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627473601">- Update to version 1.20.7
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.7/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="mvyskocil@opensuse.org" date="1631275200">- Update to version 1.20.32
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.20.32/CHANGELOG.rst
- Fix rpmlint warnings
  + use defattr for default permissions
  + mark zsh completion file as a config file
- Use github download url as a Source0
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635508800">- Update to version 1.21.6
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.21.6/CHANGELOG.rst
- Relax upper version dependency for python-docutils in Requires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1639656000">- Update to version 1.22.24
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.24/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1641470400">- Update to version 1.22.28
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.28/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642161600">- Update to version 1.22.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.35/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1643716800">- Update to version 1.22.46
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.46/CHANGELOG.rst
- Add missing python-rpm-macros to BuildRequires
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646222400">- Update to version 1.22.65
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.65/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1649073600">- Update to version 1.22.87
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.22.87/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1651060800">- Update to version 1.23.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652356800">- Update to version 1.23.11
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.23.11/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652788800">- Update to version 1.24.1
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.1/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1653048000">- Update to version 1.24.4 (bsc#1199716)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.24.4/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="25312061f297a8dd2bfef632cbf37847f13eb387576840506882aeedfa33b56e" name="bash-completion" arch="noarch">
  <version epoch="0" ver="2.7" rel="150000.4.9.1"/>
  <changelog author="werner@suse.de" date="1439467200">- Add patch backtick-completion-boo940835.patch to allow correct
  backtick completion (boo#940835)</changelog>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1513598400">- Remove rfkill conflicting with util-linux-2.31.</changelog>
  <changelog author="werner@suse.de" date="1540209600">- Modify patch PS1-completion-boo903362.patch to make it work with
  mksh as well (boo#1104531)</changelog>
  <changelog author="werner@suse.de" date="1633348800">- Add patch boo1190929-9af4afd0.patch for boo#1190929
  modinfo completion fails to recognize .ko.xz</changelog>
  <changelog author="werner@suse.de" date="1653307200">- Add patch bsc1199724-modules.patch (bsc#1199724)
  * Enable upstream commit to list ko.zst modules as well</changelog>
</package>
<package pkgid="d3e141566be341719c1791f067287646d457fae00e2efb72bb3147567ef86dba" name="bash-completion" arch="src">
  <version epoch="0" ver="2.7" rel="150000.4.9.1"/>
  <changelog author="werner@suse.de" date="1439467200">- Add patch backtick-completion-boo940835.patch to allow correct
  backtick completion (boo#940835)</changelog>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1513598400">- Remove rfkill conflicting with util-linux-2.31.</changelog>
  <changelog author="werner@suse.de" date="1540209600">- Modify patch PS1-completion-boo903362.patch to make it work with
  mksh as well (boo#1104531)</changelog>
  <changelog author="werner@suse.de" date="1633348800">- Add patch boo1190929-9af4afd0.patch for boo#1190929
  modinfo completion fails to recognize .ko.xz</changelog>
  <changelog author="werner@suse.de" date="1653307200">- Add patch bsc1199724-modules.patch (bsc#1199724)
  * Enable upstream commit to list ko.zst modules as well</changelog>
</package>
<package pkgid="08637330558533f697f856f649377be29e2783d873a54f232e2d6619e39687bb" name="btrfsprogs" arch="aarch64">
  <version epoch="0" ver="4.19.1" rel="150300.18.5.1"/>
  <changelog author="dsterba@suse.cz" date="1515326400">- spec: fix distro version condition</changelog>
  <changelog author="dsterba@suse.cz" date="1517486400">- update to version 4.15
  * mkfs --rootdir reworked, does not minimize the final image but can be still
    done using a new option --shrink
  * fix allocation of system chunk, don't allocate from the reserved area
  * other
  * new and updated tests
  * cleanups, refactoring
  * doc updates</changelog>
  <changelog author="dsterba@suse.cz" date="1518782400">- use documentation shipped by upstream tar, reduce dependencies</changelog>
  <changelog author="dsterba@suse.cz" date="1522929600">- update to version 4.16
  * libbtrfsutil - new LGPL library to wrap userspace functionality
  * several 'btrfs' commands converted to use it:
  * properties
  * filesystem sync
  * subvolume set-default/get-default/delete/show/sync
  * python bindings, tests
  * build
  * use configured pkg-config path
  * CI: add python, musl/clang, built dependencies caching
  * convert: build fix for e2fsprogs 1.44+
  * don't install library links with wrong permissions
  * fixes
  * prevent incorrect use of subvol_strip_mountpoint
  * dump-super: don't verify csum for unknown type
  * convert: fix inline extent creation condition
  * check:
  * lowmem: fix false alert for 'data extent backref lost for snapshot'
  * lowmem: fix false alert for orphan inode
  * lowmem: fix false alert for shared prealloc extents
  * mkfs:
  * add UUID and otime to root of FS_TREE - with the uuid, snapshots will
    be now linked to the toplevel subvol by the parent UUID
  * don't follow symlinks when calculating size
  * pre-create the UUID tree
  * fix --rootdir with selinux enabled
  * dump-tree: add option to print only children nodes of a given block
  * image: handle missing device for RAID1
  * other
  * new tests
  * test script cleanups (quoting, helpers)
  * tool to edit superblocks
  * updated docs
- Add patch: 0001-btrfs-progs-build-fix-static-build.patch
- Add new library packages: libbtrfsutil</changelog>
  <changelog author="dsterba@suse.cz" date="1524484800">- update to version 4.16.1
  * remove obsolete tools: btrfs-debug-tree, btrfs-zero-log, btrfs-show-super,
    btrfs-calc-size
  * sb-mod: new debugging tool to edit superblock items
  * mkfs: detect if thin-provisioned device does not have enough space
  * check: don't try to verify checksums on metadata dump images
  * build: fail documentation build if xmlto is not found
  * build: fix build of btrfs.static
- Remove patch: 0001-btrfs-progs-build-fix-static-build.patch (upstream)
- Update initrd script</changelog>
  <changelog author="jeffm@suse.com" date="1525089600">- Fix building on SLE11:
  * btrfs-progs: convert: fix support for e2fsprogs &lt; 1.42
  * btrfs-progs: build: detect whether -std=gnu90 is supported
  * btrfs-progs: build: autoconf 2.63 compatibility
  * Fixed mismerged addition of libbtrfsutil1 package description
- Added patches:
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1529582400">- update to version 4.17
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
- Removed patches (upstreamed):
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1533470400">- update to version 4.17.1
  * check:
  * add ability to fix wrong ram_bytes for compressed inline files
  * beautify progress output
  * btrfstune: allow to continue uuid change after unclean interruption
  * several fuzz fixes:
  * detect overalpping chunks
  * chunk loading error handling
  * don't crash with unexpected root refs to extents
  * relax option parsing again to allow mixing options and non-options
    arguments
  * fix qgroup rescan status reporting
  * build:
  * drop obsolete dir-test
  * new configure option to disable building of tools
  * add compatibility options --disable-static and --disable-shared
  * other:
  * cleanups and preparatory work
  * new test images
- spec cleanup</changelog>
  <changelog author="dsterba@suse.cz" date="1541937600">- update to version 4.19
  * check: support repair of fs with free-space-tree feature
  * core:
  * port delayed ref infrastructure from kernel
  * support write to free space tree
  * dump-tree: new options for BFS and DFS enumeration of b-trees
  * quota: rescan is now done automatically after 'assign'
  * btrfstune: incomplete fix to uuid change
  * subvol: fix 255 char limit checks
  * completion: complete block devices and now regular files too
  * docs:
  * ship uncompressed manual pages
  * btrfsck uses a manual page link instead of symlink
  * other
  * improved error handling
  * docs
  * new tests</changelog>
  <changelog author="dsterba@suse.cz" date="1544011200">- update to version 4.19.1
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
  * other
  * new tests
  * cleanups</changelog>
  <changelog author="nborisov@suse.com" date="1544184000">- Implement fate#325871
  * Added 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch
  * Added 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch
  * Added 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch
  * Added 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch
  * Added 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch</changelog>
  <changelog author="mfasheh@suse.com" date="1548417600">- Advise user of fs recovery options when we fail to mount (fate#320443,
  bsc#1122539)
  * Add dracut-fsck-help.txt
  * Add module-setup.sh</changelog>
  <changelog author="mfasheh@suse.com" date="1553515200">- Use correct path for dracut-fsck-help.txt in module-setup.sh (bsc#1122539)
  * Remove module-setup.sh
  * Add module-setup.sh.in</changelog>
  <changelog author="jeffm@suse.com" date="1563969600">- btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny
  metadata (bsc#1131334).
- Added patches:
  * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1581076800">- btrfs-progs: check: fix segfault with -Q (bsc#1158560)
- Added patches:
  * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch</changelog>
  <changelog author="rgoldwyn@suse.com" date="1607601600">- Enqueue feature to wait for exclusive operation to finish
  (JSC#SLE-15234)
- Added patches:
  * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch
  * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch
  * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch
  * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch
  * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch
  * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1609848000">- Refresh manual pages after the docs change (jsc#SLE-13586)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1617969600">- Correct check_running_fs_exclop() return value (bsc#1184481)
  btrfs-progs-Correct-check_running_fs_exclop-return-v.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652702400">- Ignore path devices when scanning btrfs filesystem (bsc#1199391)
  0001-btrfs-progs-build-add-optional-dependency-on-libudev.patch
  0002-btrfs-progs-ignore-devices-representing-paths-in-mul.patch
  0003-btrfs-progs-add-fallback-code-for-multipath-device-d.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652875200">- Build btrfsprogs against libudev-devel properly.
  0001-btrfs-progs-build-make-libudev-selectable.patch
- Also make libudev-devel a hard requirement in the spec file.</changelog>
</package>
<package pkgid="485368f7b4feb998d3630d622b3761ff8fdb8d5371a53035864ee1ed384669ce" name="btrfsprogs" arch="src">
  <version epoch="0" ver="4.19.1" rel="150300.18.5.1"/>
  <changelog author="dsterba@suse.cz" date="1515326400">- spec: fix distro version condition</changelog>
  <changelog author="dsterba@suse.cz" date="1517486400">- update to version 4.15
  * mkfs --rootdir reworked, does not minimize the final image but can be still
    done using a new option --shrink
  * fix allocation of system chunk, don't allocate from the reserved area
  * other
  * new and updated tests
  * cleanups, refactoring
  * doc updates</changelog>
  <changelog author="dsterba@suse.cz" date="1518782400">- use documentation shipped by upstream tar, reduce dependencies</changelog>
  <changelog author="dsterba@suse.cz" date="1522929600">- update to version 4.16
  * libbtrfsutil - new LGPL library to wrap userspace functionality
  * several 'btrfs' commands converted to use it:
  * properties
  * filesystem sync
  * subvolume set-default/get-default/delete/show/sync
  * python bindings, tests
  * build
  * use configured pkg-config path
  * CI: add python, musl/clang, built dependencies caching
  * convert: build fix for e2fsprogs 1.44+
  * don't install library links with wrong permissions
  * fixes
  * prevent incorrect use of subvol_strip_mountpoint
  * dump-super: don't verify csum for unknown type
  * convert: fix inline extent creation condition
  * check:
  * lowmem: fix false alert for 'data extent backref lost for snapshot'
  * lowmem: fix false alert for orphan inode
  * lowmem: fix false alert for shared prealloc extents
  * mkfs:
  * add UUID and otime to root of FS_TREE - with the uuid, snapshots will
    be now linked to the toplevel subvol by the parent UUID
  * don't follow symlinks when calculating size
  * pre-create the UUID tree
  * fix --rootdir with selinux enabled
  * dump-tree: add option to print only children nodes of a given block
  * image: handle missing device for RAID1
  * other
  * new tests
  * test script cleanups (quoting, helpers)
  * tool to edit superblocks
  * updated docs
- Add patch: 0001-btrfs-progs-build-fix-static-build.patch
- Add new library packages: libbtrfsutil</changelog>
  <changelog author="dsterba@suse.cz" date="1524484800">- update to version 4.16.1
  * remove obsolete tools: btrfs-debug-tree, btrfs-zero-log, btrfs-show-super,
    btrfs-calc-size
  * sb-mod: new debugging tool to edit superblock items
  * mkfs: detect if thin-provisioned device does not have enough space
  * check: don't try to verify checksums on metadata dump images
  * build: fail documentation build if xmlto is not found
  * build: fix build of btrfs.static
- Remove patch: 0001-btrfs-progs-build-fix-static-build.patch (upstream)
- Update initrd script</changelog>
  <changelog author="jeffm@suse.com" date="1525089600">- Fix building on SLE11:
  * btrfs-progs: convert: fix support for e2fsprogs &lt; 1.42
  * btrfs-progs: build: detect whether -std=gnu90 is supported
  * btrfs-progs: build: autoconf 2.63 compatibility
  * Fixed mismerged addition of libbtrfsutil1 package description
- Added patches:
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1529582400">- update to version 4.17
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
- Removed patches (upstreamed):
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1533470400">- update to version 4.17.1
  * check:
  * add ability to fix wrong ram_bytes for compressed inline files
  * beautify progress output
  * btrfstune: allow to continue uuid change after unclean interruption
  * several fuzz fixes:
  * detect overalpping chunks
  * chunk loading error handling
  * don't crash with unexpected root refs to extents
  * relax option parsing again to allow mixing options and non-options
    arguments
  * fix qgroup rescan status reporting
  * build:
  * drop obsolete dir-test
  * new configure option to disable building of tools
  * add compatibility options --disable-static and --disable-shared
  * other:
  * cleanups and preparatory work
  * new test images
- spec cleanup</changelog>
  <changelog author="dsterba@suse.cz" date="1541937600">- update to version 4.19
  * check: support repair of fs with free-space-tree feature
  * core:
  * port delayed ref infrastructure from kernel
  * support write to free space tree
  * dump-tree: new options for BFS and DFS enumeration of b-trees
  * quota: rescan is now done automatically after 'assign'
  * btrfstune: incomplete fix to uuid change
  * subvol: fix 255 char limit checks
  * completion: complete block devices and now regular files too
  * docs:
  * ship uncompressed manual pages
  * btrfsck uses a manual page link instead of symlink
  * other
  * improved error handling
  * docs
  * new tests</changelog>
  <changelog author="dsterba@suse.cz" date="1544011200">- update to version 4.19.1
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
  * other
  * new tests
  * cleanups</changelog>
  <changelog author="nborisov@suse.com" date="1544184000">- Implement fate#325871
  * Added 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch
  * Added 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch
  * Added 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch
  * Added 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch
  * Added 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch</changelog>
  <changelog author="mfasheh@suse.com" date="1548417600">- Advise user of fs recovery options when we fail to mount (fate#320443,
  bsc#1122539)
  * Add dracut-fsck-help.txt
  * Add module-setup.sh</changelog>
  <changelog author="mfasheh@suse.com" date="1553515200">- Use correct path for dracut-fsck-help.txt in module-setup.sh (bsc#1122539)
  * Remove module-setup.sh
  * Add module-setup.sh.in</changelog>
  <changelog author="jeffm@suse.com" date="1563969600">- btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny
  metadata (bsc#1131334).
- Added patches:
  * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1581076800">- btrfs-progs: check: fix segfault with -Q (bsc#1158560)
- Added patches:
  * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch</changelog>
  <changelog author="rgoldwyn@suse.com" date="1607601600">- Enqueue feature to wait for exclusive operation to finish
  (JSC#SLE-15234)
- Added patches:
  * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch
  * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch
  * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch
  * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch
  * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch
  * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1609848000">- Refresh manual pages after the docs change (jsc#SLE-13586)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1617969600">- Correct check_running_fs_exclop() return value (bsc#1184481)
  btrfs-progs-Correct-check_running_fs_exclop-return-v.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652702400">- Ignore path devices when scanning btrfs filesystem (bsc#1199391)
  0001-btrfs-progs-build-add-optional-dependency-on-libudev.patch
  0002-btrfs-progs-ignore-devices-representing-paths-in-mul.patch
  0003-btrfs-progs-add-fallback-code-for-multipath-device-d.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652875200">- Build btrfsprogs against libudev-devel properly.
  0001-btrfs-progs-build-make-libudev-selectable.patch
- Also make libudev-devel a hard requirement in the spec file.</changelog>
</package>
<package pkgid="d881117bc1a199df1cff585cd335cf9a73fc38f460bf2c79fe7c9a848bec0a8d" name="btrfsprogs" arch="x86_64">
  <version epoch="0" ver="4.19.1" rel="150300.18.5.1"/>
  <changelog author="dsterba@suse.cz" date="1515326400">- spec: fix distro version condition</changelog>
  <changelog author="dsterba@suse.cz" date="1517486400">- update to version 4.15
  * mkfs --rootdir reworked, does not minimize the final image but can be still
    done using a new option --shrink
  * fix allocation of system chunk, don't allocate from the reserved area
  * other
  * new and updated tests
  * cleanups, refactoring
  * doc updates</changelog>
  <changelog author="dsterba@suse.cz" date="1518782400">- use documentation shipped by upstream tar, reduce dependencies</changelog>
  <changelog author="dsterba@suse.cz" date="1522929600">- update to version 4.16
  * libbtrfsutil - new LGPL library to wrap userspace functionality
  * several 'btrfs' commands converted to use it:
  * properties
  * filesystem sync
  * subvolume set-default/get-default/delete/show/sync
  * python bindings, tests
  * build
  * use configured pkg-config path
  * CI: add python, musl/clang, built dependencies caching
  * convert: build fix for e2fsprogs 1.44+
  * don't install library links with wrong permissions
  * fixes
  * prevent incorrect use of subvol_strip_mountpoint
  * dump-super: don't verify csum for unknown type
  * convert: fix inline extent creation condition
  * check:
  * lowmem: fix false alert for 'data extent backref lost for snapshot'
  * lowmem: fix false alert for orphan inode
  * lowmem: fix false alert for shared prealloc extents
  * mkfs:
  * add UUID and otime to root of FS_TREE - with the uuid, snapshots will
    be now linked to the toplevel subvol by the parent UUID
  * don't follow symlinks when calculating size
  * pre-create the UUID tree
  * fix --rootdir with selinux enabled
  * dump-tree: add option to print only children nodes of a given block
  * image: handle missing device for RAID1
  * other
  * new tests
  * test script cleanups (quoting, helpers)
  * tool to edit superblocks
  * updated docs
- Add patch: 0001-btrfs-progs-build-fix-static-build.patch
- Add new library packages: libbtrfsutil</changelog>
  <changelog author="dsterba@suse.cz" date="1524484800">- update to version 4.16.1
  * remove obsolete tools: btrfs-debug-tree, btrfs-zero-log, btrfs-show-super,
    btrfs-calc-size
  * sb-mod: new debugging tool to edit superblock items
  * mkfs: detect if thin-provisioned device does not have enough space
  * check: don't try to verify checksums on metadata dump images
  * build: fail documentation build if xmlto is not found
  * build: fix build of btrfs.static
- Remove patch: 0001-btrfs-progs-build-fix-static-build.patch (upstream)
- Update initrd script</changelog>
  <changelog author="jeffm@suse.com" date="1525089600">- Fix building on SLE11:
  * btrfs-progs: convert: fix support for e2fsprogs &lt; 1.42
  * btrfs-progs: build: detect whether -std=gnu90 is supported
  * btrfs-progs: build: autoconf 2.63 compatibility
  * Fixed mismerged addition of libbtrfsutil1 package description
- Added patches:
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1529582400">- update to version 4.17
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
- Removed patches (upstreamed):
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1533470400">- update to version 4.17.1
  * check:
  * add ability to fix wrong ram_bytes for compressed inline files
  * beautify progress output
  * btrfstune: allow to continue uuid change after unclean interruption
  * several fuzz fixes:
  * detect overalpping chunks
  * chunk loading error handling
  * don't crash with unexpected root refs to extents
  * relax option parsing again to allow mixing options and non-options
    arguments
  * fix qgroup rescan status reporting
  * build:
  * drop obsolete dir-test
  * new configure option to disable building of tools
  * add compatibility options --disable-static and --disable-shared
  * other:
  * cleanups and preparatory work
  * new test images
- spec cleanup</changelog>
  <changelog author="dsterba@suse.cz" date="1541937600">- update to version 4.19
  * check: support repair of fs with free-space-tree feature
  * core:
  * port delayed ref infrastructure from kernel
  * support write to free space tree
  * dump-tree: new options for BFS and DFS enumeration of b-trees
  * quota: rescan is now done automatically after 'assign'
  * btrfstune: incomplete fix to uuid change
  * subvol: fix 255 char limit checks
  * completion: complete block devices and now regular files too
  * docs:
  * ship uncompressed manual pages
  * btrfsck uses a manual page link instead of symlink
  * other
  * improved error handling
  * docs
  * new tests</changelog>
  <changelog author="dsterba@suse.cz" date="1544011200">- update to version 4.19.1
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
  * other
  * new tests
  * cleanups</changelog>
  <changelog author="nborisov@suse.com" date="1544184000">- Implement fate#325871
  * Added 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch
  * Added 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch
  * Added 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch
  * Added 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch
  * Added 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch</changelog>
  <changelog author="mfasheh@suse.com" date="1548417600">- Advise user of fs recovery options when we fail to mount (fate#320443,
  bsc#1122539)
  * Add dracut-fsck-help.txt
  * Add module-setup.sh</changelog>
  <changelog author="mfasheh@suse.com" date="1553515200">- Use correct path for dracut-fsck-help.txt in module-setup.sh (bsc#1122539)
  * Remove module-setup.sh
  * Add module-setup.sh.in</changelog>
  <changelog author="jeffm@suse.com" date="1563969600">- btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny
  metadata (bsc#1131334).
- Added patches:
  * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1581076800">- btrfs-progs: check: fix segfault with -Q (bsc#1158560)
- Added patches:
  * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch</changelog>
  <changelog author="rgoldwyn@suse.com" date="1607601600">- Enqueue feature to wait for exclusive operation to finish
  (JSC#SLE-15234)
- Added patches:
  * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch
  * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch
  * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch
  * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch
  * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch
  * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1609848000">- Refresh manual pages after the docs change (jsc#SLE-13586)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1617969600">- Correct check_running_fs_exclop() return value (bsc#1184481)
  btrfs-progs-Correct-check_running_fs_exclop-return-v.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652702400">- Ignore path devices when scanning btrfs filesystem (bsc#1199391)
  0001-btrfs-progs-build-add-optional-dependency-on-libudev.patch
  0002-btrfs-progs-ignore-devices-representing-paths-in-mul.patch
  0003-btrfs-progs-add-fallback-code-for-multipath-device-d.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652875200">- Build btrfsprogs against libudev-devel properly.
  0001-btrfs-progs-build-make-libudev-selectable.patch
- Also make libudev-devel a hard requirement in the spec file.</changelog>
</package>
<package pkgid="955090380db10817223909e38f3697b5cacaa380ff1ebac9eb8d270812c52c30" name="btrfsprogs-udev-rules" arch="noarch">
  <version epoch="0" ver="4.19.1" rel="150300.18.5.1"/>
  <changelog author="dsterba@suse.cz" date="1515326400">- spec: fix distro version condition</changelog>
  <changelog author="dsterba@suse.cz" date="1517486400">- update to version 4.15
  * mkfs --rootdir reworked, does not minimize the final image but can be still
    done using a new option --shrink
  * fix allocation of system chunk, don't allocate from the reserved area
  * other
  * new and updated tests
  * cleanups, refactoring
  * doc updates</changelog>
  <changelog author="dsterba@suse.cz" date="1518782400">- use documentation shipped by upstream tar, reduce dependencies</changelog>
  <changelog author="dsterba@suse.cz" date="1522929600">- update to version 4.16
  * libbtrfsutil - new LGPL library to wrap userspace functionality
  * several 'btrfs' commands converted to use it:
  * properties
  * filesystem sync
  * subvolume set-default/get-default/delete/show/sync
  * python bindings, tests
  * build
  * use configured pkg-config path
  * CI: add python, musl/clang, built dependencies caching
  * convert: build fix for e2fsprogs 1.44+
  * don't install library links with wrong permissions
  * fixes
  * prevent incorrect use of subvol_strip_mountpoint
  * dump-super: don't verify csum for unknown type
  * convert: fix inline extent creation condition
  * check:
  * lowmem: fix false alert for 'data extent backref lost for snapshot'
  * lowmem: fix false alert for orphan inode
  * lowmem: fix false alert for shared prealloc extents
  * mkfs:
  * add UUID and otime to root of FS_TREE - with the uuid, snapshots will
    be now linked to the toplevel subvol by the parent UUID
  * don't follow symlinks when calculating size
  * pre-create the UUID tree
  * fix --rootdir with selinux enabled
  * dump-tree: add option to print only children nodes of a given block
  * image: handle missing device for RAID1
  * other
  * new tests
  * test script cleanups (quoting, helpers)
  * tool to edit superblocks
  * updated docs
- Add patch: 0001-btrfs-progs-build-fix-static-build.patch
- Add new library packages: libbtrfsutil</changelog>
  <changelog author="dsterba@suse.cz" date="1524484800">- update to version 4.16.1
  * remove obsolete tools: btrfs-debug-tree, btrfs-zero-log, btrfs-show-super,
    btrfs-calc-size
  * sb-mod: new debugging tool to edit superblock items
  * mkfs: detect if thin-provisioned device does not have enough space
  * check: don't try to verify checksums on metadata dump images
  * build: fail documentation build if xmlto is not found
  * build: fix build of btrfs.static
- Remove patch: 0001-btrfs-progs-build-fix-static-build.patch (upstream)
- Update initrd script</changelog>
  <changelog author="jeffm@suse.com" date="1525089600">- Fix building on SLE11:
  * btrfs-progs: convert: fix support for e2fsprogs &lt; 1.42
  * btrfs-progs: build: detect whether -std=gnu90 is supported
  * btrfs-progs: build: autoconf 2.63 compatibility
  * Fixed mismerged addition of libbtrfsutil1 package description
- Added patches:
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1529582400">- update to version 4.17
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
- Removed patches (upstreamed):
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1533470400">- update to version 4.17.1
  * check:
  * add ability to fix wrong ram_bytes for compressed inline files
  * beautify progress output
  * btrfstune: allow to continue uuid change after unclean interruption
  * several fuzz fixes:
  * detect overalpping chunks
  * chunk loading error handling
  * don't crash with unexpected root refs to extents
  * relax option parsing again to allow mixing options and non-options
    arguments
  * fix qgroup rescan status reporting
  * build:
  * drop obsolete dir-test
  * new configure option to disable building of tools
  * add compatibility options --disable-static and --disable-shared
  * other:
  * cleanups and preparatory work
  * new test images
- spec cleanup</changelog>
  <changelog author="dsterba@suse.cz" date="1541937600">- update to version 4.19
  * check: support repair of fs with free-space-tree feature
  * core:
  * port delayed ref infrastructure from kernel
  * support write to free space tree
  * dump-tree: new options for BFS and DFS enumeration of b-trees
  * quota: rescan is now done automatically after 'assign'
  * btrfstune: incomplete fix to uuid change
  * subvol: fix 255 char limit checks
  * completion: complete block devices and now regular files too
  * docs:
  * ship uncompressed manual pages
  * btrfsck uses a manual page link instead of symlink
  * other
  * improved error handling
  * docs
  * new tests</changelog>
  <changelog author="dsterba@suse.cz" date="1544011200">- update to version 4.19.1
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
  * other
  * new tests
  * cleanups</changelog>
  <changelog author="nborisov@suse.com" date="1544184000">- Implement fate#325871
  * Added 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch
  * Added 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch
  * Added 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch
  * Added 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch
  * Added 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch</changelog>
  <changelog author="mfasheh@suse.com" date="1548417600">- Advise user of fs recovery options when we fail to mount (fate#320443,
  bsc#1122539)
  * Add dracut-fsck-help.txt
  * Add module-setup.sh</changelog>
  <changelog author="mfasheh@suse.com" date="1553515200">- Use correct path for dracut-fsck-help.txt in module-setup.sh (bsc#1122539)
  * Remove module-setup.sh
  * Add module-setup.sh.in</changelog>
  <changelog author="jeffm@suse.com" date="1563969600">- btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny
  metadata (bsc#1131334).
- Added patches:
  * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1581076800">- btrfs-progs: check: fix segfault with -Q (bsc#1158560)
- Added patches:
  * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch</changelog>
  <changelog author="rgoldwyn@suse.com" date="1607601600">- Enqueue feature to wait for exclusive operation to finish
  (JSC#SLE-15234)
- Added patches:
  * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch
  * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch
  * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch
  * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch
  * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch
  * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1609848000">- Refresh manual pages after the docs change (jsc#SLE-13586)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1617969600">- Correct check_running_fs_exclop() return value (bsc#1184481)
  btrfs-progs-Correct-check_running_fs_exclop-return-v.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652702400">- Ignore path devices when scanning btrfs filesystem (bsc#1199391)
  0001-btrfs-progs-build-add-optional-dependency-on-libudev.patch
  0002-btrfs-progs-ignore-devices-representing-paths-in-mul.patch
  0003-btrfs-progs-add-fallback-code-for-multipath-device-d.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652875200">- Build btrfsprogs against libudev-devel properly.
  0001-btrfs-progs-build-make-libudev-selectable.patch
- Also make libudev-devel a hard requirement in the spec file.</changelog>
</package>
<package pkgid="b324ca79cf631f9ae964a7d4efd8692a119b79b4a5f0dc5bb39a94f8da432c88" name="c-ares" arch="src">
  <version epoch="0" ver="1.19.0" rel="150000.3.20.1"/>
  <changelog author="jengelh@inai.de" date="1519128000">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
</package>
<package pkgid="85f4f3bcfb4452d9c52df5f8e4c8682c224f38a29370534e6080c5d9e63c3a0f" name="ca-certificates-mozilla" arch="noarch">
  <version epoch="0" ver="2.56" rel="150200.24.1"/>
  <changelog author="meissner@suse.com" date="1459944000">- diff-from-upstream-2.7.patch: restore some important legacy
  CAs, otherwise Pidgin fails to talk to Google Talk for instance.</changelog>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
</package>
<package pkgid="0605ee22c055f3c594fe9568eaf78ba497b12444e68ae67f634e44d35c5ddcf6" name="ca-certificates-mozilla" arch="src">
  <version epoch="0" ver="2.56" rel="150200.24.1"/>
  <changelog author="meissner@suse.com" date="1459944000">- diff-from-upstream-2.7.patch: restore some important legacy
  CAs, otherwise Pidgin fails to talk to Google Talk for instance.</changelog>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
</package>
<package pkgid="a4316f4ebf0ccc2e54f50f0c9367ae138e2c30f16b3fc8c5cf62b040d9831bf9" name="ca-certificates-mozilla" arch="noarch">
  <version epoch="0" ver="2.60" rel="150200.27.1"/>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
</package>
<package pkgid="e443545e1b737dfc61c141218e2b502ebcee3b14081e0449ecf61787a00ea01a" name="ca-certificates-mozilla" arch="src">
  <version epoch="0" ver="2.60" rel="150200.27.1"/>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1612872000">- Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994)
- Added new root CAs:
  - NAVER Global Root Certification Authority
- Removed old root CA:
  - GeoTrust Global CA
  - GeoTrust Primary Certification Authority
  - GeoTrust Primary Certification Authority - G3
  - GeoTrust Universal CA
  - GeoTrust Universal CA 2
  - thawte Primary Root CA
  - thawte Primary Root CA - G2
  - thawte Primary Root CA - G3
  - VeriSign Class 3 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G5</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
  <changelog author="meissner@suse.com" date="1633176000">- updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006)
- Added CAs:
  + HARICA Client ECC Root CA 2021
  + HARICA Client RSA Root CA 2021
  + HARICA TLS ECC Root CA 2021
  + HARICA TLS RSA Root CA 2021
  + TunTrust Root CA</changelog>
  <changelog author="meissner@suse.com" date="1651492800">- Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079)
  Added:
  - Autoridad de Certificacion Firmaprofesional CIF A62634068
  - D-TRUST BR Root CA 1 2020
  - D-TRUST EV Root CA 1 2020
  - GlobalSign ECC Root CA R4
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4
  - HiPKI Root CA - G1
  - ISRG Root X2
  - Telia Root CA v2
  - vTrus ECC Root CA
  - vTrus Root CA
  Removed:
  - Cybertrust Global Root
  - DST Root CA X3
  - DigiNotar PKIoverheid CA Organisatie - G2
  - GlobalSign ECC Root CA R4
  - GlobalSign Root CA R2
  - GTS Root R1
  - GTS Root R2
  - GTS Root R3
  - GTS Root R4</changelog>
  <changelog author="meissner@suse.com" date="1661774400">- Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868)
  Added:
  - Certainly Root E1
  - Certainly Root R1
  - DigiCert SMIME ECC P384 Root G5
  - DigiCert SMIME RSA4096 Root G5
  - DigiCert TLS ECC P384 Root G5
  - DigiCert TLS RSA4096 Root G5
  - E-Tugra Global Root CA ECC v3
  - E-Tugra Global Root CA RSA v3
  Removed:
  - Hellenic Academic and Research Institutions RootCA 2011</changelog>
  <changelog author="meissner@suse.com" date="1671710400">- Updated to 2.60 state of Mozilla SSL root CAs (bsc#1206622)
  Removed CAs:
  - Global Chambersign Root
  - EC-ACC
  - Network Solutions Certificate Authority
  - Staat der Nederlanden EV Root CA
  - SwissSign Platinum CA - G2
  Added CAs:
  - DIGITALSIGN GLOBAL ROOT ECDSA CA
  - DIGITALSIGN GLOBAL ROOT RSA CA
  - Security Communication ECC RootCA1
  - Security Communication RootCA3
  Changed trust:
  - TrustCor certificates only trusted up to Nov 30 (bsc#1206212)
- Removed CAs (bsc#1206212) as most code does not handle "valid before nov 30 2022"
  and it is not clear how many certs were issued for SSL middleware by TrustCor:
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
  Patch: remove-trustcor.patch</changelog>
</package>
<package pkgid="a21ebb268652c8e02380364b0383063b732dcdbdf87dabc0eafbbeb52ab2671c" name="ca-certificates-mozilla-prebuilt" arch="noarch">
  <version epoch="0" ver="2.56" rel="150200.24.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="e706bd4dd05a0ffeee210632124b2723130810d59a716e8ae19a0774f7c63f81" name="ca-certificates-mozilla-prebuilt" arch="src">
  <version epoch="0" ver="2.56" rel="150200.24.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="4ea2baa7883936f7419c6429c779c3d8df383b9da746e3fb79a53af757179199" name="ca-certificates-mozilla-prebuilt" arch="noarch">
  <version epoch="0" ver="2.60" rel="150200.27.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="3405312c4bf1b5d37d6275245b58b80b2a60dfa1a26c744638bc4b664ed1a9a4" name="ca-certificates-mozilla-prebuilt" arch="src">
  <version epoch="0" ver="2.60" rel="150200.27.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="c7b63d6691edeff1dd175e6089ec209110771b1128e3b3faaad47dfc7106e30f" name="catatonit" arch="aarch64">
  <version epoch="0" ver="0.1.7" rel="150300.10.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
</package>
<package pkgid="6c4ffab7027536bd5200c9c8e2a8477dffc138b394d1b64c7005aa083b2b75e4" name="catatonit" arch="src">
  <version epoch="0" ver="0.1.7" rel="150300.10.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
</package>
<package pkgid="ab99ecde9e7f52964b286751593a567884a82014a5a5522b9a5690cffd1b4189" name="catatonit" arch="x86_64">
  <version epoch="0" ver="0.1.7" rel="150300.10.3.1"/>
  <changelog author="asarai@suse.com" date="1522152000">- Initial import of catatonit v0.1.0.</changelog>
  <changelog author="asarai@suse.com" date="1522152001">- Update to catatonit v0.1.1, which includes a fix for the libtool requirement.
  This lets us build on much older distributions.</changelog>
  <changelog author="asarai@suse.com" date="1522324800">- Update to catatonit v0.1.2 and update links to point to openSUSE repo.</changelog>
  <changelog author="jengelh@inai.de" date="1522756800">- Update package descriptions.</changelog>
  <changelog author="asarai@suse.com" date="1523016000">- Fix build to correctly build a static binary (which will allow it to work in
  all containers). This was caused by forgetting to include
  'glibc-devel-static'. I've added a check to ensure it doesn't happen by
  accident again.
- Add catatonit-rpmlintrc to include filters for "static binary" warnings,
  since this is intentional.</changelog>
  <changelog author="asarai@suse.com" date="1524052800">- Update to catatonit v0.1.3, which includes a fix for docker compatiblity so
  that dockerd doesn't give spurrious warnings.</changelog>
  <changelog author="asarai@suse.com" date="1548763200">- Update to catatonit v0.1.4, which includes support for "-g".</changelog>
  <changelog author="asarai@suse.com" date="1583150400">- Update to catatonit v0.1.5, which fixes two bugs where catatonit would hang
  endlessly when pid1 died in very specific ways. bsc#1176155</changelog>
  <changelog author="asarai@suse.com" date="1631793600">- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to
  socket activation or features somewhat adjacent to socket activation (such as
  passing file descriptors).
- Update catatonit-rpmlintrc in order to cover that static binaries are now an
  error not a warning.</changelog>
  <changelog author="dimstar@opensuse.org" date="1637841600">- Add 99bb9048f.patch: configure.ac: call AM_INIT_AUTOMAKE only
  once. Fix build with autocnf 2.71 / automake 1.16.5.</changelog>
  <changelog author="rbrown@suse.com" date="1649678400">- Update to catatont v0.1.7
- This release adds the ability for catatonit to be used as the only
  process in a pause container, by passing the -P flag (in this mode no
  subprocess is spawned and thus no signal forwarding is done).</changelog>
</package>
<package pkgid="376bb1bb05eab4c5a58684f8ac661aab4f63b42770d074d2278cab43f3447281" name="ceph" arch="src">
  <version epoch="0" ver="16.2.9.536+g41a9f9a5573" rel="150300.6.3.1"/>
  <changelog author="ncutler@suse.com" date="1626955200">- Update to 16.2.5-110-gc5d9c915c46:
  + rebased on top of upstream commit SHA1 7feddc9819ca05586f230accd67b4e26a328e618
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path</changelog>
  <changelog author="ncutler@suse.com" date="1627387200">- Update to 16.2.5-111-ga5b472dfcf8:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9</changelog>
  <changelog author="ncutler@suse.com" date="1627646400">- Update to 16.2.5-113-g8b5bda7684e:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9
    improved version of patch that did not work as intended</changelog>
  <changelog author="ncutler@suse.com" date="1630584000">- Update to 16.2.5-504-g6a3a59bd19e:
  + rebased on top of upstream commit SHA1 0d1e1f2973cae7645126fc88a72743367c790d9d
  + (bsc#1189605) cmake: exclude "grafonnet-lib" target from "all"</changelog>
  <changelog author="sallen@suse.com" date="1632139200">- Update to Version: 16.2.6.45+g8fda9838398:
  + rebased on top of upstream commit SHA1 dbc87327c37d0f305c2107e487cb98a072ae858b
    upstream 16.2.6 release
    https://ceph.io/releases/v16-2-6-pacific-released/</changelog>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)</changelog>
</package>
<package pkgid="eb7434f1c24ba545a88000a6ab811d04bebf0e5373e47b12b8c1ecc461e35218" name="cifs-utils" arch="aarch64">
  <version epoch="0" ver="6.9" rel="150100.5.18.1"/>
  <changelog author="lmuelle@suse.com" date="1456142400">- Update to cifs-utils 6.5.
  + mount.cifs: ignore x- mount options
  + minor build fixes; obsoletes include_paths.h_for__PATH_MOUNTED.patch
  + minor manpage fix</changelog>
  <changelog author="lmuelle@suse.com" date="1456142401">- Don't ignore libldb, libtalloc, libtevent, and samba-client-libs at build
  time; (bsc#966174).</changelog>
  <changelog author="aaptel@suse.com" date="1486036800">- Use https urls.</changelog>
  <changelog author="aaptel@suse.com" date="1488888000">- Get rid of init script on everything based off SLE12+ (bsc#1025471).</changelog>
  <changelog author="aaptel@suse.com" date="1493294400">- Document SMB3+ and new seal option; (fate#322075).
  + add patch 0001-manpage-correct-typos-and-spelling-mistakes.patch
  + add patch 0002-mount.cifs-document-SMBv3.1.1-and-new-seal-option.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- update to 6.7:
  * mount.cifs cleanups
- includes 6.6:
  * cleanup/overhaul of cifs.upcall krb5 credcache handling
- partial cleanup with spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1520337600">- Update BuildIgnore to break build cycle samba-client &lt;-&gt; cifs-utils</changelog>
  <changelog author="aaptel@suse.com" date="1536580800">- Update to cifs-utils 6.8.
  + document more mount options
  + man pages now generated from RST files
  + add python-docutils build dependency
  + update keyring to check tarball signature
  + remove 0001-manpage-correct-typos-and-spelling-mistakes.patch
  + remove 0002-mount.cifs-document-SMBv3.1.1-and-new-seal-option.patch
- Add typo corrections, better doc and configure fixes from upstream
  + add 0001-docs-cleanup-rst-formating.patch
  + add 0002-mount.cifs.rst-document-new-no-handlecache-mount-opt.patch
  + add 0003-manpage-update-mount.cifs-manpage-with-info-about-rd.patch
  + add 0004-checkopts-add-python-script-to-cross-check-mount-opt.patch
  + add 0005-mount.cifs.rst-document-missing-options-correct-wron.patch
  + add 0006-cifs-utils-support-rst2man-3.patch
  + add 0007-checkopts-report-duplicated-options-in-man-page.patch
  + add 0008-mount.cifs.rst-more-cleanups.patch
  + add 0009-mount.cifs.rst-document-vers-3-mount-option.patch
  + add 0010-mount.cifs.rst-document-vers-3.02-mount-option.patch
- Cleanup spec file
  * assume SUSE vendor and SLE &gt;= 11</changelog>
  <changelog author="dmulder@suse.com" date="1549886400">- Fix python dependency stalemate by requiring python3 version of
  samba-libs.</changelog>
  <changelog author="aaptel@suse.com" date="1549972800">- Document new SMB2.1+ defaults; (bsc#1130528).
  * be more verbose on mount errors, especially with EHOSTDOWN which
    is often returned on SMB version issues.
  * add suse-document-new-vers-default-SMB2.1.patch</changelog>
  <changelog author="aaptel@suse.com" date="1550145600">- Allow cached DNS entry to expire; (fate#325270).
  * add allow-dns-resolver-key-to-expire.patch</changelog>
  <changelog author="palcantara@suse.de" date="1552392000">- Fix dependency failure on SLE15 regarding python2/python3.</changelog>
  <changelog author="aaptel@suse.com" date="1565870400">- Update to cifs-utils 6.9; (bsc#1132087); (bsc#1136031).
  * adds fixes for Azure
  * new smbinfo utility
  * remove cifs-utils-6.8.tar.bz2
  * remove cifs-utils-6.8.tar.bz2.asc
  * add cifs-utils-6.9.tar.bz2
  * add cifs-utils-6.9.tar.bz2.asc
  * add 0001-smbinfo-Improve-help-usage-and-add-h-option.patch
  * add 0002-smbinfo-Add-bash-completion-support-for-smbinfo.patch
  * add 0003-getcifsacl-Add-support-to-accept-more-paths.patch
  * add 0004-getcifsacl-Fix-usage-message-to-include-multiple-fil.patch
  * add 0005-smbinfo-add-GETCOMPRESSION-support.patch
  * add 0006-getcifsacl-Add-support-for-R-recursive-option.patch
  * add 0007-smbinfo-add-bash-completion-support-for-getcompressi.patch
  * add 0008-mount.cifs.c-fix-memory-leaks-in-main-func.patch
  * add 0009-Zero-fill-the-allocated-memory-for-new-struct-cifs_n.patch
  * add 0010-Zero-fill-the-allocated-memory-for-a-new-ACE.patch
- Remove backports that are already in 6.9; (fate#325270); (bsc#1130528);
  * remove 0001-docs-cleanup-rst-formating.patch
  * remove 0002-mount.cifs.rst-document-new-no-handlecache-mount-opt.patch
  * remove 0003-manpage-update-mount.cifs-manpage-with-info-about-rd.patch
  * remove 0004-checkopts-add-python-script-to-cross-check-mount-opt.patch
  * remove 0005-mount.cifs.rst-document-missing-options-correct-wron.patch
  * remove 0006-cifs-utils-support-rst2man-3.patch
  * remove 0007-checkopts-report-duplicated-options-in-man-page.patch
  * remove 0008-mount.cifs.rst-more-cleanups.patch
  * remove 0009-mount.cifs.rst-document-vers-3-mount-option.patch
  * remove 0010-mount.cifs.rst-document-vers-3.02-mount-option.patch
  * remove allow-dns-resolver-key-to-expire.patch
  * remove suse-document-new-vers-default-SMB2.1.patch
- Remove dependency workaround regarding python2/python3</changelog>
  <changelog author="aaptel@suse.com" date="1568030400">- Fix double-free in mount.cifs; (bsc#1149164).
  * add 0011-fix-doublefree.patch</changelog>
  <changelog author="palcantara@suse.de" date="1570017600">- Fix invalid free in mount.cifs; (bsc#1152930).
  * add 0012-mount.cifs-Fix-invalid-free.patch</changelog>
  <changelog author="aaptel@suse.com" date="1597060800">- CVE-2020-14342: Shell command injection vulnerability in mount.cifs;
  (bsc#1174477); (bso#14442); CVE-2020-14342.
  * add 0013-CVE-2020-14342-mount.cifs-fix-shell-command-injectio.patch</changelog>
  <changelog author="palcantara@suse.de" date="1615291200">- CVE-2021-20208: cifs-utils: cifs.upcall kerberos auth leak in
  container; (bsc#1183239); CVE-2021-20208.</changelog>
  <changelog author="palcantara@suse.de" date="1619438400">- cifs.upcall: fix regression in kerberos mount; (bsc#1184815).
  * add 0015-cifs.upcall-fix-regression-in-kerberos-mount.patch</changelog>
  <changelog author="palcantara@suse.de" date="1650024000">- CVE-2022-27239: mount.cifs: fix length check for ip option
  parsing; (bsc#1197216) (bso#15025); CVE-2022-27239.
  * add 0016-CVE-2022-27239-mount.cifs-fix-length-check-for-ip-op.patch</changelog>
  <changelog author="ematsumiya@suse.de" date="1657022400">- CVE-2022-29869: mount.cifs: fix verbose messages on option parsing
  (bsc#1198976, CVE-2022-29869)
  * add cifs-utils-CVE-2022-29869.patch</changelog>
</package>
<package pkgid="58e65a395e8ee95bb50f20ce83844b50d02368010f9e97ba54a95d836c3e5083" name="cifs-utils" arch="src">
  <version epoch="0" ver="6.9" rel="150100.5.18.1"/>
  <changelog author="lmuelle@suse.com" date="1456142400">- Update to cifs-utils 6.5.
  + mount.cifs: ignore x- mount options
  + minor build fixes; obsoletes include_paths.h_for__PATH_MOUNTED.patch
  + minor manpage fix</changelog>
  <changelog author="lmuelle@suse.com" date="1456142401">- Don't ignore libldb, libtalloc, libtevent, and samba-client-libs at build
  time; (bsc#966174).</changelog>
  <changelog author="aaptel@suse.com" date="1486036800">- Use https urls.</changelog>
  <changelog author="aaptel@suse.com" date="1488888000">- Get rid of init script on everything based off SLE12+ (bsc#1025471).</changelog>
  <changelog author="aaptel@suse.com" date="1493294400">- Document SMB3+ and new seal option; (fate#322075).
  + add patch 0001-manpage-correct-typos-and-spelling-mistakes.patch
  + add patch 0002-mount.cifs-document-SMBv3.1.1-and-new-seal-option.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- update to 6.7:
  * mount.cifs cleanups
- includes 6.6:
  * cleanup/overhaul of cifs.upcall krb5 credcache handling
- partial cleanup with spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1520337600">- Update BuildIgnore to break build cycle samba-client &lt;-&gt; cifs-utils</changelog>
  <changelog author="aaptel@suse.com" date="1536580800">- Update to cifs-utils 6.8.
  + document more mount options
  + man pages now generated from RST files
  + add python-docutils build dependency
  + update keyring to check tarball signature
  + remove 0001-manpage-correct-typos-and-spelling-mistakes.patch
  + remove 0002-mount.cifs-document-SMBv3.1.1-and-new-seal-option.patch
- Add typo corrections, better doc and configure fixes from upstream
  + add 0001-docs-cleanup-rst-formating.patch
  + add 0002-mount.cifs.rst-document-new-no-handlecache-mount-opt.patch
  + add 0003-manpage-update-mount.cifs-manpage-with-info-about-rd.patch
  + add 0004-checkopts-add-python-script-to-cross-check-mount-opt.patch
  + add 0005-mount.cifs.rst-document-missing-options-correct-wron.patch
  + add 0006-cifs-utils-support-rst2man-3.patch
  + add 0007-checkopts-report-duplicated-options-in-man-page.patch
  + add 0008-mount.cifs.rst-more-cleanups.patch
  + add 0009-mount.cifs.rst-document-vers-3-mount-option.patch
  + add 0010-mount.cifs.rst-document-vers-3.02-mount-option.patch
- Cleanup spec file
  * assume SUSE vendor and SLE &gt;= 11</changelog>
  <changelog author="dmulder@suse.com" date="1549886400">- Fix python dependency stalemate by requiring python3 version of
  samba-libs.</changelog>
  <changelog author="aaptel@suse.com" date="1549972800">- Document new SMB2.1+ defaults; (bsc#1130528).
  * be more verbose on mount errors, especially with EHOSTDOWN which
    is often returned on SMB version issues.
  * add suse-document-new-vers-default-SMB2.1.patch</changelog>
  <changelog author="aaptel@suse.com" date="1550145600">- Allow cached DNS entry to expire; (fate#325270).
  * add allow-dns-resolver-key-to-expire.patch</changelog>
  <changelog author="palcantara@suse.de" date="1552392000">- Fix dependency failure on SLE15 regarding python2/python3.</changelog>
  <changelog author="aaptel@suse.com" date="1565870400">- Update to cifs-utils 6.9; (bsc#1132087); (bsc#1136031).
  * adds fixes for Azure
  * new smbinfo utility
  * remove cifs-utils-6.8.tar.bz2
  * remove cifs-utils-6.8.tar.bz2.asc
  * add cifs-utils-6.9.tar.bz2
  * add cifs-utils-6.9.tar.bz2.asc
  * add 0001-smbinfo-Improve-help-usage-and-add-h-option.patch
  * add 0002-smbinfo-Add-bash-completion-support-for-smbinfo.patch
  * add 0003-getcifsacl-Add-support-to-accept-more-paths.patch
  * add 0004-getcifsacl-Fix-usage-message-to-include-multiple-fil.patch
  * add 0005-smbinfo-add-GETCOMPRESSION-support.patch
  * add 0006-getcifsacl-Add-support-for-R-recursive-option.patch
  * add 0007-smbinfo-add-bash-completion-support-for-getcompressi.patch
  * add 0008-mount.cifs.c-fix-memory-leaks-in-main-func.patch
  * add 0009-Zero-fill-the-allocated-memory-for-new-struct-cifs_n.patch
  * add 0010-Zero-fill-the-allocated-memory-for-a-new-ACE.patch
- Remove backports that are already in 6.9; (fate#325270); (bsc#1130528);
  * remove 0001-docs-cleanup-rst-formating.patch
  * remove 0002-mount.cifs.rst-document-new-no-handlecache-mount-opt.patch
  * remove 0003-manpage-update-mount.cifs-manpage-with-info-about-rd.patch
  * remove 0004-checkopts-add-python-script-to-cross-check-mount-opt.patch
  * remove 0005-mount.cifs.rst-document-missing-options-correct-wron.patch
  * remove 0006-cifs-utils-support-rst2man-3.patch
  * remove 0007-checkopts-report-duplicated-options-in-man-page.patch
  * remove 0008-mount.cifs.rst-more-cleanups.patch
  * remove 0009-mount.cifs.rst-document-vers-3-mount-option.patch
  * remove 0010-mount.cifs.rst-document-vers-3.02-mount-option.patch
  * remove allow-dns-resolver-key-to-expire.patch
  * remove suse-document-new-vers-default-SMB2.1.patch
- Remove dependency workaround regarding python2/python3</changelog>
  <changelog author="aaptel@suse.com" date="1568030400">- Fix double-free in mount.cifs; (bsc#1149164).
  * add 0011-fix-doublefree.patch</changelog>
  <changelog author="palcantara@suse.de" date="1570017600">- Fix invalid free in mount.cifs; (bsc#1152930).
  * add 0012-mount.cifs-Fix-invalid-free.patch</changelog>
  <changelog author="aaptel@suse.com" date="1597060800">- CVE-2020-14342: Shell command injection vulnerability in mount.cifs;
  (bsc#1174477); (bso#14442); CVE-2020-14342.
  * add 0013-CVE-2020-14342-mount.cifs-fix-shell-command-injectio.patch</changelog>
  <changelog author="palcantara@suse.de" date="1615291200">- CVE-2021-20208: cifs-utils: cifs.upcall kerberos auth leak in
  container; (bsc#1183239); CVE-2021-20208.</changelog>
  <changelog author="palcantara@suse.de" date="1619438400">- cifs.upcall: fix regression in kerberos mount; (bsc#1184815).
  * add 0015-cifs.upcall-fix-regression-in-kerberos-mount.patch</changelog>
  <changelog author="palcantara@suse.de" date="1650024000">- CVE-2022-27239: mount.cifs: fix length check for ip option
  parsing; (bsc#1197216) (bso#15025); CVE-2022-27239.
  * add 0016-CVE-2022-27239-mount.cifs-fix-length-check-for-ip-op.patch</changelog>
  <changelog author="ematsumiya@suse.de" date="1657022400">- CVE-2022-29869: mount.cifs: fix verbose messages on option parsing
  (bsc#1198976, CVE-2022-29869)
  * add cifs-utils-CVE-2022-29869.patch</changelog>
</package>
<package pkgid="b7eebda525e7b9ebba50ad0d5e80209b926760aef7878c33c758a7b2e393c1f4" name="cifs-utils" arch="x86_64">
  <version epoch="0" ver="6.9" rel="150100.5.18.1"/>
  <changelog author="lmuelle@suse.com" date="1456142400">- Update to cifs-utils 6.5.
  + mount.cifs: ignore x- mount options
  + minor build fixes; obsoletes include_paths.h_for__PATH_MOUNTED.patch
  + minor manpage fix</changelog>
  <changelog author="lmuelle@suse.com" date="1456142401">- Don't ignore libldb, libtalloc, libtevent, and samba-client-libs at build
  time; (bsc#966174).</changelog>
  <changelog author="aaptel@suse.com" date="1486036800">- Use https urls.</changelog>
  <changelog author="aaptel@suse.com" date="1488888000">- Get rid of init script on everything based off SLE12+ (bsc#1025471).</changelog>
  <changelog author="aaptel@suse.com" date="1493294400">- Document SMB3+ and new seal option; (fate#322075).
  + add patch 0001-manpage-correct-typos-and-spelling-mistakes.patch
  + add patch 0002-mount.cifs-document-SMBv3.1.1-and-new-seal-option.patch</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- update to 6.7:
  * mount.cifs cleanups
- includes 6.6:
  * cleanup/overhaul of cifs.upcall krb5 credcache handling
- partial cleanup with spec-cleaner</changelog>
  <changelog author="schwab@suse.de" date="1520337600">- Update BuildIgnore to break build cycle samba-client &lt;-&gt; cifs-utils</changelog>
  <changelog author="aaptel@suse.com" date="1536580800">- Update to cifs-utils 6.8.
  + document more mount options
  + man pages now generated from RST files
  + add python-docutils build dependency
  + update keyring to check tarball signature
  + remove 0001-manpage-correct-typos-and-spelling-mistakes.patch
  + remove 0002-mount.cifs-document-SMBv3.1.1-and-new-seal-option.patch
- Add typo corrections, better doc and configure fixes from upstream
  + add 0001-docs-cleanup-rst-formating.patch
  + add 0002-mount.cifs.rst-document-new-no-handlecache-mount-opt.patch
  + add 0003-manpage-update-mount.cifs-manpage-with-info-about-rd.patch
  + add 0004-checkopts-add-python-script-to-cross-check-mount-opt.patch
  + add 0005-mount.cifs.rst-document-missing-options-correct-wron.patch
  + add 0006-cifs-utils-support-rst2man-3.patch
  + add 0007-checkopts-report-duplicated-options-in-man-page.patch
  + add 0008-mount.cifs.rst-more-cleanups.patch
  + add 0009-mount.cifs.rst-document-vers-3-mount-option.patch
  + add 0010-mount.cifs.rst-document-vers-3.02-mount-option.patch
- Cleanup spec file
  * assume SUSE vendor and SLE &gt;= 11</changelog>
  <changelog author="dmulder@suse.com" date="1549886400">- Fix python dependency stalemate by requiring python3 version of
  samba-libs.</changelog>
  <changelog author="aaptel@suse.com" date="1549972800">- Document new SMB2.1+ defaults; (bsc#1130528).
  * be more verbose on mount errors, especially with EHOSTDOWN which
    is often returned on SMB version issues.
  * add suse-document-new-vers-default-SMB2.1.patch</changelog>
  <changelog author="aaptel@suse.com" date="1550145600">- Allow cached DNS entry to expire; (fate#325270).
  * add allow-dns-resolver-key-to-expire.patch</changelog>
  <changelog author="palcantara@suse.de" date="1552392000">- Fix dependency failure on SLE15 regarding python2/python3.</changelog>
  <changelog author="aaptel@suse.com" date="1565870400">- Update to cifs-utils 6.9; (bsc#1132087); (bsc#1136031).
  * adds fixes for Azure
  * new smbinfo utility
  * remove cifs-utils-6.8.tar.bz2
  * remove cifs-utils-6.8.tar.bz2.asc
  * add cifs-utils-6.9.tar.bz2
  * add cifs-utils-6.9.tar.bz2.asc
  * add 0001-smbinfo-Improve-help-usage-and-add-h-option.patch
  * add 0002-smbinfo-Add-bash-completion-support-for-smbinfo.patch
  * add 0003-getcifsacl-Add-support-to-accept-more-paths.patch
  * add 0004-getcifsacl-Fix-usage-message-to-include-multiple-fil.patch
  * add 0005-smbinfo-add-GETCOMPRESSION-support.patch
  * add 0006-getcifsacl-Add-support-for-R-recursive-option.patch
  * add 0007-smbinfo-add-bash-completion-support-for-getcompressi.patch
  * add 0008-mount.cifs.c-fix-memory-leaks-in-main-func.patch
  * add 0009-Zero-fill-the-allocated-memory-for-new-struct-cifs_n.patch
  * add 0010-Zero-fill-the-allocated-memory-for-a-new-ACE.patch
- Remove backports that are already in 6.9; (fate#325270); (bsc#1130528);
  * remove 0001-docs-cleanup-rst-formating.patch
  * remove 0002-mount.cifs.rst-document-new-no-handlecache-mount-opt.patch
  * remove 0003-manpage-update-mount.cifs-manpage-with-info-about-rd.patch
  * remove 0004-checkopts-add-python-script-to-cross-check-mount-opt.patch
  * remove 0005-mount.cifs.rst-document-missing-options-correct-wron.patch
  * remove 0006-cifs-utils-support-rst2man-3.patch
  * remove 0007-checkopts-report-duplicated-options-in-man-page.patch
  * remove 0008-mount.cifs.rst-more-cleanups.patch
  * remove 0009-mount.cifs.rst-document-vers-3-mount-option.patch
  * remove 0010-mount.cifs.rst-document-vers-3.02-mount-option.patch
  * remove allow-dns-resolver-key-to-expire.patch
  * remove suse-document-new-vers-default-SMB2.1.patch
- Remove dependency workaround regarding python2/python3</changelog>
  <changelog author="aaptel@suse.com" date="1568030400">- Fix double-free in mount.cifs; (bsc#1149164).
  * add 0011-fix-doublefree.patch</changelog>
  <changelog author="palcantara@suse.de" date="1570017600">- Fix invalid free in mount.cifs; (bsc#1152930).
  * add 0012-mount.cifs-Fix-invalid-free.patch</changelog>
  <changelog author="aaptel@suse.com" date="1597060800">- CVE-2020-14342: Shell command injection vulnerability in mount.cifs;
  (bsc#1174477); (bso#14442); CVE-2020-14342.
  * add 0013-CVE-2020-14342-mount.cifs-fix-shell-command-injectio.patch</changelog>
  <changelog author="palcantara@suse.de" date="1615291200">- CVE-2021-20208: cifs-utils: cifs.upcall kerberos auth leak in
  container; (bsc#1183239); CVE-2021-20208.</changelog>
  <changelog author="palcantara@suse.de" date="1619438400">- cifs.upcall: fix regression in kerberos mount; (bsc#1184815).
  * add 0015-cifs.upcall-fix-regression-in-kerberos-mount.patch</changelog>
  <changelog author="palcantara@suse.de" date="1650024000">- CVE-2022-27239: mount.cifs: fix length check for ip option
  parsing; (bsc#1197216) (bso#15025); CVE-2022-27239.
  * add 0016-CVE-2022-27239-mount.cifs-fix-length-check-for-ip-op.patch</changelog>
  <changelog author="ematsumiya@suse.de" date="1657022400">- CVE-2022-29869: mount.cifs: fix verbose messages on option parsing
  (bsc#1198976, CVE-2022-29869)
  * add cifs-utils-CVE-2022-29869.patch</changelog>
</package>
<package pkgid="53f0e622e7042491c07b856c2615c39967b3a18ae80ddcdbc1145244e7e42d43" name="cni" arch="aarch64">
  <version epoch="0" ver="0.7.1" rel="150100.3.8.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1487851200">- Initial version</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1488369600">- Update to version 0.4.0:
  * plugins/noop: return a helpful message for test authors
  * host-local: trim whitespace from container IDs and disk file contents
  * travis: roll forward the versions of Go that we test
  * MAINTAINERS: hi CaseyC!
  * ipam/host-local: Move allocator and config to backend
  * ipam/host-local: add ResolvConf argument for DNS configuration
  * spec: notice of version</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch
- disable usage of go modules to fix build failures with go 1.19</changelog>
</package>
<package pkgid="15f3d60315c836738b693d58199b3248b64604e3d082887bcdc6c6b86fd68a63" name="cni" arch="src">
  <version epoch="0" ver="0.7.1" rel="150100.3.8.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1487851200">- Initial version</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1488369600">- Update to version 0.4.0:
  * plugins/noop: return a helpful message for test authors
  * host-local: trim whitespace from container IDs and disk file contents
  * travis: roll forward the versions of Go that we test
  * MAINTAINERS: hi CaseyC!
  * ipam/host-local: Move allocator and config to backend
  * ipam/host-local: add ResolvConf argument for DNS configuration
  * spec: notice of version</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch
- disable usage of go modules to fix build failures with go 1.19</changelog>
</package>
<package pkgid="6ba3458feabc0788a9ae642fdbd43f651a65a5ddf3669ad4b9ddb2a05ae3d654" name="cni" arch="x86_64">
  <version epoch="0" ver="0.7.1" rel="150100.3.8.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1487851200">- Initial version</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1488369600">- Update to version 0.4.0:
  * plugins/noop: return a helpful message for test authors
  * host-local: trim whitespace from container IDs and disk file contents
  * travis: roll forward the versions of Go that we test
  * MAINTAINERS: hi CaseyC!
  * ipam/host-local: Move allocator and config to backend
  * ipam/host-local: add ResolvConf argument for DNS configuration
  * spec: notice of version</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch
- disable usage of go modules to fix build failures with go 1.19</changelog>
</package>
<package pkgid="caf90502570c09232fee7d5d166394d0a958db2cb8e621013c8f5cd534b75649" name="cni-plugin-dnsname" arch="aarch64">
  <version epoch="0" ver="1.3.1" rel="150300.1.3.1"/>
  <changelog author="rhafer@suse.com" date="1601380800">- Initial release v1.0.0</changelog>
  <changelog author="rhafer@suse.com" date="1602072000">- remove empty scriptlets
- Adjust build flags to create PIE binary</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 1.1.1:
  * Bump to v1.1.1
  * use tabs not spaces
  * Bump to v1.1
  * pass aliases to dns masq
  * Cirrus: Use images from automation_images
  * correct fedora package name in documentation
  * clarify where to report issues
  * change references from libpod to podman</changelog>
  <changelog author="ralf@h4kamp.de" date="1637323200">- Update to version 1.3.0:
  * Bump to v1.3.0
  * Output version information when called directly
  * Do not error on del command
  * Cirrus: Remove unused $DEST_BRANCH definition
  * Cleanup dangling config files
  * Update F34beta -&gt; F34 and U2010 -&gt; U2104
  * Cirrus: Add modern get_ci_vm support
  * Cirrus: Update to F34beta VM image
  * Bump to v1.2.0
  * return dnsmasq errors
  * Update podman readme
  * Add dns search domain to cni result
  * Add AppArmor instruction in the Podman readme
  * fix typo in README_PODMAN
  * Added missing comma in README_PODMAN.md
  * Cirrus: Update to F33 and U2010
  * Improve documentation of use with Podman
  * bump go-iptables version
- Fix build on SLE and Leap</changelog>
  <changelog author="idesmi@protonmail.com" date="1648209600">- Update to version 1.3.1:
  * Don't use LDFLAGS: made `dnsname` unable to build in some
    packaging systems (not ours).</changelog>
</package>
<package pkgid="8bbd308db0c7047338f37da201ca2327abb85c0d30a9422474776c960ed3d245" name="cni-plugin-dnsname" arch="ppc64le">
  <version epoch="0" ver="1.3.1" rel="150300.1.3.1"/>
  <changelog author="rhafer@suse.com" date="1601380800">- Initial release v1.0.0</changelog>
  <changelog author="rhafer@suse.com" date="1602072000">- remove empty scriptlets
- Adjust build flags to create PIE binary</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 1.1.1:
  * Bump to v1.1.1
  * use tabs not spaces
  * Bump to v1.1
  * pass aliases to dns masq
  * Cirrus: Use images from automation_images
  * correct fedora package name in documentation
  * clarify where to report issues
  * change references from libpod to podman</changelog>
  <changelog author="ralf@h4kamp.de" date="1637323200">- Update to version 1.3.0:
  * Bump to v1.3.0
  * Output version information when called directly
  * Do not error on del command
  * Cirrus: Remove unused $DEST_BRANCH definition
  * Cleanup dangling config files
  * Update F34beta -&gt; F34 and U2010 -&gt; U2104
  * Cirrus: Add modern get_ci_vm support
  * Cirrus: Update to F34beta VM image
  * Bump to v1.2.0
  * return dnsmasq errors
  * Update podman readme
  * Add dns search domain to cni result
  * Add AppArmor instruction in the Podman readme
  * fix typo in README_PODMAN
  * Added missing comma in README_PODMAN.md
  * Cirrus: Update to F33 and U2010
  * Improve documentation of use with Podman
  * bump go-iptables version
- Fix build on SLE and Leap</changelog>
  <changelog author="idesmi@protonmail.com" date="1648209600">- Update to version 1.3.1:
  * Don't use LDFLAGS: made `dnsname` unable to build in some
    packaging systems (not ours).</changelog>
</package>
<package pkgid="529499b2f0820188ca66b950226ee8e4c3f35c008154081fb68cb123ddc8dd53" name="cni-plugin-dnsname" arch="s390x">
  <version epoch="0" ver="1.3.1" rel="150300.1.3.1"/>
  <changelog author="rhafer@suse.com" date="1601380800">- Initial release v1.0.0</changelog>
  <changelog author="rhafer@suse.com" date="1602072000">- remove empty scriptlets
- Adjust build flags to create PIE binary</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 1.1.1:
  * Bump to v1.1.1
  * use tabs not spaces
  * Bump to v1.1
  * pass aliases to dns masq
  * Cirrus: Use images from automation_images
  * correct fedora package name in documentation
  * clarify where to report issues
  * change references from libpod to podman</changelog>
  <changelog author="ralf@h4kamp.de" date="1637323200">- Update to version 1.3.0:
  * Bump to v1.3.0
  * Output version information when called directly
  * Do not error on del command
  * Cirrus: Remove unused $DEST_BRANCH definition
  * Cleanup dangling config files
  * Update F34beta -&gt; F34 and U2010 -&gt; U2104
  * Cirrus: Add modern get_ci_vm support
  * Cirrus: Update to F34beta VM image
  * Bump to v1.2.0
  * return dnsmasq errors
  * Update podman readme
  * Add dns search domain to cni result
  * Add AppArmor instruction in the Podman readme
  * fix typo in README_PODMAN
  * Added missing comma in README_PODMAN.md
  * Cirrus: Update to F33 and U2010
  * Improve documentation of use with Podman
  * bump go-iptables version
- Fix build on SLE and Leap</changelog>
  <changelog author="idesmi@protonmail.com" date="1648209600">- Update to version 1.3.1:
  * Don't use LDFLAGS: made `dnsname` unable to build in some
    packaging systems (not ours).</changelog>
</package>
<package pkgid="6e81288e6d9e103a27c6ded5a1e3e68d3963091794f54a139b13b0395abba765" name="cni-plugin-dnsname" arch="src">
  <version epoch="0" ver="1.3.1" rel="150300.1.3.1"/>
  <changelog author="rhafer@suse.com" date="1601380800">- Initial release v1.0.0</changelog>
  <changelog author="rhafer@suse.com" date="1602072000">- remove empty scriptlets
- Adjust build flags to create PIE binary</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 1.1.1:
  * Bump to v1.1.1
  * use tabs not spaces
  * Bump to v1.1
  * pass aliases to dns masq
  * Cirrus: Use images from automation_images
  * correct fedora package name in documentation
  * clarify where to report issues
  * change references from libpod to podman</changelog>
  <changelog author="ralf@h4kamp.de" date="1637323200">- Update to version 1.3.0:
  * Bump to v1.3.0
  * Output version information when called directly
  * Do not error on del command
  * Cirrus: Remove unused $DEST_BRANCH definition
  * Cleanup dangling config files
  * Update F34beta -&gt; F34 and U2010 -&gt; U2104
  * Cirrus: Add modern get_ci_vm support
  * Cirrus: Update to F34beta VM image
  * Bump to v1.2.0
  * return dnsmasq errors
  * Update podman readme
  * Add dns search domain to cni result
  * Add AppArmor instruction in the Podman readme
  * fix typo in README_PODMAN
  * Added missing comma in README_PODMAN.md
  * Cirrus: Update to F33 and U2010
  * Improve documentation of use with Podman
  * bump go-iptables version
- Fix build on SLE and Leap</changelog>
  <changelog author="idesmi@protonmail.com" date="1648209600">- Update to version 1.3.1:
  * Don't use LDFLAGS: made `dnsname` unable to build in some
    packaging systems (not ours).</changelog>
</package>
<package pkgid="575c37788f86da7a064c1d0138d8f4f06356fa3e821cc1fb5d81aaf63c4ab6ec" name="cni-plugin-dnsname" arch="x86_64">
  <version epoch="0" ver="1.3.1" rel="150300.1.3.1"/>
  <changelog author="rhafer@suse.com" date="1601380800">- Initial release v1.0.0</changelog>
  <changelog author="rhafer@suse.com" date="1602072000">- remove empty scriptlets
- Adjust build flags to create PIE binary</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 1.1.1:
  * Bump to v1.1.1
  * use tabs not spaces
  * Bump to v1.1
  * pass aliases to dns masq
  * Cirrus: Use images from automation_images
  * correct fedora package name in documentation
  * clarify where to report issues
  * change references from libpod to podman</changelog>
  <changelog author="ralf@h4kamp.de" date="1637323200">- Update to version 1.3.0:
  * Bump to v1.3.0
  * Output version information when called directly
  * Do not error on del command
  * Cirrus: Remove unused $DEST_BRANCH definition
  * Cleanup dangling config files
  * Update F34beta -&gt; F34 and U2010 -&gt; U2104
  * Cirrus: Add modern get_ci_vm support
  * Cirrus: Update to F34beta VM image
  * Bump to v1.2.0
  * return dnsmasq errors
  * Update podman readme
  * Add dns search domain to cni result
  * Add AppArmor instruction in the Podman readme
  * fix typo in README_PODMAN
  * Added missing comma in README_PODMAN.md
  * Cirrus: Update to F33 and U2010
  * Improve documentation of use with Podman
  * bump go-iptables version
- Fix build on SLE and Leap</changelog>
  <changelog author="idesmi@protonmail.com" date="1648209600">- Update to version 1.3.1:
  * Don't use LDFLAGS: made `dnsname` unable to build in some
    packaging systems (not ours).</changelog>
</package>
<package pkgid="39aac73101fbb53ec9ee105d566fe25f6dad02db5a175b74b27ff374afa58d2c" name="cni-plugins" arch="aarch64">
  <version epoch="0" ver="0.8.6" rel="150100.3.11.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch</changelog>
</package>
<package pkgid="0496aee6fe90b5ad1ccaf521ad524ef5d881605a6a2426a1b609fd2270acdc77" name="cni-plugins" arch="src">
  <version epoch="0" ver="0.8.6" rel="150100.3.11.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch</changelog>
</package>
<package pkgid="dc9164408fad9aadd5887ae8a10cb99dd3248f27d913c57fe9682b9bc42a69a2" name="cni-plugins" arch="x86_64">
  <version epoch="0" ver="0.8.6" rel="150100.3.11.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dcermak@suse.com" date="1668686400">- Add patch to fix bsc#1181961 aka CVE-2021-20206
  added 0001-tighten-up-plugin-finding-logic.patch</changelog>
</package>
<package pkgid="e2907f7056a1a1cf615c3fde8936386f214b3f06becf302025e473579b0ca813" name="colord" arch="src">
  <version epoch="0" ver="1.4.4" rel="150200.4.6.1"/>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Update to version 1.3.4:
  + New Features:
  - colord:
    . Add cd_color_rgb_from_wavelength().
    . Add cd_spectrum_resample_to_size().
  - colorhug:
    . Add commands for getting the device calibration spectra.
    . Increase the size of the EP0 transfer.
    . Support enabling the illuminants on the ColorHug+.
  + Bugfixes:
  - Fix a possible NULL dereference when talking to Spark
    devices.
  - Fix compile with -Wformat-signedness.
  - Fix possible division by zero if parsing /proc/cpuinfo fails.</changelog>
  <changelog author="zaitor@opensuse.org" date="1485259200">- Split out color profiles in sub package colord-color-profiles.
  Add shared-color-profiles Obsoletes and Provides.
- Replace shared-color-profiles with colord-color-profiles
  Requires.
- Pass --enable-libcolordcompat, build compatability lib.
- Pass --enable-print-profiles, build print profiles.
- Pass --disable-examples, ensure we do not build examples.</changelog>
  <changelog author="zaitor@opensuse.org" date="1488369600">- Update to version 1.3.5:
  + New Features:
  - Add cd_color_get_blackbody_rgb_full().
  - Add cd_spectrum_multiply_scalar().
  + Bugfixes: Check the parsed context arguments in the session
    helper.</changelog>
  <changelog author="fezhang@suse.com" date="1488888000">- Apparmor profile (usr.lib.colord): Allow reading / writing
  /var/lib/colord/.cache (bsc#1024933).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1504785600">- Update to version 1.4.1:
  + Bugfixes:
  - Add back the meson -Denable-systemd=false configure argument.
  - Add the fallback rules for older PolicyKit versions.
  - Define PATH_MAX if not available.
  - Enable C99 support in meson.build.
  - Include all the files in the GIR target.
  - Include the correct file when using Colord-1.0.gir.
  - Use appropriate feature macro for realpath().
  - Use gio-2.0 when generating the VAPI.
- Changes from version 1.4.0:
  + New Features:
  - Port to the Meson build system.
  - Enable Travis CI for Fedora 25 and Debian Stretch.
  - Make PolicyKit, gusb and udev a hard requirement.
  + Bugfixes:
  - Add some experimental tools for the HueyCOLOR sensor as found
    in the P70.
  - Conditionally build documentation and man pages.
  - Correctly build the ICC transfer curve for Rec709.
  - Do not build the examples as part of the regular build.
  - Do not spin the Huey LEDs when the sensor is embedded.
  - Do not use /tmp to create profiles.
  - Fix the version numbers in cd-version.h to reflect reality.
  - Get the Huey status before trying to unlock.
  - Use a different Huey unlock code on the W700 laptop.
- Add meson BuildRequires, and switch autotools macros configure,
  make and makeinstall to meson, meson_build and meson_install
  following upstream switch to Meson Build System.
- Add gtk-doc and docbook-utils BuildRequires: new dependencies.
- Drop %glib2_gsettings_schema_* post/postun macros: the
  functionality is now covered by file triggers.
- Drop intltool and vala BuildRequires: no longer needed.
- Upstream rename of ColorHug-1.0.typelib file to
  Colorhug-1.0.typelib, thus its package has been renamed as well.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Add pkgconfig(vapigen) BuildRequires and pass
  enable-session-example=false, enable-bash-completion=true,
  enable-systemd=true, enable-libcolordcompat=true,
  enable-argyllcms-sensor=true, enable-reverse=false,
  enable-sane=false, enable-vala=true, enable-print-profiles=true,
  enable-tests=false, enable-installed-tests=false,
  with-daemon-user=colord, enable-man=true and enable-docs=true to
  meson, ensure we build the feature we want.</changelog>
  <changelog author="zaitor@opensuse.org" date="1506427200">- Add ulimit -Sv 2000000 entry before build, set ~2 GiB limit so
  that colprof is forced to work in chunks when generating the
  print profile rather than trying to allocate a 3.1 GiB chunk of
  RAM to put the entire B-to-A tables in.</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in version 1.4.5)
- Move colord-session.service and tmpfiles config from libcolord-devel to colord package</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak in
  sqlite3_exec (boo#1202802 CVE-2021-42523).</changelog>
</package>
<package pkgid="8deaa8d92f09708834a479ad594529acb4ab4dda8356cf4cdf2e820660108601" name="conmon" arch="aarch64">
  <version epoch="0" ver="2.1.5" rel="150300.8.6.1"/>
  <changelog author="rhafer@suse.com" date="1582286400">- Update to v2.0.10 (bsc#1160460, bsc#1164390, jsc#ECO-1048,
  jsc#SLE-11485, jsc#SLE-11331):
  - journal logging: write to /dev/null instead of -1</changelog>
  <changelog author="sgrunert@suse.com" date="1583409600">- Update to v2.0.11
  - log: reject --log-tag with k8s-file
  - chmod std files pipes
  - adjust score to -1000 to prevent conmon from ever being OOM
    killed
  - container OOM: verify cgroup hasn't been cleaned up before
    reporting OOM</changelog>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
</package>
<package pkgid="bd40a7052bc36b85e43130b1bfc3faa63e99fd89c2e902e33f4daeb857d0895e" name="conmon" arch="src">
  <version epoch="0" ver="2.1.5" rel="150300.8.6.1"/>
  <changelog author="rhafer@suse.com" date="1582286400">- Update to v2.0.10 (bsc#1160460, bsc#1164390, jsc#ECO-1048,
  jsc#SLE-11485, jsc#SLE-11331):
  - journal logging: write to /dev/null instead of -1</changelog>
  <changelog author="sgrunert@suse.com" date="1583409600">- Update to v2.0.11
  - log: reject --log-tag with k8s-file
  - chmod std files pipes
  - adjust score to -1000 to prevent conmon from ever being OOM
    killed
  - container OOM: verify cgroup hasn't been cleaned up before
    reporting OOM</changelog>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
</package>
<package pkgid="2837e9c6fcb1f912dd199332f8850c612f01ba74901308a429f2a33ca8f96800" name="conmon" arch="x86_64">
  <version epoch="0" ver="2.1.5" rel="150300.8.6.1"/>
  <changelog author="rhafer@suse.com" date="1582286400">- Update to v2.0.10 (bsc#1160460, bsc#1164390, jsc#ECO-1048,
  jsc#SLE-11485, jsc#SLE-11331):
  - journal logging: write to /dev/null instead of -1</changelog>
  <changelog author="sgrunert@suse.com" date="1583409600">- Update to v2.0.11
  - log: reject --log-tag with k8s-file
  - chmod std files pipes
  - adjust score to -1000 to prevent conmon from ever being OOM
    killed
  - container OOM: verify cgroup hasn't been cleaned up before
    reporting OOM</changelog>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
</package>
<package pkgid="0043c851d2a625f952dd15920ade8a694926d9a118e8180178c831f551f7b956" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.6.12" rel="150000.79.1"/>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
</package>
<package pkgid="30e2f29abfa80815a178eb4510a6318ec37235f5c79b455059260e758d614d93" name="containerd" arch="src">
  <version epoch="0" ver="1.6.12" rel="150000.79.1"/>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
</package>
<package pkgid="7cbe67a37afc579c15f55b08d688a00167875eb2a11647680b49ee03c06c5aa8" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.6.12" rel="150000.79.1"/>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
</package>
<package pkgid="f80b2d529f89f017da97f977977e3fc1c507472d2adbc04be9fff237764f95f4" name="cups" arch="src">
  <version epoch="0" ver="2.2.7" rel="150000.3.35.1"/>
  <changelog author="jsmeix@suse.de" date="1496923200">- In /usr/lib/tmpfiles.d/cups.conf use
  group 'root' for /run/cups/certs (boo#1042916).</changelog>
  <changelog author="schwab@suse.de" date="1505908800">- Pre-require user(lp) in cups-libs</changelog>
  <changelog author="jengelh@inai.de" date="1506772800">- Remove redundant Requires(pre) line? the use of %post -p
  already implies it.</changelog>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
</package>
<package pkgid="57244a0c5dd55bf5310d2ae248306ebcf46a2766d63028a7395069d19b940b1b" name="cups-config" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.35.1"/>
  <changelog author="jsmeix@suse.de" date="1496923200">- In /usr/lib/tmpfiles.d/cups.conf use
  group 'root' for /run/cups/certs (boo#1042916).</changelog>
  <changelog author="schwab@suse.de" date="1505908800">- Pre-require user(lp) in cups-libs</changelog>
  <changelog author="jengelh@inai.de" date="1506772800">- Remove redundant Requires(pre) line? the use of %post -p
  already implies it.</changelog>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
</package>
<package pkgid="a92c1a6a82493c183d370a2edf82600bbef8d939139172cd6b1f87ce3416f53a" name="cups-config" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.35.1"/>
  <changelog author="jsmeix@suse.de" date="1496923200">- In /usr/lib/tmpfiles.d/cups.conf use
  group 'root' for /run/cups/certs (boo#1042916).</changelog>
  <changelog author="schwab@suse.de" date="1505908800">- Pre-require user(lp) in cups-libs</changelog>
  <changelog author="jengelh@inai.de" date="1506772800">- Remove redundant Requires(pre) line? the use of %post -p
  already implies it.</changelog>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
</package>
<package pkgid="c1291f2eb9f38651c49462ef7ef2cbf16d1ba9b13252aa33385c4286976d8f34" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="7b68bdb9d3f5d02f6d9633985d184a5be2644463174f1cbe75dade36a81e30f7" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="0965395a2f8f6d530f447b6da9e08295feb655acd7aa723f969e504f58965428" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="f92e1f8c440720cf9ca73464e40e4fa5e6666b5545f175c1d4685172f7567f9b" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.39.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
</package>
<package pkgid="b0186160309e5579a01759541cd5c624b644830879095d85651b62266785e0fb" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="150200.4.39.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
</package>
<package pkgid="97f85baf6d872fe990754ca922e0126fd01915775634cbdc67b445fddb0f58dc" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.39.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
</package>
<package pkgid="1db41d75f6ae76723cdc2e4c8e497e65ff674e5d677480364fdce6e0a2280373" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.42.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
</package>
<package pkgid="c2332bc92556e56e9370d0ef895dee78b420849c19974ca10cc7ecbd86173402" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="150200.4.42.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
</package>
<package pkgid="78eee3a5e3790faecbf126ed06ac5af020300a041c6989f36da6379d874da4e4" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.42.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
</package>
<package pkgid="c11fd874b1c8ed5309e6c36dcb8bed89d443ad8b086f078de9793e312ca24d18" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.45.1"/>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="06028aa90a6f3f5007bb4c832f2e5a53ec0a912d4d7fc9080e9db33299bae060" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="150200.4.45.1"/>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="0800a157645676772e1ef19f1e2f31ea93009320d42109f05a81ff942dc7fc65" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.45.1"/>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="7240b970819d6e6a2495834e671478ad8e2d9eb980c495abceefb5fe96c241af" name="db48-utils" arch="aarch64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="bf090c90906276585b37e4b83099001e2af1c589e89e2ae708f848292f69c312" name="db48-utils" arch="x86_64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="10d9451cc45a70a11f6759f5afc73ac8a6420e915104fd68fb892a17c6e320ea" name="dbus-1" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="5ab26fd96ba0b965376396e7738f84c22215b81c9d8806ac7d25d702388d2542" name="dbus-1" arch="src">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="46afdca9a184bc01c720fc0246667845b9fd280a2ca18b9a943adb140942b3df" name="dbus-1" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="131c3a4ed0265536730eb5928fc81d19f8694c37cb6cfbb861c5e508886b8e50" name="dbus-1-x11" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="09a42e3580ddfa18cf16e21af808a48139c4fff2c7da16d2d63e9a75d0f7ac27" name="dbus-1-x11" arch="src">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="90fb0cc881ee60e255923d8b39190a13e87ca14a91f856067f9fab2b835706bb" name="dbus-1-x11" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="31eaaf5b88c9c93a82ed5b72de0b49acf80a3fef5531ddadba5cdb663194e8b1" name="device-mapper" arch="aarch64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="bc779a8269907bd14a561b5c6ca70c8ab9ff211da2ab1084bc9809258079ab1f" name="device-mapper" arch="x86_64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="23b73069ea19265c194b26fe661af157e2247573e5c18ccb434b4125fe8edbe5" name="docker" arch="aarch64">
  <version epoch="0" ver="20.10.17_ce" rel="150000.169.1"/>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20105&gt;. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20106&gt;. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20109&gt;. bsc#1191355
  CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
  CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637236800">- Update to Docker 20.10.11-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201011&gt;. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
  - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to Docker 20.10.12-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201012&gt;.
- Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
  changelogs are currently only available online.</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to Docker 20.10.14-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201014&gt;. bsc#1197517
  CVE-2022-24769</changelog>
  <changelog author="asarai@suse.com" date="1651233600">- Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
  bsc#1193930 bsc#1197284
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to Docker 20.10.17-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201017&gt;. bsc#1200145
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch</changelog>
  <changelog author="asarai@suse.com" date="1656504000">- Backport &lt;https://github.com/containerd/fifo/pull/32&gt; to fix a crash-on-start
  issue with dockerd. bsc#1200022
  + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch</changelog>
</package>
<package pkgid="443f3100afd67906cb3f3149f095c0e3917d767dd3752ab1e62ad0750b7d74f1" name="docker" arch="src">
  <version epoch="0" ver="20.10.17_ce" rel="150000.169.1"/>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20105&gt;. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20106&gt;. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20109&gt;. bsc#1191355
  CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
  CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637236800">- Update to Docker 20.10.11-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201011&gt;. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
  - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to Docker 20.10.12-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201012&gt;.
- Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
  changelogs are currently only available online.</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to Docker 20.10.14-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201014&gt;. bsc#1197517
  CVE-2022-24769</changelog>
  <changelog author="asarai@suse.com" date="1651233600">- Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
  bsc#1193930 bsc#1197284
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to Docker 20.10.17-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201017&gt;. bsc#1200145
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch</changelog>
  <changelog author="asarai@suse.com" date="1656504000">- Backport &lt;https://github.com/containerd/fifo/pull/32&gt; to fix a crash-on-start
  issue with dockerd. bsc#1200022
  + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch</changelog>
</package>
<package pkgid="a70b69024f0b44d821746e8c25f6e06555cc22f6311119e44ee002273f1d558a" name="docker" arch="x86_64">
  <version epoch="0" ver="20.10.17_ce" rel="150000.169.1"/>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20105&gt;. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20106&gt;. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#20109&gt;. bsc#1191355
  CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
  CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637236800">- Update to Docker 20.10.11-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201011&gt;. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
  - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to Docker 20.10.12-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201012&gt;.
- Remove CHANGELOG.md. It hasn't been maintained since 2017, and all of the
  changelogs are currently only available online.</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to Docker 20.10.14-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201014&gt;. bsc#1197517
  CVE-2022-24769</changelog>
  <changelog author="asarai@suse.com" date="1651233600">- Add patch to update golang.org/x/crypto for CVE-2021-43565 and CVE-2022-27191.
  bsc#1193930 bsc#1197284
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to Docker 20.10.17-ce. See upstream changelog online at
  &lt;https://docs.docker.com/engine/release-notes/#201017&gt;. bsc#1200145
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1193930-vendor-update-golang.org-x-crypto.patch</changelog>
  <changelog author="asarai@suse.com" date="1656504000">- Backport &lt;https://github.com/containerd/fifo/pull/32&gt; to fix a crash-on-start
  issue with dockerd. bsc#1200022
  + 0007-bsc1200022-fifo.Close-prevent-possible-panic-if-fifo.patch</changelog>
</package>
<package pkgid="786bff813400629b7da3834c0ead72aa458d3c874d538f2ebde3fb4d7206c6bb" name="dracut" arch="aarch64">
  <version epoch="0" ver="049.1+suse.247.gfb7df05c" rel="150200.3.63.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1635163200">- Update to version 049.1+suse.213.g346cf20c:
  * fix(suse): add 60-io-scheduler.rules (bsc#1188713)
  * fix(kernel-modules): add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs (bsc#1190326)</changelog>
  <changelog author="thomas.blume@suse.com" date="1636545600">- Update to version 049.1+suse.216.gf705637b:
  * fix(iscsi): add support for the new iscsiadm "no-wait" (-W) command
  * fix(iscsi): add iscsid.service requirements
    (bsc#1187190)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 049.1+suse.218.gca24e614:
  * fix(iscsi): add iscsi-init.service requirements (bsc#1193512)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1641902400">- Update to version 049.1+suse.224.gd285ddd8:
  * fix(dracut.spec): change util-linux-systemd version for SLE15-SP2 (bsc#1194162)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642680000">- Update to version 049.1+suse.228.g07676562:
  * fix(network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(install): handle builtin modules (bsc#1194716)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647604800">- Update to version 049.1+suse.232.g2ccee559:
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 049.1+suse.234.g902e489c:
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651838400">- Update to version 049.1+suse.238.gd8dbb075:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 049.1+suse.247.gfb7df05c:
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)
  * fix(drm): consider also drm_dev_register when looking for gpu driver (bsc#1195618)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
</package>
<package pkgid="7a54ac1732a7d6895de24f52936b21e916391d5d4ed1f3369a03decdf54d6bb8" name="dracut" arch="src">
  <version epoch="0" ver="049.1+suse.247.gfb7df05c" rel="150200.3.63.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1635163200">- Update to version 049.1+suse.213.g346cf20c:
  * fix(suse): add 60-io-scheduler.rules (bsc#1188713)
  * fix(kernel-modules): add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs (bsc#1190326)</changelog>
  <changelog author="thomas.blume@suse.com" date="1636545600">- Update to version 049.1+suse.216.gf705637b:
  * fix(iscsi): add support for the new iscsiadm "no-wait" (-W) command
  * fix(iscsi): add iscsid.service requirements
    (bsc#1187190)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 049.1+suse.218.gca24e614:
  * fix(iscsi): add iscsi-init.service requirements (bsc#1193512)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1641902400">- Update to version 049.1+suse.224.gd285ddd8:
  * fix(dracut.spec): change util-linux-systemd version for SLE15-SP2 (bsc#1194162)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642680000">- Update to version 049.1+suse.228.g07676562:
  * fix(network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(install): handle builtin modules (bsc#1194716)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647604800">- Update to version 049.1+suse.232.g2ccee559:
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 049.1+suse.234.g902e489c:
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651838400">- Update to version 049.1+suse.238.gd8dbb075:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 049.1+suse.247.gfb7df05c:
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)
  * fix(drm): consider also drm_dev_register when looking for gpu driver (bsc#1195618)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
</package>
<package pkgid="f0eeff15b31278d98ea5e5d449a702b224f35a65ac76e03605d563222048d2b8" name="dracut" arch="x86_64">
  <version epoch="0" ver="049.1+suse.247.gfb7df05c" rel="150200.3.63.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1635163200">- Update to version 049.1+suse.213.g346cf20c:
  * fix(suse): add 60-io-scheduler.rules (bsc#1188713)
  * fix(kernel-modules): add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs (bsc#1190326)</changelog>
  <changelog author="thomas.blume@suse.com" date="1636545600">- Update to version 049.1+suse.216.gf705637b:
  * fix(iscsi): add support for the new iscsiadm "no-wait" (-W) command
  * fix(iscsi): add iscsid.service requirements
    (bsc#1187190)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 049.1+suse.218.gca24e614:
  * fix(iscsi): add iscsi-init.service requirements (bsc#1193512)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1641902400">- Update to version 049.1+suse.224.gd285ddd8:
  * fix(dracut.spec): change util-linux-systemd version for SLE15-SP2 (bsc#1194162)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642680000">- Update to version 049.1+suse.228.g07676562:
  * fix(network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(install): handle builtin modules (bsc#1194716)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647604800">- Update to version 049.1+suse.232.g2ccee559:
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 049.1+suse.234.g902e489c:
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651838400">- Update to version 049.1+suse.238.gd8dbb075:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 049.1+suse.247.gfb7df05c:
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)
  * fix(drm): consider also drm_dev_register when looking for gpu driver (bsc#1195618)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
</package>
<package pkgid="8c45907936706494bec3efc5dcec2d4a7eca4f7786e3580011b0ba2b8fa20017" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="049.1+suse.247.gfb7df05c" rel="150200.3.63.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1635163200">- Update to version 049.1+suse.213.g346cf20c:
  * fix(suse): add 60-io-scheduler.rules (bsc#1188713)
  * fix(kernel-modules): add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs (bsc#1190326)</changelog>
  <changelog author="thomas.blume@suse.com" date="1636545600">- Update to version 049.1+suse.216.gf705637b:
  * fix(iscsi): add support for the new iscsiadm "no-wait" (-W) command
  * fix(iscsi): add iscsid.service requirements
    (bsc#1187190)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 049.1+suse.218.gca24e614:
  * fix(iscsi): add iscsi-init.service requirements (bsc#1193512)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1641902400">- Update to version 049.1+suse.224.gd285ddd8:
  * fix(dracut.spec): change util-linux-systemd version for SLE15-SP2 (bsc#1194162)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642680000">- Update to version 049.1+suse.228.g07676562:
  * fix(network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(install): handle builtin modules (bsc#1194716)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647604800">- Update to version 049.1+suse.232.g2ccee559:
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 049.1+suse.234.g902e489c:
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651838400">- Update to version 049.1+suse.238.gd8dbb075:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 049.1+suse.247.gfb7df05c:
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)
  * fix(drm): consider also drm_dev_register when looking for gpu driver (bsc#1195618)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
</package>
<package pkgid="8c3ca7c84c06682fb1731c6534c8a36f24ea815ca32a82f61b45058f15b472d6" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="049.1+suse.247.gfb7df05c" rel="150200.3.63.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1635163200">- Update to version 049.1+suse.213.g346cf20c:
  * fix(suse): add 60-io-scheduler.rules (bsc#1188713)
  * fix(kernel-modules): add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs (bsc#1190326)</changelog>
  <changelog author="thomas.blume@suse.com" date="1636545600">- Update to version 049.1+suse.216.gf705637b:
  * fix(iscsi): add support for the new iscsiadm "no-wait" (-W) command
  * fix(iscsi): add iscsid.service requirements
    (bsc#1187190)</changelog>
  <changelog author="thomas.blume@suse.com" date="1639051200">- Update to version 049.1+suse.218.gca24e614:
  * fix(iscsi): add iscsi-init.service requirements (bsc#1193512)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1641902400">- Update to version 049.1+suse.224.gd285ddd8:
  * fix(dracut.spec): change util-linux-systemd version for SLE15-SP2 (bsc#1194162)
  * fix(dracut.spec): require util-linux-systemd (bsc#1194162)
  * fix(url-lib): improve ca-bundle detection (bsc#1175892)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1642680000">- Update to version 049.1+suse.228.g07676562:
  * fix(network): consistent use of "$gw" for gateway (bsc#1192685)
  * fix(install): handle builtin modules (bsc#1194716)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647604800">- Update to version 049.1+suse.232.g2ccee559:
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(dracut-functions.sh): ip route parsing (bsc#1195011)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 049.1+suse.234.g902e489c:
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651838400">- Update to version 049.1+suse.238.gd8dbb075:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 049.1+suse.247.gfb7df05c:
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)
  * fix(drm): consider also drm_dev_register when looking for gpu driver (bsc#1195618)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
</package>
<package pkgid="a43aa3c0862d303059a62dd64687ddc9218a113513d5ae083df3260e4a9f682e" name="dracut-kiwi-lib" arch="aarch64">
  <version epoch="0" ver="9.24.36" rel="150100.3.53.2"/>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
</package>
<package pkgid="9e7811c901060d8b0e512fbae1a48c7ba167ccc106dd8a77f64d771fa4058099" name="dracut-kiwi-lib" arch="x86_64">
  <version epoch="0" ver="9.24.36" rel="150100.3.53.2"/>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
</package>
<package pkgid="8727427f3ee72426cebd0f309e86a3cb904d86a4cd89b5870508993a011552ac" name="dracut-kiwi-lib" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="34b3c729c3af5c483151ff3bb6bf8493790f0367c5a18b99d1646cab47eef43d" name="dracut-kiwi-lib" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="18febb7c235272590951470bf0ba59f2a50caa527bbfc30e16771efbf573faf0" name="dracut-kiwi-oem-dump" arch="aarch64">
  <version epoch="0" ver="9.24.36" rel="150100.3.53.2"/>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
</package>
<package pkgid="6c3e97cf4b4ea12732fb1e82aa1b3ae46eec7a94031e51c532180ff42c31bd20" name="dracut-kiwi-oem-dump" arch="x86_64">
  <version epoch="0" ver="9.24.36" rel="150100.3.53.2"/>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
</package>
<package pkgid="c02513e37a9327def791fec532b87b2a0fd7aa1ea596ef16f6f3c01445927610" name="dracut-kiwi-oem-dump" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="fb8913ec09da781c655350b427dfb683f1c1b84e90058ae2e9d959b9ce27ea5c" name="dracut-kiwi-oem-dump" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="3028ad7c7b45d17723da50c80139dda41f8b61d4874f56aae021cc9af61ba2de" name="dracut-kiwi-oem-repart" arch="aarch64">
  <version epoch="0" ver="9.24.36" rel="150100.3.53.2"/>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
</package>
<package pkgid="beaa813f32e3b0b126b9c8027439bf8af23a1100fadd8d3e9e7e86bb264ed03d" name="dracut-kiwi-oem-repart" arch="x86_64">
  <version epoch="0" ver="9.24.36" rel="150100.3.53.2"/>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
</package>
<package pkgid="e81b7ae9e4218a7f69b3f943e59b35c6feaaacc81082edca6df3ed9763a05033" name="dracut-kiwi-oem-repart" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="f9657925f6e7fc1f97ec6a285d45dfb37b4c8d66f8dbc3bbc091d802116b819c" name="dracut-kiwi-oem-repart" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="dc97de06f389dce55f25e9538302681ac8e67373fa4a61031cb815ead7592b7e" name="dracut-transactional-update" arch="noarch">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="77f401f3d538faeafd396133ba249d25374c22ed9782b2470bd51f9684cc7aa7" name="dracut-transactional-update" arch="noarch">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="cfa2a0a8f01e2212800d30a298b15592bebce5e8a844591c448cd201b81fc092" name="dwarves" arch="aarch64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="5db678ff93c3709257fe8e1ed7364a3d9ffcbf8ad40da4ae9b71bcf26f4f603b" name="dwarves" arch="src">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="9c6e03f62459f08e7a40d1f94358a4d2c88431f705a7320b4c1c5c1dfaa01954" name="dwarves" arch="x86_64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="043b64f2ddd56b2af8f4f4dfe96fb5b3f18e8462998c5923247f4db287f42e7c" name="elfutils" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="bee29b3563d6c7d81856ad625a45cc0c4079b26eae00061eca472e9fb1dd9973" name="elfutils" arch="src">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="7ec5a70242c9c157d1225288e92ce6089f5807bb093664337f0a78c858005a1f" name="elfutils" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="62fbf44f10d410c2c473f2684962bd2b123883377e576f18913c8117dda010bf" name="expat" arch="src">
  <version epoch="0" ver="2.2.5" rel="150000.3.22.1"/>
  <changelog author="mpluskal@suse.com" date="1436616000">- Cleanup spec file with spec-cleaner
- Remove old ppc obsoletes/provides</changelog>
  <changelog author="idonmez@suse.com" date="1458734400">- Update to version 2.1.1
  * Fixes CVE-2015-1283 ? Multiple integer overflows in the
    XML_GetBuffer function
  * Fix potential null pointer dereference
  * Symbol XML_SetHashSalt was not exported
  * Output of xmlwf -h was incomplete
  * Document behavior of calling XML_SetHashSalt with salt 0
  * Minor improvements to man page xmlwf(1)
- Simplify expat-visibility.patch, refresh expat-alloc-size.patch
- Drop config-guess-sub-update.patch, fixed upstream.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1459512000">- After simplification of expat-visibility.patch, it became
  uneffective as no symbols are getting hidden. add
  - fvisibility=hidden to CFLAGS again.
- expat-alloc-size.patch: fix braino, realloc()-like functions
  should not take __attribute__(malloc)</changelog>
  <changelog author="kstreitova@suse.com" date="1463572800">- add expat-2.1.1-avoid_relying_on_undef_behaviour.patch to avoid
  relying on undefined behavior in the original CVE-2015-1283 fix
  [bnc#980391], [bnc#983985], [CVE-2016-4472]
- add expat-2.1.1-parser_crashes_on_malformed_input.patch to fix
  Expat XML parser that mishandles certain kinds of malformed input
  documents [bnc#979441], [CVE-2016-0718]
- use spec-cleaner to clean specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1468497600">- Version update to 2.2.0:
  * Fixes bnc#983215 CVE-2012-6702
  * Fixes bnc#983216 CVE-2016-5300
  * Various cmake and autotools script updates
  * Fix detection of utf8 character boundaries
- Remove all patches merged upstream:
  * expat-2.1.1-avoid_relying_on_undef_behaviour.patch
  * expat-2.1.1-parser_crashes_on_malformed_input.patch
  * expat-alloc-size.patch
  * expat-visibility.patch</changelog>
  <changelog author="jengelh@inai.de" date="1468843200">- Remove pointless --with-pic (for static only)</changelog>
  <changelog author="meissner@suse.com" date="1499169600">- Version update to 2.2.1 Sat June 17 2017
  - Security fixes:
    CVE-2017-9233 / bsc#1047236 -- External entity infinite loop DoS
    Details: https://libexpat.github.io/doc/cve-2017-9233/
    Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
  - [MOX-002]      CVE-2016-9063 / bsc#1047240 -- Detect integer overflow;
    (Fixed version of existing downstream patches!)
  - (SF.net) #539  Fix regression from fix to CVE-2016-0718 cutting off
    longer tag names;
    [#25]  More integer overflow detection (function poolGrow);
  - [MOX-002]      Detect overflow from len=INT_MAX call to XML_Parse;
  - [MOX-005] #30  Use high quality entropy for hash initialization:
  * arc4random_buf on BSD, systems with libbsd
    (when configured with --with-libbsd), CloudABI
  * RtlGenRandom on Windows XP / Server 2003 and later
  * getrandom on Linux 3.17+
    In a way, that's still part of CVE-2016-5300.
    https://github.com/libexpat/libexpat/pull/30/commits
  - [MOX-005] For the low quality entropy extraction fallback code,
    the parser instance address can no longer leak,
  - [MOX-003] Prevent use of uninitialised variable; commit
  - [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
    Add missing parameter validation to public API functions
    and dedicated error code XML_ERROR_INVALID_ARGUMENT:
  - [MOX-006] * NULL checks; commits
  * Negative length (XML_Parse); commit
  - [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
  - [MOX-001] #35  Change hash algorithm to William Ahern's version of SipHash
    to go further with fixing CVE-2012-0876.
    https://github.com/libexpat/libexpat/pull/39/commits
  - Bug fixes:
    [#32] Fix sharing of hash salt across parsers;
    relevant where XML_ExternalEntityParserCreate is called
    prior to XML_Parse, in particular (e.g. FBReader)
    [#28] xmlwf: Auto-disable use of memory-mapping (and parsing
    as a single chunk) for files larger than ~1 GB (2^30 bytes)
    rather than failing with error "out of memory"
    [#3]  Fix double free after malloc failure in DTD code; commit
    7ae9c3d3af433cd4defe95234eae7dc8ed15637f
    [#17] Fix memory leak on parser error for unbound XML attribute
    prefix with new namespaces defined in the same tag;
    found by Google's OSS-Fuzz; commits
    xmlwf on Windows: Add missing calls to CloseHandle
  - New features:
    [#30] Introduced environment switch EXPAT_ENTROPY_DEBUG=1
    for runtime debugging of entropy extraction
    Bump version info from 7:2:6 to 7:3:6</changelog>
  <changelog author="mpluskal@suse.com" date="1499774400">- Build with profiling when possible</changelog>
  <changelog author="jayvdb@gmail.com" date="1507377600">- Allow building when do_profiling is undefined</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1509019200">- Version update to 2.2.4 Sat August 19 2017
  * Bug fixes:
    [#115]  Fix copying of partial characters for UTF-8 input
  * Other changes:
    [#109]  Fix "make check" for non-x86 architectures that default
    to unsigned type char (-128..127 rather than 0..255)
    [#109]  coverage.sh: Cover -funsigned-char
    Autotools: Introduce --without-xmlwf argument
    [#65]  Autotools: Replace handwritten Makefile with GNU Automake
    [#43]  CMake: Auto-detect high quality entropy extractors, add new
    option USE_libbsd=ON to use arc4random_buf of libbsd
    [#74]  CMake: Add -fno-strict-aliasing only where supported
    [#114]  CMake: Always honor manually set BUILD_* options
    [#114]  CMake: Compile man page if docbook2x-man is available, only
    [#117]  Include file tests/xmltest.log.expected in source tarball
    (required for "make run-xmltest")
    [#111]  Fix some typos in documentation
    Version info bumped from 7:5:6 to 7:6:6
- Release 2.2.3 Wed August 2 2017
  * Bug fixes:
    [#85]  Fix a dangling pointer issue related to realloc
  * Other changes:
    [#91]  Linux: Allow getrandom to fail if nonblocking pool has not
    yet been initialized and read /dev/urandom then, instead.
    This is in line with what recent Python does.
    [#86]  Check that a UTF-16 encoding in an XML declaration has the
    right endianness
  [#4] #5 #7  Recover correctly when some reallocations fail
    Repair "./configure &amp;&amp; make" for systems without any
    provider of high quality entropy
    and try reading /dev/urandom on those
    Ensure that user-defined character encodings have converter
    functions when they are needed
    Fix mis-leading description of argument -c in xmlwf.1
    Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__)
    for CloudABI
    [#100]  Fix use of SIPHASH_MAIN in siphash.h
    [#23]  Test suite: Fix memory leaks
    Version info bumped from 7:4:6 to 7:5:6
- Release 2.2.2 Wed July 12 2017
  * Security fixes:
    [#43]  Protect against compilation without any source of high
    quality entropy enabled, e.g. with CMake build system;
  * [MOX-006] Fix non-NULL parser parameter validation in XML_Parse;
    resulted in NULL dereference, previously;
  * Bug fixes:
    [#69]  Fix improper use of unsigned long long integer literals
  * Other changes:
    [#73]  Start requiring a C99 compiler
    [#49]  Fix "==" Bashism in configure script
    [#58]  Address compile warnings
    [#68]  Fix "./buildconf.sh &amp;&amp; ./configure" for some versions
    of Dash for /bin/sh
    [#72]  CMake: Ease use of Expat in context of a parent project
    with multiple CMakeLists.txt files
    [#72]  CMake: Resolve mistaken executable permissions
    [#76]  Address compile warning with -DNDEBUG (not recommended!)
    [#77]  Address compile warning about macro redefinition
  * Added patch expat-docbook.patch to compile the man pages with
  docbook-to-man
  * Cleaned spec file with spec-cleaner</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- Version update to 2.2.5 Tue October 31 2017
  * Bug fixes:
  - If the parser runs out of memory, make sure its internal
    state reflects the memory it actually has, not the memory
    it wanted to have.
  - The default handler wasn't being called when it should for
    a SYSTEM or PUBLIC doctype if an entity declaration handler
    was registered.
  - Fix a case of mistakenly reported parsing success where
    XML_StopParser was called from an element handler
  - Function XML_ErrorString was returning NULL rather than
    a message for code XML_ERROR_INVALID_ARGUMENT
    introduced with release 2.2.1
  * Other changes:
  - Add argument -N adding notation declarations
  - various compiler-specific fixes
  - Improve docbook2x-man detection
- drop expat-docbook.patch
  * fixed in 0f5186c7b8e503c669e332d944712de010b265f3
- switch to github for release tarballs and website</changelog>
  <changelog author="mpluskal@suse.com" date="1510833600">- Do not generate manpages from docbook
- Temporarily disable profiling due to bug in build system</changelog>
  <changelog author="jengelh@inai.de" date="1510833601">- Expand description of expat-devel.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix (CVE-2018-20843, bsc#1139937)
  * Large number of colons in input makes parser consume high
    amount of resources
  * Added expat-CVE-2018-20843.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567598400">- Security fix (CVE-2019-15903, bsc#1149429)
  * Crafted XML input results in heap-based buffer over-read by fooling
    the parser into changing from DTD parsing to document parsing
  * Added patches:
  - expat-CVE-2019-15903.patch
  - expat-CVE-2019-15903-tests.patch</changelog>
  <changelog author="david.anes@suse.com" date="1642420800">- Security fix (CVE-2021-45960, bsc#1194251)
  * A left shift by 29 (or more) places in the storeAtts function
    in xmlparse.c can lead to realloc misbehavior.
  * Added expat-CVE-2021-45960.patch
- Security fix (CVE-2021-46143, bsc#1194362)
  * Integer overflow exists for m_groupSize in doProlog
  * Added expat-CVE-2021-46143.patch
- Security fix (CVE-2022-22822, bsc#1194474)
  * Integer overflow in addBinding in xmlparse.c
  * Added expat-CVE-2022-22822.patch
- Security fix (CVE-2022-22823, bsc#1194476)
  * Integer overflow in build_model in xmlparse.c
  * Added expat-CVE-2022-22823.patch
- Security fix (CVE-2022-22824, bsc#1194477)
  * Integer overflow in defineAttribute in xmlparse.c
  * Added expat-CVE-2022-22824.patch
- Security fix (CVE-2022-22825, bsc#1194478)
  * Integer overflow in lookup in xmlparse.c
  * Added expat-CVE-2022-22825.patch
- Security fix (CVE-2022-22826, bsc#1194479)
  * Integer overflow in nextScaffoldPart in xmlparse.c
  * Added expat-CVE-2022-22826.patch
- Security fix (CVE-2022-22827, bsc#1194480)
  * Integer overflow in storeAtts in xmlparse.c
  * Added expat-CVE-2022-22827.patch
- Refresh expat-CVE-2018-20843.patch as a p1 patch.
- Use %autosetup macro</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- Security fix (CVE-2022-23852, bsc#1195054)
  * Expat (aka libexpat) before 2.4.4 has a signed integer overflow
    in XML_GetBuffer, for configurations with a nonzero
    XML_CONTEXT_BYTES
  * Add tests for CVE-2022-23852.
  * Added expat-CVE-2022-23852.patch
- Security fix (CVE-2022-23990, bsc#1195217)
  * Fix unsigned integer overflow in function doProlog triggered
    by large content in element type declarations when there is
    an element declaration handler present (from a prior call to
    XML_SetElementDeclHandler).
  * Add expat-CVE-2022-23990.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645444800">- Security fixes:
  * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
    attackers to insert namespace-separator characters into
    namespace URIs
  - Added expat-CVE-2022-25236.patch
  * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
    2.4.5 does not check whether a UTF-8 character is valid in a
    certain context.
  - Added expat-CVE-2022-25235.patch
  * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
    build_model() via uncontrolled recursion
  - Added expat-CVE-2022-25313.patch
  - The fix upstream introduced a regression that was later
    amended in 2.4.6 version
    + Added expat-CVE-2022-25313-fix-regression.patch
  * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
  - Added expat-CVE-2022-25314.patch
  * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
  - Added expat-CVE-2022-25315.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- Security fixes:
  * (CVE-2022-25236, bsc#1196784) [&gt;=2.4.5] Fix to CVE-2022-25236
    breaks biboumi, ClairMeta, jxmlease, libwbxml,
    openleadr-python, rnv, xmltodict
  - Added expat-CVE-2022-25236-relax-fix.patch</changelog>
  <changelog author="david.anes@suse.com" date="1664193600">- Security fix:
  * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent
    function in xmlparse.c
  - Added patch expat-CVE-2022-40674.patch</changelog>
</package>
<package pkgid="bb79d529cd65258d8c4117f159943c60a59c3857bcd15c2f8693d2f42727aafa" name="expat" arch="src">
  <version epoch="0" ver="2.2.5" rel="150000.3.25.1"/>
  <changelog author="idonmez@suse.com" date="1458734400">- Update to version 2.1.1
  * Fixes CVE-2015-1283 ? Multiple integer overflows in the
    XML_GetBuffer function
  * Fix potential null pointer dereference
  * Symbol XML_SetHashSalt was not exported
  * Output of xmlwf -h was incomplete
  * Document behavior of calling XML_SetHashSalt with salt 0
  * Minor improvements to man page xmlwf(1)
- Simplify expat-visibility.patch, refresh expat-alloc-size.patch
- Drop config-guess-sub-update.patch, fixed upstream.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1459512000">- After simplification of expat-visibility.patch, it became
  uneffective as no symbols are getting hidden. add
  - fvisibility=hidden to CFLAGS again.
- expat-alloc-size.patch: fix braino, realloc()-like functions
  should not take __attribute__(malloc)</changelog>
  <changelog author="kstreitova@suse.com" date="1463572800">- add expat-2.1.1-avoid_relying_on_undef_behaviour.patch to avoid
  relying on undefined behavior in the original CVE-2015-1283 fix
  [bnc#980391], [bnc#983985], [CVE-2016-4472]
- add expat-2.1.1-parser_crashes_on_malformed_input.patch to fix
  Expat XML parser that mishandles certain kinds of malformed input
  documents [bnc#979441], [CVE-2016-0718]
- use spec-cleaner to clean specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1468497600">- Version update to 2.2.0:
  * Fixes bnc#983215 CVE-2012-6702
  * Fixes bnc#983216 CVE-2016-5300
  * Various cmake and autotools script updates
  * Fix detection of utf8 character boundaries
- Remove all patches merged upstream:
  * expat-2.1.1-avoid_relying_on_undef_behaviour.patch
  * expat-2.1.1-parser_crashes_on_malformed_input.patch
  * expat-alloc-size.patch
  * expat-visibility.patch</changelog>
  <changelog author="jengelh@inai.de" date="1468843200">- Remove pointless --with-pic (for static only)</changelog>
  <changelog author="meissner@suse.com" date="1499169600">- Version update to 2.2.1 Sat June 17 2017
  - Security fixes:
    CVE-2017-9233 / bsc#1047236 -- External entity infinite loop DoS
    Details: https://libexpat.github.io/doc/cve-2017-9233/
    Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
  - [MOX-002]      CVE-2016-9063 / bsc#1047240 -- Detect integer overflow;
    (Fixed version of existing downstream patches!)
  - (SF.net) #539  Fix regression from fix to CVE-2016-0718 cutting off
    longer tag names;
    [#25]  More integer overflow detection (function poolGrow);
  - [MOX-002]      Detect overflow from len=INT_MAX call to XML_Parse;
  - [MOX-005] #30  Use high quality entropy for hash initialization:
  * arc4random_buf on BSD, systems with libbsd
    (when configured with --with-libbsd), CloudABI
  * RtlGenRandom on Windows XP / Server 2003 and later
  * getrandom on Linux 3.17+
    In a way, that's still part of CVE-2016-5300.
    https://github.com/libexpat/libexpat/pull/30/commits
  - [MOX-005] For the low quality entropy extraction fallback code,
    the parser instance address can no longer leak,
  - [MOX-003] Prevent use of uninitialised variable; commit
  - [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
    Add missing parameter validation to public API functions
    and dedicated error code XML_ERROR_INVALID_ARGUMENT:
  - [MOX-006] * NULL checks; commits
  * Negative length (XML_Parse); commit
  - [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
  - [MOX-001] #35  Change hash algorithm to William Ahern's version of SipHash
    to go further with fixing CVE-2012-0876.
    https://github.com/libexpat/libexpat/pull/39/commits
  - Bug fixes:
    [#32] Fix sharing of hash salt across parsers;
    relevant where XML_ExternalEntityParserCreate is called
    prior to XML_Parse, in particular (e.g. FBReader)
    [#28] xmlwf: Auto-disable use of memory-mapping (and parsing
    as a single chunk) for files larger than ~1 GB (2^30 bytes)
    rather than failing with error "out of memory"
    [#3]  Fix double free after malloc failure in DTD code; commit
    7ae9c3d3af433cd4defe95234eae7dc8ed15637f
    [#17] Fix memory leak on parser error for unbound XML attribute
    prefix with new namespaces defined in the same tag;
    found by Google's OSS-Fuzz; commits
    xmlwf on Windows: Add missing calls to CloseHandle
  - New features:
    [#30] Introduced environment switch EXPAT_ENTROPY_DEBUG=1
    for runtime debugging of entropy extraction
    Bump version info from 7:2:6 to 7:3:6</changelog>
  <changelog author="mpluskal@suse.com" date="1499774400">- Build with profiling when possible</changelog>
  <changelog author="jayvdb@gmail.com" date="1507377600">- Allow building when do_profiling is undefined</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1509019200">- Version update to 2.2.4 Sat August 19 2017
  * Bug fixes:
    [#115]  Fix copying of partial characters for UTF-8 input
  * Other changes:
    [#109]  Fix "make check" for non-x86 architectures that default
    to unsigned type char (-128..127 rather than 0..255)
    [#109]  coverage.sh: Cover -funsigned-char
    Autotools: Introduce --without-xmlwf argument
    [#65]  Autotools: Replace handwritten Makefile with GNU Automake
    [#43]  CMake: Auto-detect high quality entropy extractors, add new
    option USE_libbsd=ON to use arc4random_buf of libbsd
    [#74]  CMake: Add -fno-strict-aliasing only where supported
    [#114]  CMake: Always honor manually set BUILD_* options
    [#114]  CMake: Compile man page if docbook2x-man is available, only
    [#117]  Include file tests/xmltest.log.expected in source tarball
    (required for "make run-xmltest")
    [#111]  Fix some typos in documentation
    Version info bumped from 7:5:6 to 7:6:6
- Release 2.2.3 Wed August 2 2017
  * Bug fixes:
    [#85]  Fix a dangling pointer issue related to realloc
  * Other changes:
    [#91]  Linux: Allow getrandom to fail if nonblocking pool has not
    yet been initialized and read /dev/urandom then, instead.
    This is in line with what recent Python does.
    [#86]  Check that a UTF-16 encoding in an XML declaration has the
    right endianness
  [#4] #5 #7  Recover correctly when some reallocations fail
    Repair "./configure &amp;&amp; make" for systems without any
    provider of high quality entropy
    and try reading /dev/urandom on those
    Ensure that user-defined character encodings have converter
    functions when they are needed
    Fix mis-leading description of argument -c in xmlwf.1
    Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__)
    for CloudABI
    [#100]  Fix use of SIPHASH_MAIN in siphash.h
    [#23]  Test suite: Fix memory leaks
    Version info bumped from 7:4:6 to 7:5:6
- Release 2.2.2 Wed July 12 2017
  * Security fixes:
    [#43]  Protect against compilation without any source of high
    quality entropy enabled, e.g. with CMake build system;
  * [MOX-006] Fix non-NULL parser parameter validation in XML_Parse;
    resulted in NULL dereference, previously;
  * Bug fixes:
    [#69]  Fix improper use of unsigned long long integer literals
  * Other changes:
    [#73]  Start requiring a C99 compiler
    [#49]  Fix "==" Bashism in configure script
    [#58]  Address compile warnings
    [#68]  Fix "./buildconf.sh &amp;&amp; ./configure" for some versions
    of Dash for /bin/sh
    [#72]  CMake: Ease use of Expat in context of a parent project
    with multiple CMakeLists.txt files
    [#72]  CMake: Resolve mistaken executable permissions
    [#76]  Address compile warning with -DNDEBUG (not recommended!)
    [#77]  Address compile warning about macro redefinition
  * Added patch expat-docbook.patch to compile the man pages with
  docbook-to-man
  * Cleaned spec file with spec-cleaner</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- Version update to 2.2.5 Tue October 31 2017
  * Bug fixes:
  - If the parser runs out of memory, make sure its internal
    state reflects the memory it actually has, not the memory
    it wanted to have.
  - The default handler wasn't being called when it should for
    a SYSTEM or PUBLIC doctype if an entity declaration handler
    was registered.
  - Fix a case of mistakenly reported parsing success where
    XML_StopParser was called from an element handler
  - Function XML_ErrorString was returning NULL rather than
    a message for code XML_ERROR_INVALID_ARGUMENT
    introduced with release 2.2.1
  * Other changes:
  - Add argument -N adding notation declarations
  - various compiler-specific fixes
  - Improve docbook2x-man detection
- drop expat-docbook.patch
  * fixed in 0f5186c7b8e503c669e332d944712de010b265f3
- switch to github for release tarballs and website</changelog>
  <changelog author="mpluskal@suse.com" date="1510833600">- Do not generate manpages from docbook
- Temporarily disable profiling due to bug in build system</changelog>
  <changelog author="jengelh@inai.de" date="1510833601">- Expand description of expat-devel.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix (CVE-2018-20843, bsc#1139937)
  * Large number of colons in input makes parser consume high
    amount of resources
  * Added expat-CVE-2018-20843.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567598400">- Security fix (CVE-2019-15903, bsc#1149429)
  * Crafted XML input results in heap-based buffer over-read by fooling
    the parser into changing from DTD parsing to document parsing
  * Added patches:
  - expat-CVE-2019-15903.patch
  - expat-CVE-2019-15903-tests.patch</changelog>
  <changelog author="david.anes@suse.com" date="1642420800">- Security fix (CVE-2021-45960, bsc#1194251)
  * A left shift by 29 (or more) places in the storeAtts function
    in xmlparse.c can lead to realloc misbehavior.
  * Added expat-CVE-2021-45960.patch
- Security fix (CVE-2021-46143, bsc#1194362)
  * Integer overflow exists for m_groupSize in doProlog
  * Added expat-CVE-2021-46143.patch
- Security fix (CVE-2022-22822, bsc#1194474)
  * Integer overflow in addBinding in xmlparse.c
  * Added expat-CVE-2022-22822.patch
- Security fix (CVE-2022-22823, bsc#1194476)
  * Integer overflow in build_model in xmlparse.c
  * Added expat-CVE-2022-22823.patch
- Security fix (CVE-2022-22824, bsc#1194477)
  * Integer overflow in defineAttribute in xmlparse.c
  * Added expat-CVE-2022-22824.patch
- Security fix (CVE-2022-22825, bsc#1194478)
  * Integer overflow in lookup in xmlparse.c
  * Added expat-CVE-2022-22825.patch
- Security fix (CVE-2022-22826, bsc#1194479)
  * Integer overflow in nextScaffoldPart in xmlparse.c
  * Added expat-CVE-2022-22826.patch
- Security fix (CVE-2022-22827, bsc#1194480)
  * Integer overflow in storeAtts in xmlparse.c
  * Added expat-CVE-2022-22827.patch
- Refresh expat-CVE-2018-20843.patch as a p1 patch.
- Use %autosetup macro</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- Security fix (CVE-2022-23852, bsc#1195054)
  * Expat (aka libexpat) before 2.4.4 has a signed integer overflow
    in XML_GetBuffer, for configurations with a nonzero
    XML_CONTEXT_BYTES
  * Add tests for CVE-2022-23852.
  * Added expat-CVE-2022-23852.patch
- Security fix (CVE-2022-23990, bsc#1195217)
  * Fix unsigned integer overflow in function doProlog triggered
    by large content in element type declarations when there is
    an element declaration handler present (from a prior call to
    XML_SetElementDeclHandler).
  * Add expat-CVE-2022-23990.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645444800">- Security fixes:
  * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
    attackers to insert namespace-separator characters into
    namespace URIs
  - Added expat-CVE-2022-25236.patch
  * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
    2.4.5 does not check whether a UTF-8 character is valid in a
    certain context.
  - Added expat-CVE-2022-25235.patch
  * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
    build_model() via uncontrolled recursion
  - Added expat-CVE-2022-25313.patch
  - The fix upstream introduced a regression that was later
    amended in 2.4.6 version
    + Added expat-CVE-2022-25313-fix-regression.patch
  * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
  - Added expat-CVE-2022-25314.patch
  * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
  - Added expat-CVE-2022-25315.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- Security fixes:
  * (CVE-2022-25236, bsc#1196784) [&gt;=2.4.5] Fix to CVE-2022-25236
    breaks biboumi, ClairMeta, jxmlease, libwbxml,
    openleadr-python, rnv, xmltodict
  - Added expat-CVE-2022-25236-relax-fix.patch</changelog>
  <changelog author="david.anes@suse.com" date="1664193600">- Security fix:
  * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent
    function in xmlparse.c
  - Added patch expat-CVE-2022-40674.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Security fix:
  * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager
    destruction of a shared DTD in XML_ExternalEntityParserCreate in
    out-of-memory situations
  - Added patch expat-CVE-2022-43680.patch</changelog>
</package>
<package pkgid="8c41b62fa28b3cba1bb52a63b02c0ca9df19e931aa6aa2b6ba3bc5582e6f0c5b" name="fmt" arch="src">
  <version epoch="0" ver="8.0.1" rel="150300.7.5.1"/>
  <changelog author="olaf@aepfle.de" date="1553515200">- Install fmt.pc into libdir with
  0001-install-pkg-config-file-into-libdir.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1575028800">- Update to version 6.0.0
  (too many changes to list, see ChangeLog.rst)
- Dropped 0001-install-pkg-config-file-into-libdir.patch (no
  longer necessary)
- Switched to MIT license
- Increased SOVERSION to 6</changelog>
  <changelog author="aloisio@gmx.com" date="1575201600">- Added fmt-bigendian_1.patch, fmt-bigendian_2.patch,
  fmt-bigendian_3.patch and fmt-bigendian_4.patch to fix tests
  on big endian targets</changelog>
  <changelog author="aloisio@gmx.com" date="1575460800">- Update to version 6.1.0
  * {fmt} now formats IEEE 754 ``float`` and ``double`` using
    the shortest decimal representation with correct rounding by
    default:
    .. code:: c++
    [#]include &lt;cmath&gt;
    [#]include &lt;fmt/core.h&gt;
    int main() {
    fmt::print("{}", M_PI);
    }
    prints ``3.141592653589793``.
  * Made the fast binary to decimal floating-point formatter the
    default, simplified it and improved performance. {fmt} is now
    15 times faster than libc++'s ``std::ostringstream``, 11
    times faster than ``printf`` and 10% faster than
    double-conversion on `dtoa-benchmark
    (https://github.com/fmtlib/dtoa-benchmark)
    ==================  =========  =======
    Function            Time (ns)  Speedup
    ==================  =========  =======
    ostringstream        1,346.30    1.00x
    ostrstream           1,195.74    1.13x
    sprintf                995.08    1.35x
    doubleconv              99.10   13.59x
    fmt                     88.34   15.24x
    ==================  =========  =======
  * {fmt} no longer converts ``float`` arguments to ``double``.
    In particular this improves the default (shortest)
    representation of floats and makes
    ``fmt::format`` consistent with ``std::format`` specs
    (#1336, #1353, #1360, #1361)
    .. code:: c++
    fmt::print("{}", 0.1f);
    prints ``0.1`` instead of ``0.10000000149011612``.
  * Made floating-point formatting output consistent with
    ``printf``/iostreams (#1376, #1417)
  * Added support for 128-bit integers (#1287)
    .. code:: c++
    fmt::print("{}", std::numeric_limits&lt;__int128_t&gt;::max());
    prints ``170141183460469231731687303715884105727``.
  * The overload of ``print`` that takes ``text_style`` is now
    atomic, i.e. the output from different threads doesn't
    interleave (#1351)
  * Made compile time in the header-only mode ~20% faster by
    reducing the number of template instantiations. ``wchar_t``
    overload of ``vprint`` was moved from
    ``fmt/core.h`` to ``fmt/format.h``.
  * Added an overload of ``fmt::join`` that works with tuples
    (#1322, #1330)
    .. code:: c++
    [#]include &lt;tuple&gt;
    [#]include &lt;fmt/ranges.h&gt;
    int main() {
    std::tuple&lt;char, int, float&gt; t{'a', 1, 2.0f};
    fmt::print("{}", t);
    }
    prints ``('a', 1, 2.0)``.
  * Changed formatting of octal zero with prefix from "0o0" to
    "0":
    .. code:: c++
    fmt::print("{:#o}", 0);
    prints ``0``.
  * The locale is now passed to ostream insertion (``&lt;&lt;``)
    operators (#1406)
    .. code:: c++
    [#]include &lt;fmt/locale.h&gt;
    [#]include &lt;fmt/ostream.h&gt;
    struct S {
    double value;
    };
    std::ostream&amp; operator&lt;&lt;(std::ostream&amp; os, S s) {
    return os &lt;&lt; s.value;
    }
    int main() {
    auto s = fmt::format(std::locale("fr_FR.UTF-8"), "{}", S{0.42});
    // s == "0,42"
    }
  * Locale-specific number formatting now uses grouping (#1393,
    [#1394])
  * Fixed handling of types with deleted implicit rvalue
    conversion to ``const char**`` (#1421)
    .. code:: c++
    struct mystring {
    operator const char*() const&amp;;
    operator const char*() &amp;;
    operator const char*() const&amp;&amp; = delete;
    operator const char*() &amp;&amp; = delete;
    };
    mystring str;
    fmt::print("{}", str); // now compiles
  * Enums are now mapped to correct underlying types instead of
    ``int`` (#1286)
  * Enum classes are no longer implicitly converted to ``int``
    (#1424)
  * Added ``basic_format_parse_context`` for consistency with
    C++20 ``std::format`` and deprecated ``basic_parse_context``.
  * Fixed handling of UTF-8 in precision (#1389, #1390)
  * Added a CUDA test (#1285, #1317)
  * Improved documentation (#1276, #1291, #1296, #1315, #1332,
    [#1337], #1395, #1418)
  * Various code improvements (#1358, #1407)
  * Fixed compile-time format string checks for user-defined
    types (#1292)
  * Worked around a false positive in
    ``unsigned-integer-overflow`` sanitizer (#1377)
  * Fixed various warnings and compilation issues (#1273, #1278,
    [#1280], #1281, #1288, #1290, #1301, #1305, #1306, #1309,
    [#1312], #1313, #1316, #1319, #1320, #1326, #1328, #1344,
    [#1345], #1347, #1349, #1354, #1362, #1366, #1364, #1370,
    [#1371], #1385, #1388, #1397, #1414, #1416, #1422, #1427,
    [#1431], #1433)
- Dropped fmt-bigendian_1.patch, fmt-bigendian_2.patch,
  fmt-bigendian_3.patch and fmt-bigendian_4.patch (merged
  upstream)</changelog>
  <changelog author="aloisio@gmx.com" date="1575547200">- Update to version 6.1.1
  * Added a missing decimal point in exponent notation with
    trailing zeros.
  * Removed deprecated format_arg_store::TYPES.</changelog>
  <changelog author="aloisio@gmx.com" date="1576065600">- Update to version 6.1.2
  * Fixed ABI compatibility with libfmt.so.6.0.0 (#1471).
  * Fixed handling types convertible to std::string_view (#1451).
    Thanks @denizevrenci (Deniz Evrenci).
  * Made CUDA test an opt-in enabled via the FMT_CUDA_TEST CMake
    option.
  * Fixed sign conversion warnings (#1440). Thanks @0x8000-0000
    (Florin Iucha).</changelog>
  <changelog author="aloisio@gmx.com" date="1586174400">- Update to version 6.2.0
  * Improved error reporting when trying to format an object of
    a non-formattable type:
  * Reduced library size by ~10%.
  * Always print decimal point if # is specified (#1476, #1498):
  * Implemented the 'L' specifier for locale-specific numeric
    formatting to improve compatibility with std::format. The 'n'
    specifier is now deprecated and will be removed in the next
    major release.
  * Moved OS-specific APIs such as windows_error from
    fmt/format.h to fmt/os.h. You can define
    FMT_DEPRECATED_INCLUDE_OS to automatically include fmt/os.h from
    fmt/format.h for compatibility but this will be disabled in the
    next major release.
  * Added precision overflow detection in floating-point
    formatting.
  * Implemented detection of invalid use of fmt::arg.
  * Used type_identity to block unnecessary template argument
    deduction.
  * Improved UTF-8 handling (#1109):
  * Added experimental dynamic argument storage (#1170, #1584):
  * Made fmt::join accept initializer_list (#1591).
  * Fixed handling of empty tuples (#1588).
  * Fixed handling of output iterators in format_to_n (#1506).
  * Fixed formatting of std::chrono::duration types to wide
    output (#1533).
  * Added const begin and end overload to buffers (#1553).
  * Added the ability to disable floating-point formatting via
    FMT_USE_FLOAT, FMT_USE_DOUBLE and FMT_USE_LONG_DOUBLE macros for
    extremely memory-constrained embedded system (#1590).
  * Made FMT_STRING work with constexpr string_view (#1589).
  * Implemented a minor optimization in the format string parser
    (#1560).
  * Improved attribute detection (#1469, #1475, #1576).
  * Improved documentation (#1481, #1523).
  * Fixed symbol visibility on Linux when compiling with
  - fvisibility=hidden (#1535).
  * Implemented various build configuration fixes and
    improvements (#1264, #1460, #1534, #1536, #1545, #1546, #1566,
    [#1582], #1597, #1598).
  * Fixed various warnings and compilation issues
- Dropped Group tag</changelog>
  <changelog author="hpj@urpla.net" date="1586865600">- Apply 7d01859ef16e6b65bc023ad8bebfedecb088bf81.patch
  to fix kodi compilation and probably others:
  https://github.com/fmtlib/fmt/issues/1620</changelog>
  <changelog author="aloisio@gmx.com" date="1589025600">- Update to version 6.2.1
  * Fixed ostream support in ``sprintf``
    (`#1631 &lt;https://github.com/fmtlib/fmt/issues/1631&gt;`_).
  * Fixed type detection when using implicit conversion to
    ``string_view`` and ostream ``operator&lt;&lt;`` inconsistently
    (`#1662 &lt;https://github.com/fmtlib/fmt/issues/1662&gt;`_).
- Drop 7d01859ef16e6b65bc023ad8bebfedecb088bf81.patch (no longer
  necessary)
- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1592913600">- Add fmt-6.2.1-fix_pkgconfig_paths.patch (fix for boo#1173270)</changelog>
  <changelog author="aloisio@gmx.com" date="1594036800">- Update to version 7.0.0
  * Reduced the library size.
  * Added a simpler and more efficient format string compilation
    API. The old fmt::compile API is now deprecated.
  * Optimized integer formatting: format_to with format string
    compilation and a stack-allocated buffer is now faster than
    to_chars on both libc++ and libstdc++.
  * Optimized handling of small format strings.
  * Applied extern templates to improve compile times when using
    the core API and fmt/format.h. It is still recommended to use
    fmt/core.h instead of fmt/format.h but the compile time
    difference is now smaller.
  * Named arguments are now stored on stack (no dynamic memory
    allocations) and the compiled code is more compact and
    efficient.
  * Implemented compile-time checks for dynamic width and
    precision.
  * Added sentinel support to fmt::join.
  * Added support for named args, clear and reserve to
    dynamic_format_arg_store.
  * Added support for the 'c' format specifier to integral types
    for compatibility with std::format.
  * Replaced the 'n' format specifier with 'L' for compatibility
    with std::format. The 'n' specifier can be enabled via the
    FMT_DEPRECATED_N_SPECIFIER macro.
  * The '=' format specifier is now disabled by default for
    compatibility with std::format. It can be enabled via the
    FMT_DEPRECATED_NUMERIC_ALIGN macro.
  * Removed the following deprecated APIs:
    + FMT_STRING_ALIAS and fmt macros - replaced by
    FMT_STRING
    + fmt::basic_string_view::char_type - replaced by
    fmt::basic_string_view::value_type
    + convert_to_int
    + format_arg_store::types
    + *parse_context - replaced by *format_parse_context
    + FMT_DEPRECATED_INCLUDE_OS
    + FMT_DEPRECATED_PERCENT - incompatible with
    std::format
    + *writer - replaced by compiled format API
  * Renamed the internal namespace to detail. The former is
    still provided as an alias if the FMT_USE_INTERNAL macro is
    defined.
  * Improved compatibility between fmt::printf with the standard
    specs.
  * Fixed handling of operator&lt;&lt; overloads that use copyfmt.
  * Added the FMT_OS CMake option to control inclusion of
    OS-specific APIs in the fmt target. This can be useful for
    embedded platforms.
  * Replaced FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION with the
    FMT_FUZZ macro to prevent interferring with fuzzing of
    projects using {fmt}.
  * Fixed compatibility with emscripten.
  * Improved documentation.
  * Implemented various build configuration fixes and
    improvements.
  * Fixed various warnings and compilation issues.
- Drop fmt-6.2.1-fix_pkgconfig_paths.patch
- Bump sover to 7</changelog>
  <changelog author="aloisio@gmx.com" date="1594123200">- Update to version 7.0.1
  * Updated the inline version namespace name.
  * Worked around a gcc bug in mangling of alias templates
  * Fixed minor issues with the documentation.</changelog>
  <changelog author="aloisio@gmx.com" date="1596024000">- Update to version 7.0.2
  * Worked around broken ``numeric_limits`` for 128-bit integers
  * Fixed compatibility with CMake 3.4
  * Fixed handling of digit separators in locale-specific
    formatting</changelog>
  <changelog author="aloisio@gmx.com" date="1596801600">- Update to version 7.0.3
  * Worked around broken ``numeric_limits`` for 128-bit integers
  * Added error reporting on missing named arguments
  * Stopped using 128-bit integers with clang-cl
  * Fixed issues in locale-specific integer formatting</changelog>
  <changelog author="aloisio@gmx.com" date="1603713600">- Update to version 7.1.0
  * Switched from Grisu3 to Dragonbox for the default
    floating-point formatting which gives the shortest decimal
    representation with round-trip guarantee and correct rounding.
    This makes {fmt} up to 20-30x faster than common
    implementations of std::ostringstream and sprintf on
    dtoa-benchmark and faster than double-conversion and Ry?. It
    is possible to get even better performance at the cost of
    larger binary size by compiling with the
    FMT_USE_FULL_CACHE_DRAGONBOX macro set to 1.
  * Added an experimental unsynchronized file output API which,
    together with format string compilation can give 5-9 times
    speed up compared to fprintf on common platforms.
  * Added a formatter for std::chrono::time_point&lt;system_clock&gt;
  * Added support for ranges with non-const begin/end to fmt::join
  * Added a memory_buffer::append overload that takes a range.
  * Improved handling of single code units in FMT_COMPILE.
  * Added dynamic width support to format string compilation.
  * Improved error reporting for unformattable types: now you'll
    get the type name directly in the error message instead of
    the note.
  * Added the make_args_checked function template that allows
    you to write formatting functions with compile-time format
    string checks and avoid binary code bloat.
  * Replaced snprintf fallback with a faster internal IEEE 754
    float and double formatter for arbitrary precision.
  * Made format_to_n and formatted_size part of the core API.
  * Added fmt::format_to_n overload with format string
    compilation.
  * Added fmt::format_to overload that take text_style.
  * Made the # specifier emit trailing zeros in addition to the
    decimal point.
  * Changed the default floating point format to not include .0
    for consistency with std::format and std::to_chars. It is
    possible to get the decimal point and trailing zero with the
    [#] specifier.
  * Fixed an issue with floating-point formatting that could
    result in addition of a non-significant trailing zero in
    rare cases e.g. 1.00e-34 instead of 1.0e-34.
  * Made fmt::to_string fallback on ostream insertion operator
    if the formatter specialization is not provided.
  * Added support for the append mode to the experimental file
    API and improved fcntl.h detection.
  * Fixed handling of types that have both an implicit
    conversion operator and an overloaded ostream insertion
    operator.
  * Fixed a slicing issue in an internal iterator type.
  * Fixed an issue in locale-specific integer formatting.
  * Fixed handling of exotic code unit types.
  * Improved FMT_ALWAYS_INLINE.
  * Improved documentation.
  * Added the FMT_REDUCE_INT_INSTANTIATIONS CMake option that
    reduces the binary code size at the cost of some integer
    formatting performance. This can be useful for extremely
    memory-constrained embedded systems.
  * Added the FMT_USE_INLINE_NAMESPACES macro to control usage
    of inline namespaces.
  * Improved build configuration.
  * Fixed various warnings and compilation issues.
- Add fmt-7.1.0-LTO.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1604318400">- Update to version 7.1.1
  * Fixed ABI compatibility with 7.0.x
  * Added the FMT_ARM_ABI_COMPATIBILITY macro to work around
    ABI incompatibility between GCC and Clang on ARM
  * Worked around a SFINAE bug in GCC 8
  * Fixed linkage errors when building with GCC's LTO
  * Fixed a compilation error when building without
    __builtin_clz or equivalent
  * Fixed a sign conversion warning
- Dropped fmt-7.1.0-LTO.patch (merged upstream)</changelog>
  <changelog author="aloisio@gmx.com" date="1604491200">- Update to version 7.1.2
  * Fixed floating point formatting with large precision</changelog>
  <changelog author="aloisio@gmx.com" date="1606305600">- Update to version 7.1.3
  * Fixed handling of buffer boundaries in format_to_n
  * Fixed linkage errors when linking with a shared library
  * Reintroduced ostream support to range formatters
  * Worked around an issue with mixing std versions in gcc</changelog>
  <changelog author="aloisio@gmx.com" date="1624276800">- Update to version 8.0.0
  * Enabled compile-time format string check by default.
  * Added compile-time formatting.
  * Optimized handling of format specifiers during format string
    compilation.
  * Added the ``_cf`` user-defined literal to represent a
    compiled format string. It can be used instead of the
    ``FMT_COMPILE`` macro.
  * Format string compilation now requires ``format`` functions
    of ``formatter`` specializations for user-defined types to
    be ``const``.
  * Added UDL-based named argument support to format string
    compilation.
  * Added format string compilation support to ``fmt::print``.
  * Added initial support for compiling {fmt} as a C++20 module.
  * Made symbols private by default reducing shared library size
  * Optimized includes making the result of preprocessing
    ``fmt/format.h``.
  * Added support of ranges with non-const ``begin`` / ``end``
  * Added support of ``std::byte`` and other formattable types
    to ``fmt::join``.
  * Implemented the default format for
    ``std::chrono::system_clock``.
  * Made more chrono specifiers locale independent by default.
    Use the ``'L'`` specifier to get localized formatting.
  * Improved locale handling in chrono formatting.
  * Deprecated ``fmt/locale.h`` moving the formatting functions
    that take a locale to ``fmt/format.h`` (``char``) and
    ``fmt/xchar`` (other overloads). This doesn't introduce a
    dependency on ``&lt;locale&gt;`` so there is virtually no compile
    time effect.
  * Made parameter order in ``vformat_to`` consistent with
    ``format_to``.
  * Added support for time points with arbitrary durations.
  * Formatting floating-point numbers no longer produces
    trailing zeros by default.
    for consistency with ``std::format``.
  * Dropped a limit on the number of elements in a range and
    replaced ``{}`` with ``[]`` as range delimiters for
    consistency with Python's ``str.format``.
  * The ``'L'`` specifier for locale-specific numeric formatting
    can now be combined with presentation specifiers as in
    ``std::format``.
  * Made the ``0`` specifier ignored for infinity and NaN.
  * Made the hexfloat formatting use the right alignment by
    default.
  * Removed the deprecated numeric alignment (``'='``). Use the
    ``'0'`` specifier instead.
  * Removed the deprecated ``fmt/posix.h`` header that has been
    replaced with ``fmt/os.h``.
  * Removed the deprecated ``format_to_n_context``,
    ``format_to_n_args`` and ``make_format_to_n_args``. They
    have been replaced with ``format_context``, ``format_args`
    and ``make_format_args`` respectively.
  * Moved ``wchar_t``-specific functions and types to
    ``fmt/wchar.h``. You can define
    ``FMT_DEPRECATED_INCLUDE_WCHAR`` to automatically include
    ``fmt/wchar.h`` from ``fmt/format.h`` but this will be
    disabled in the next major release.
  * Fixed handling of the ``'+'`` specifier in localized
    formatting.
  * Added support for the ``'s'`` format specifier that gives
    textual representation of ``bool``.
  * Made ``fmt::ptr`` work with function pointers.
  * Fixed ``fmt::formatted_size`` with format string compilation
  * Fixed handling of empty format strings during format string
    compilation.
  * Fixed handling of enums in ``fmt::to_string``.
  * Improved width computation.
  * The experimental fast output stream (``fmt::ostream``) is
    now truncated by default for consistency with ``fopen``.
  * Fixed moving of ``fmt::ostream`` that holds buffered data
  * Replaced the ``fmt::system_error`` exception with a function
    of the same name that constructs ``std::system_error``.
  * Replaced the ``fmt::windows_error`` exception with a
    function of the same name that constructs
    ``std::system_error`` with the category returned by
    ``fmt::system_category()``.
  * Replaced ``fmt::error_code`` with ``std::error_code`` and
    made it formattable.
  * Added speech synthesis support.
  * Made ``format_to`` work with a memory buffer that has a
    custom allocator.
  * Added ``Allocator::max_size`` support to
    ``basic_memory_buffer``.
  * Added wide string support to ``fmt::join``
  * Made iterators passed to ``formatter`` specializations via a
    format context satisfy C++20 ``std::output_iterator``
    requirements.
  * Optimized the ``printf`` implementation.
  * Improved detection of ``constexpr`` ``char_traits``.
  * Fixed exception propagation from iterators.
  * Improved ``strftime`` error handling.
  * Stopped using deprecated GCC UDL template extension.
  * Added ``fmt/args.h`` to the install target.
  * Error messages are now passed to assert when exceptions are
    disabled.
  * Added the ``FMT_MASTER_PROJECT`` CMake option to control
    build and install targets when {fmt} is included via
    ``add_subdirectory``.
  * Improved build configuration.
  * Fixed various warnings and compilation issues.
  * Improved documentation.
  * Continuous integration and test improvements.
- Bump soversion to 8</changelog>
  <changelog author="aloisio@gmx.com" date="1625313600">- Update to version 8.0.1
  * Fixed the version number in the inline namespace.
  * Added a missing presentation type check for std::string.
  * Fixed a linkage error when mixing code built with clang and
    gcc.
  * Fixed documentation issues.
  * Removed dead code in FP formatter.
  * Fixed various warnings and compilation issues.</changelog>
</package>
<package pkgid="bc83ead5339456bcf53ceb368c43fe5f75b6b6707f96328ced3668656d3be029" name="freetype2" arch="src">
  <version epoch="0" ver="2.10.4" rel="150000.4.12.1"/>
  <changelog author="develop7@develop7.info" date="1473422400">- update to version 2.7:
  * IMPORTANT CHANGES
    + As announced earlier, the 2.7.x series now uses the new subpixel
    hinting  mode as  the  default, emulating  a  modern version  of
    ClearType.
    This change inevitably leads to different rendering results, and
    you   might   change   the   `TT_CONFIG_OPTION_SUBPIXEL_HINTING'
    configuration option to  adapt it to your taste (or  use the new
    `FREETYPE_PROPERTIES'    environment    variable).    See    the
    corresponding entry  below for  version 2.6.4, which  gives more
    information.
    + A new option  `FT_CONFIG_OPTION_ENVIRONMENT_PROPERTIES' has been
    introduced.   If  set (which  is  the  default), an  environment
    variable  `FREETYPE_PROPERTIES' can  be used  to control  driver
    properties.  Example:
    FREETYPE_PROPERTIES=truetype:interpreter-version=35 \
    cff:no-stem-darkening=1 \
    autofitter:warping=1
    This allows to select, say, the subpixel hinting mode at runtime
    for a given application.  See file `ftoption.h' for more.
  * IMPORTANT BUG FIXES
    + After  loading a  named instance  of  a GX  variation font,  the
    `face_index'  value  in  the returned  `FT_Face'  structure  now
    correctly holds the named instance  index in the upper 16bits as
    documented.
  * MISCELLANEOUS
    + A new macro `FT_IS_NAMED_INSTANCE' to  test whether a given face
    is a named instance.
    + More fixes to GX font handling.
    + Apple's   `GETVARIATION'  bytecode   operator  (needed   for  GX
    variation font support) has been implemented.
    + Another round  of fuzzer fixes,  mainly to reject  invalid fonts
    faster.
    + Handling of raw CID fonts  was broken (bug introduced in version
    2.6.4).
    + The smooth rasterizer has been streamlined  to make it faster by
    approx. 20%.
    + The `ftgrid'  demo program now  understands command  line option
    `-d' to give start-up design coordinates.
    + The `ftdump' demo program has  a new command line option `-p' to
    dump TrueType bytecode instructions.
- removed freetype2-subpixel.patch in favor of above
  FREETYPE_PROPERTIES environment variable</changelog>
  <changelog author="idonmez@suse.com" date="1483272000">- Update to version 2.7.1:
  * IMPORTANT CHANGES
    + Support for the new CFF2 font format as introduced with
    OpenType 1.8 has been contributed by Dave Arnolds from Adobe.
    + Preliminary support for variation fonts as specified in
    OpenType 1.8 (in addition to the already existing support for
    Adobe's MM and Apple's GX formats). Dave Arnolds contributed
    handling of advance width change variation; more will come in
    the next version.
  * IMPORTANT BUG FIXES
    + Handling of raw CID fonts was partially broken (bug introduced
    in 2.6.4).
  * MISCELLANEOUS
    + Some limits for TrueType bytecode execution have been tightened
    to speed up FreeType's handling of malformed fonts, in
    particular to quickly abort endless loops.
    + The number of twilight points can no longer be set to an
    arbitrarily large value.
    + The total number of jump opcode instructions (like JMPR) with
    negative arguments is dynamically restricted; the same holds
    for the total number of iterations in LOOPCALL opcodes.
    + The dynamic limits are based on the number of points in a glyph
    and the number of CVT entries. Please report if you encounter a
    font where the selected values are not adequate.
    + PCF family names are made more `colourful'; they now include the
    foundry and information whether they contain wide characters.
    For example, you no longer get `Fixed' but rather `Sony Fixed'
    or `Misc Fixed Wide'.
    + A new function `FT_Get_Var_Blend_Coordinates' (with its alias
    name `FT_Get_MM_Blend_Coordinates') to retrieve the normalized
    blend coordinates of the currently selected variation instance
    has been added to the Multiple Masters interface.
    + A new function `FT_Get_Var_Design_Coordinates' to retrieve the
    design coordinates of the currently selected variation instance
    has been added to the Multiple Masters interface.
    + A new load flag `FT_LOAD_BITMAP_METRICS_ONLY' to retrieve bitmap
    information without loading the (embedded) bitmap itself.
    + Retrieving advance widths from bitmap strikes (using
    `FT_Get_Advance' and `FT_Get_Advances') have been sped up.
    + The usual round of fuzzer fixes to better reject malformed
    fonts.
- Drop freetype2-bitmap-foundry.patch, merged upstream.</changelog>
  <changelog author="idoenmez@suse.de" date="1494849600">- Update to version 2.8
  * Support for OpenType Variation Fonts is now complete. The last
    missing part was handling the `VVAR' and `MVAR' tables, which is
    available with this release.
  * A new  function `FT_Face_Properties' allows the  control of some
    module  and   library  properties  per  font.    Currently,  the
    following properties can be  handled: stem darkening, LCD filter
    weights, and the random seed for the `random' CFF operator.
  * The PCF change to show more `colourful' family names (introduced
    in version 2.7.1) was too radical; it can now be configured with
    PCF_CONFIG_OPTION_LONG_FAMILY_NAMES   at   compile   time.    If
    activated, it can  be switched off at run time  with the new pcf
    property  `no-long-family-names'.  If  the `FREETYPE_PROPERTIES'
    environment variable is available, you can say
    FREETYPE_PROPERTIES=pcf:no-long-family-names=1
  * Support  for  the  following  scripts  has  been  added  to  the
    auto-hinter.
    Adlam, Avestan, Bamum, Buhid, Carian, Chakma, Coptic, Cypriot,
    Deseret, Glagolitic, Gothic, Kayah, Lisu, N'Ko, Ol Chiki, Old
    Turkic, Osage, Osmanya, Saurashtra, Shavian, Sundanese, Tai
    Viet, Tifinagh, Unified Canadian Syllabics, Vai
  * `Light' auto-hinting  mode no  longer uses TrueType  metrics for
    TrueType  fonts.   This bug  was  introduced  in version  2.4.6,
    causing   horizontal  scaling   also.    Almost  all   GNU/Linux
    distributions (with Fedora as  a notable exception) disabled the
    corresponding patch for good reasons; chances are thus high that
    you won't notice a difference.
  * If a TrueType font gets loaded with FT_LOAD_NO_HINTING, FreeType
    now scales  the font linearly  again (bug introduced  in version
    2.4.6).
  * Fixed CVE-2017-8105,  CVE-2017-8287:  Older   FreeType  versions
    have out-of-bounds  writes  caused  by  heap-based  buffer  overflows
    related to Type 1 fonts. (boo#1035807, boo#1036457)
- See https://sourceforge.net/projects/freetype/files/freetype2/2.8/ for
  the complete changelog.</changelog>
  <changelog author="idonmez@suse.com" date="1505736000">- Update to version 2.8.1
  * B/W  hinting   of  TrueType   fonts  didn't  work   properly  if
    interpreter version 38 or 40 was selected.
  * Some severe  problems within the handling  of TrueType Variation
    Fonts were found and fixed.
  * Function `FT_Set_Var_Design_Coordinates' didn't correctly handle
    the case with less input coordinates than axes.
  * By default,  FreeType  now offers  high  quality  LCD-optimized
    output  without resorting to ClearType techniques of resolution
    tripling and filtering.  In this method,  called Harmony,  each
    color channel is generated separately  after shifting the glyph
    outline,  capitalizing on the fact  that the color grids on LCD
    panels  are  shifted  by  a third  of  a pixel.  This output is
    indistinguishable from ClearType with a light 3-tap filter.
  * Using the  new function `FT_Get_Var_Axis_Flags',  an application
    can access the `flags' field  of a variation axis (introduced in
    OpenType version 1.8.2)
  * FreeType  now synthesizes  a  missing Unicode  cmap for  (older)
    TrueType fonts also if glyph names are available.
  * The warping option  has moved  from `light'  to `normal' hinting
    where  it replaces  the original hinting algorithm.  The `light'
    mode is now always void of any hinting in x-direction.</changelog>
  <changelog author="idonmez@suse.com" date="1515499200">- Update to version 2.9
  * Advance width values of variation fonts were often wrong.
  * More fixes for variation font support; you should update to
    this version if you want to support them.
  * As a GSoC project, Ewald Hew extended the new (Adobe) CFF
    engine to handle Type 1 fonts also, thus greatly improving
    the rendering of this format. This is the new default.
  * A new function, `FT_Set_Named_Instance', can be used to set
    or change the current named instance.
  * Starting with this FreeType version, resetting variation
    coordinates will return to the currently selected named
    instance. Previously, FreeType returned to the base font
    (i.e., no instance set).
  * Some fuzzer fixes to better reject malformed fonts.</changelog>
  <changelog author="idonmez@suse.com" date="1515585600">- Add psaux-flex.patch to fix a regression in Type1 rendering</changelog>
  <changelog author="fstrba@suse.com" date="1518004800">- Added patches:
  * 0001-src-truetype-ttinterp.c-Ins_GETVARIATION-Avoid-NULL-.patch
    + Upstream fix for bsc#1079603: Avoid NULL reference in
    src/truetype/ttinterp.c
  * 0001-truetype-Better-protection-against-invalid-VF-data.patch
    + Upstream fix for bsc#1079601: Protection against invalid VF
    data</changelog>
  <changelog author="fstrba@suse.com" date="1518177600">- Added patch:
  * enable-long-family-names-by-default.patch
    + Define PCF_CONFIG_OPTION_LONG_FAMILY_NAMES to obtain 2.7.1
    behaviour</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1520337600">- Refresh spec-file via spec-cleaner.
- Add shell script freetype2.sh in separate package
  freetype2-profile-tti35 in order to be able to set TrueType
  interpreter version 35 (boo#1084085).</changelog>
  <changelog author="kbabioch@suse.com" date="1520510400">- Add bnc1079600.patch: Fix several integer overflow issues in
  truetype/ttinterp.c (bsc#1079600)</changelog>
  <changelog author="idonmez@suse.com" date="1525262400">- Update to version 2.9.1
  * Type 1 fonts containing flex features were not rendered
    correctly (bug introduced in version 2.9).
  * CVE-2018-6942: Older FreeType versions can crash with certain
    malformed variation fonts.
  * Bug fix: Multiple calls to `FT_Get_MM_Var' returned garbage.
  * Emboldening of bitmaps didn't work correctly sometimes, showing
    various artifacts (bug introduced in version 2.8.1).
  * The auto-hinter script ranges have  been updated for Unicode 11.
    No support for new scripts have been added, however,  with the
    exception of Georgian Mtavruli.
- freetype-config is now deprecated by upstream and not enabled
  by default.
- Drop upstreamed patches:
  * bnc1079600.patch
  * psaux-flex.patch
  * 0001-src-truetype-ttinterp.c-Ins_GETVARIATION-Avoid-NULL-.patch
  * 0001-truetype-Better-protection-against-invalid-VF-data.patch</changelog>
  <changelog author="idonmez@suse.com" date="1526299200">- Re-enable freetype-config, there is just too many fallouts.</changelog>
  <changelog author="idonmez@suse.com" date="1540641600">- Remove old ppc64 parts in spec file
- Refresh patches:
  + bugzilla-308961-cmex-workaround.patch
  + don-t-mark-libpng-as-required-library.patch
  + enable-long-family-names-by-default.patch
- Enable subpixel rendering with infinality config:
  + enable-subpixel-rendering.patch
  + enable-infinality-subpixel-hinting.patch</changelog>
  <changelog author="idonmez@suse.com" date="1561377600">- Update to version 2.10.0
  * A bunch of new functions has been added to access and process
    COLR/CPAL data of OpenType fonts with color-layered glyphs.
  * As a GSoC 2018 project, Nikhil Ramakrishnan completely
    overhauled and modernized the API reference.
  * The logic for computing the global ascender, descender, and
    height of OpenType fonts has been slightly adjusted for
    consistency.
  * `TT_Set_MM_Blend' could fail if called repeatedly with the same
    arguments.
  * The precision of handling deltas in Variation Fonts has been
    increased.The problem did only show up with multidimensional
    designspaces.
  * New function `FT_Library_SetLcdGeometry' to set up the geometry
    of LCD subpixels.
  * FreeType now uses the `defaultChar' property of PCF fonts to set
    the  glyph for  the undefined  character  at glyph  index 0  (as
    FreeType already does for all other supported font formats).  As
    a consequence, the order of glyphs of a PCF font if accessed
    with  FreeType can be different now compared to previous
    versions.
    This change doesn't affect PCF font access with cmaps.
  * `FT_Select_Charmap' has been changed to allow  parameter value
    `FT_ENCODING_NONE', which is valid for BDF, PCF, and Windows FNT
    formats to access built-in cmaps that don't have a predefined
    `FT_Encoding' value.
  * A previously reserved field in the `FT_GlyphSlotRec' structure
    now holds the glyph index.
  * The usual round of fuzzer bug fixes to better reject malformed
    fonts.
  * `FT_Outline_New_Internal' and `FT_Outline_Done_Internal' have
    been removed.These two functions were public by oversight only
    and were never documented.
  * A new function `FT_Error_String' returns descriptions of error
    codes if configuration macro FT_CONFIG_OPTION_ERROR_STRINGS is
    defined.
  * `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector' are new
    functions limited to Adobe MultiMaster fonts to directly set and
    get the weight vector.</changelog>
  <changelog author="idonmez@suse.com" date="1562068800">- Update to version 2.10.1
  * The bytecode hinting of OpenType variation fonts was flawed, since
    the data in the `CVAR' table wasn't correctly applied.
  * Auto-hinter support for Mongolian.
  * The handling of  the default character in PCF fonts as  introduced
    in version 2.10.0 was partially broken, causing premature abortion
    of charmap iteration for many fonts.
  * If  `FT_Set_Named_Instance' was  called  with  the same  arguments
    twice in a row, the function  returned an incorrect error code the
    second time.
  * Direct   rendering   using  FT_RASTER_FLAG_DIRECT   crashed   (bug
    introduced in version 2.10.0).
  * Increased  precision  while  computing  OpenType  font   variation
    instances.
  * The  flattening  algorithm of  cubic  Bezier  curves was  slightly
    changed to make  it faster.  This can cause  very subtle rendering
    changes, which aren't noticeable by the eye, however.
  * The  auto-hinter  now  disables hinting  if there  are blue  zones
    defined for a `style' (i.e., a certain combination of a script and
    its related typographic features) but the font doesn't contain any
    characters needed to set up at least one blue zone.
- Add tarball signatures and freetype2.keyring</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1570622400">- Use the compiler default C std, since 2012 gcc defaults
  have changed, we now only need to get rid of ANSIFLAGS, override
  that variable instead.</changelog>
  <changelog author="idonmez@suse.com" date="1589025600">- Update to version 2.10.2
  * Support for WOFF2 fonts, add BR on pkgconfig(libbrotlidec)
  * Function `FT_Get_Var_Axis_Flags' returned random data for Type 1
    MM fonts.
  * Type 1 fonts with non-integer metrics are now supported by the new
    (CFF) engine introduced in FreeType 2.9.
  * Drop support for Python 2 in Freetype's API reference generator
  * Auto-hinter support for Hanifi Rohingya
  * Document the `FT2_KEEP_ALIVE' debugging environment variable.</changelog>
  <changelog author="idonmez@suse.com" date="1603195200">- Update to version 2.10.4
  * Fix a heap buffer overflow has been found  in the handling of
    embedded PNG bitmaps, introduced in FreeType version 2.6
    (CVE-2020-15999 bsc#1177914)
  * Minor improvements to the B/W rasterizer.
  * Auto-hinter support for Medefaidrin script.
  * Fix various  memory leaks (mainly  for CFF) and other  issues that
    might cause crashes in rare circumstances.</changelog>
  <changelog author="fstrba@suse.com" date="1661256000">- Added patches:
  * CVE-2022-27404.patch
    + fixes bsc#1198830, CVE-2022-27404: Buffer Overflow
  * CVE-2022-27405.patch
    + fixes bsc#1198832, CVE-2022-27405: Segmentation Fault
  * CVE-2022-27406.patch
    + fixes bsc#1198823, CVE-2022-27406: Segmentation violation</changelog>
  <changelog author="meissner@suse.com" date="1661947200">- disable brotli linkage / WOFF2 support for now to keep dependencies
  as before.</changelog>
</package>
<package pkgid="258bb13d66121656230a56fffdaff77a1f0ab61ca3927ade3f307beee881998b" name="gcc11" arch="src">
  <version epoch="0" ver="11.3.0+git1637" rel="150000.1.11.2"/>
  <changelog author="rguenther@suse.com" date="1625832000">- Add BuildRequires on netcfg for the testsuite when testing Go.</changelog>
  <changelog author="schwab@suse.de" date="1626696000">- Remove bits/unistd_ext.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1626868800">- Properly adjust GPL-3.0 WITH GCC-exception-3.1 to
  GPL-3.0-or-later WITH GCC-exception-3.1</changelog>
  <changelog author="rguenther@suse.com" date="1626868801">- Update to gcc-11 branch head (076930b9690ac3564638636f6b), git536
  * Includes GCC 11.2 RC1.
- Refresh gcc10-foffload-default.patch</changelog>
  <changelog author="rguenther@suse.com" date="1629115200">- Update to gcc-11 branch head (056e324ce46a7924b5cf10f610), git610
  * Includes GCC 11.2 release
  * Includes fix for opie build with glibc 2.34  [boo#1188623]</changelog>
  <changelog author="schwab@suse.de" date="1629288000">- Require libgccjit%{libgccjit_sover}%{libgccjit_suffix} from
  libgccjit%{libgccjit_sover}-devel%{libdevel_suffix}.</changelog>
  <changelog author="matz@suse.com" date="1632139200">- Enable the full cross compiler, cross-aarch64-gcc11 and
  cross-riscv64-gcc11 now provide a fully hosted C (and C++)
  cross compiler, not just a freestanding one.  I.e. with a cross
  glibc.  They don't yet support the sanitizer libraries.
  Part of [jsc#OBS-124].</changelog>
  <changelog author="rguenther@suse.com" date="1634731200">- Remove spurious exit from change_spec.</changelog>
  <changelog author="rguenther@suse.com" date="1637755200">- Update to gcc-11 branch head (7510c23c1ec53aa4a62705f03), git1018
  * fixes issue with debug dumping together with -o /dev/null
  * fixes libgccjit issue showing up in emacs build  [boo#1192951]
- Package mwaitintrin.h</changelog>
  <changelog author="matz@suse.com" date="1637928000">- Enable the cross compilers also on i586
- Enable some cross compilers also in rings
- Remove cross compilers for i386 target</changelog>
  <changelog author="mliska@suse.cz" date="1639569600">- Update to gcc-11 branch head (d4a1d3c4b377f1d4acb), git1173
  * Fix D memory corruption in -M output.
  * Fix ICE in is_this_parameter with coroutines.  [boo#1193659]</changelog>
  <changelog author="schwab@suse.de" date="1642507200">- Remove sys/rseq.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1644408000">- Put libstdc++6-pp Requires on the shared library and drop
  to Recoomends.</changelog>
  <changelog author="rguenther@suse.com" date="1644494400">- Add gcc11-PIE, similar to gcc-PIE but affecting gcc11 [bsc#1195628]</changelog>
  <changelog author="rguenther@suse.com" date="1646222400">- Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
  packages provided by older GCC work.  Add a requires from that
  package to the corresponding libstc++6 package to keep those
  at the same version.  [bsc#1196107]</changelog>
  <changelog author="dmueller@suse.com" date="1646654400">- drop armv5tel, merge arm and armv6hl
- use --with-cpu rather than specifying --with-arch/--with-tune</changelog>
  <changelog author="rguenther@suse.com" date="1647432000">- Update to gcc-11 branch head (6a1150d1524aeda3381b21717), git1406
  * includes change to adjust gnats idea of the target, fixing
    the build of gprbuild.  [bsc#1196861]
- Add gcc11-pr104931.patch to fix miscompile of embedded premake
  in 0ad on i586.  [bsc#1197065]</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit.</changelog>
  <changelog author="rguenther@suse.com" date="1650456000">- Update to gcc-11 branch head (691af15031e00227ba6d5935c), git1635
  * includes gcc11-pr104931.patch
  * includes fix for Firefox ICE  [gcc#105256]</changelog>
  <changelog author="rguenther@suse.com" date="1650542400">- Update to the GCC 11.3.0 release.
  * includes SLS hardening backport on x86_64.  [bsc#1195283]</changelog>
</package>
<package pkgid="ed1b51be091fbdf707ae590f9c95ad9f7c18adf3349115755793a6b330ae4431" name="gcc12" arch="src">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="0d3ef276f24686a607ac74accfd83ac5b64a2354dfff11a9d314aacefa7cf466" name="gdk-pixbuf" arch="src">
  <version epoch="0" ver="2.40.0" rel="150200.3.6.1"/>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Update to version 2.36.10:
  + build: meson build improvements.
  + build: win32 build fixes.
  + tests: show error before failing (bgo#786259).
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
</package>
<package pkgid="a6f3ab2638a8561e6156171585c40f7c01394455ccd9a0255f7bbef79ebddeee" name="gdk-pixbuf" arch="src">
  <version epoch="0" ver="2.40.0" rel="150200.3.9.1"/>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
  <changelog author="mgorse@suse.com" date="1661860800">- Add gdk-pixbuf-CVE_2021-44648.patch: check for maximum LZW code
  size (boo#1194633 CVE-2021-44648). Also add
  gdk_pixbuf_new_tests.tar.xz for some new gif tests.</changelog>
</package>
<package pkgid="5263c11a9d8e21482f2cb877b11a470324a8721f6379fc0e9d0aa8e144f29d42" name="gdk-pixbuf-query-loaders" arch="aarch64">
  <version epoch="0" ver="2.40.0" rel="150200.3.6.1"/>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Update to version 2.36.10:
  + build: meson build improvements.
  + build: win32 build fixes.
  + tests: show error before failing (bgo#786259).
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
</package>
<package pkgid="7f6bd803999856d85412eff89b2f4653415c99be347f8603e20a288e486387ff" name="gdk-pixbuf-query-loaders" arch="x86_64">
  <version epoch="0" ver="2.40.0" rel="150200.3.6.1"/>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Update to version 2.36.10:
  + build: meson build improvements.
  + build: win32 build fixes.
  + tests: show error before failing (bgo#786259).
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
</package>
<package pkgid="acf5abfde8a662be2ac384e108ccc1556caac456d35850889b850d1d1d2d93c9" name="gdk-pixbuf-query-loaders" arch="aarch64">
  <version epoch="0" ver="2.40.0" rel="150200.3.9.1"/>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
  <changelog author="mgorse@suse.com" date="1661860800">- Add gdk-pixbuf-CVE_2021-44648.patch: check for maximum LZW code
  size (boo#1194633 CVE-2021-44648). Also add
  gdk_pixbuf_new_tests.tar.xz for some new gif tests.</changelog>
</package>
<package pkgid="ecf102a775f00177d030cd5fc1dc8047e1d84747c92542be29b577db29412d87" name="gdk-pixbuf-query-loaders" arch="x86_64">
  <version epoch="0" ver="2.40.0" rel="150200.3.9.1"/>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
  <changelog author="mgorse@suse.com" date="1661860800">- Add gdk-pixbuf-CVE_2021-44648.patch: check for maximum LZW code
  size (boo#1194633 CVE-2021-44648). Also add
  gdk_pixbuf_new_tests.tar.xz for some new gif tests.</changelog>
</package>
<package pkgid="3793dd85739fdf10e41dda2f4398eb35adebb2e4dc062a1c696725a0c80ad1db" name="glib2" arch="src">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="abe8d48446ff84c1e8606e3cc8c54d865c9ca19d6cc20ecffe9127ee58ab8feb" name="glib2-tools" arch="aarch64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="9ea88ab4eaea23620404b484ad76b45450243dba69307599553b6c3888407b42" name="glib2-tools" arch="x86_64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="794998108c1889046d81224b9f68adc4465a39d4586910d2c795b00924c18c36" name="glibc" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="580c72c60506fbca92eb4e44364d3fe026c7bdcff3d7d928736645f8653014c9" name="glibc" arch="src">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="c6d01675fd675d9b5de8afbafc8a8cae445aaa834ab313dd662b104d02d625ba" name="glibc" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="994d27f41087ff158ca7caf1dbe41c7ee76b7c4ed1636585a9f4019bfb3d746f" name="glibc" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="27c92147aa7c0eac6e4ef9802c9bdf8e5308dd451337716b031558a3bc4f5b59" name="glibc" arch="src">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="fddf74776c64fa4097dd7df0a481b60f113c8aefb49d25373269eb2ba2e9736d" name="glibc" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="011fe953a78e826f95637962fd8da653fb0269b21c0260f1be62e9ebec599497" name="glibc" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.41.1"/>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
</package>
<package pkgid="4279af6b0eb13b2dcffb49d7d82d0c06eaa6280a7b8ae4866a3e82099fdcdc0d" name="glibc" arch="src">
  <version epoch="0" ver="2.31" rel="150300.41.1"/>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
</package>
<package pkgid="45fcf060008b67aa2bb84b0052efb6883baf91975358d76c39807b62b1593eba" name="glibc" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.41.1"/>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
</package>
<package pkgid="e97531bae9dd8fc5cb6dbe4eea76bc7b709b21f7388ed5f60518833abf0e5e6d" name="glibc-locale" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="dba03abcf9940a9b7e14f60b45865b4e28c16e2d54b269062dca5236ea294470" name="glibc-locale" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="7b5a52ac647c5f3ee086debf80262ef3385f1e1028670498fbb926d7f858e574" name="glibc-locale" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="9dc0243baffdea4a252f59598a208858cd5b5856ca7681f073e70706c0d56f37" name="glibc-locale" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="97e89ecf04cd1b373487a2205cd55663ac05de24d65e25238550d2402bb3a065" name="glibc-locale" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.41.1"/>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
</package>
<package pkgid="409b078af733517ae3b531dcec047d7fbde72b2d7d5189f05092b4b5d1534993" name="glibc-locale" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.41.1"/>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
</package>
<package pkgid="6cdbcfae3db1edb1e75ccad1effe13f3035dbc5a553e1a0983ef2f22f90b5560" name="glibc-locale-base" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="67d29014a25dce63d48d8b9ddfb83b6e200744004344129f75409e3b5c6dbfd9" name="glibc-locale-base" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.31.2"/>
  <changelog author="schwab@suse.de" date="1599048000">- Update to glibc 2.31
- glibc-2.14-crypt.diff, crypt_blowfish-const.patch,
  crypt_blowfish-1.2-sha.diff, crypt_blowfish-gensalt.patch,
  crypt_blowfish-1.2-hack_around_arm.diff, glibc-nodate.patch,
  powerpc-elision-enable-envvar.patch, s390-elision-enable-envvar.patch,
  crt-nocompress-debug-sections.patch, resolv-context-leak.patch,
  dl-runtime-resolve-opt-avx512f.patch, libpthread-compat-wrappers.patch,
  math-c++-compat.patch, remove-nss-nis-compat.patch,
  eh-frame-zero-terminator.patch, ld-so-hwcap-x86-64.patch,
  assert-pedantic.patch, getaddrinfo-errno.patch, resolv-conf-oom.patch,
  dynarray-allocation.patch, nearbyint-inexact.patch, nss-compat.patch,
  nscd-libnsl.patch, malloc-tcache-leak.patch,
  falkor-memcpy-memmove.patch, aarch64-cpu-features.patch,
  nss-files-large-buffers.patch, sysconf-uio-maxiov.patch,
  glob-tilde-overflow.patch, dl-runtime-resolve-xsave.patch,
  spawni-assert.patch, x86-64-dl-platform.patch, glob64-s390.patch,
  tst-tlsopt-powerpc.patch, powerpc-hwcap-bits.patch,
  malloc-tcache-check-overflow.patch, dl-init-paths-overflow.patch,
  fillin-rpath-empty-tokens.patch, getcwd-absolute.patch,
  memalign-overflow.patch, stack-guard-size-accounting.patch,
  libgcc-rtld-now.patch, res-send-enomem.patch,
  glibc-fix-avx512-mempcpy.patch, i386-memmove-sse2-unaligned.patch,
  realpath-ssize-max-overflow.patch, localtime-2039.patch,
  math-remove-slow-path.patch, aarch64-hwcap-atomics.patch,
  glibc-fix-aarch64-build.diff, absolute-symbols.patch,
  x86-haswell-string-flags.patch,
  pthread-cond-broadcast-waiters-after-spinning.patch,
  mman-map-sync.patch, mman-linux-map-shared-validate.patch,
  nptl-setxid-error.patch, pthread-mutex-trylock-barrier.patch,
  getaddrinfo-parse-ipv4-address.patch, japanese-era-name-may-2019.patch,
  force-elision-race.patch, regex-read-overrun.patch,
  regex-parse-reg-exp.patch,
  0001-S390-Add-configure-check-to-detect-z10-as-mininum-ar.patch,
  0002-S390-Use-hwcap-instead-of-dl_hwcap-in-ifunc-resolver.patch,
  0003-S390-Unify-31-64bit-memcpy.patch,
  0004-S390-Refactor-memcpy-mempcpy-ifunc-handling.patch,
  0005-S390-Remove-s390-specific-implementation-of-bcopy.patch,
  0006-S390-Use-memcpy-for-forward-cases-in-memmove.patch,
  0007-S390-Add-configure-check-to-detect-z13-as-mininum-ar.patch,
  0008-S390-Add-z13-memmove-ifunc-variant.patch,
  0009-S390-Add-z13-strstr-ifunc-variant.patch,
  0010-S390-Add-z13-memmem-ifunc-variant.patch,
  0011-S390-Cleanup-ifunc-resolve.h.patch,
  0012-S390-Mark-vx-and-vxe-as-important-hwcap.patch,
  0013-S390-Add-new-hwcap-values-for-new-cpu-architecture-a.patch,
  0014-S390-Add-configure-check-to-detect-support-for-arch1.patch,
  0015-S390-Add-arch13-memmove-ifunc-variant.patch,
  0016-S390-Add-arch13-strstr-ifunc-variant.patch,
  0017-S390-Add-arch13-memmem-ifunc-variant.patch,
  prefer-map-32bit-exec.patch, s390-strstr-page-boundary.patch,
  ppc-tle-htm-nosc.patch,
  posix-Add-internal-symbols-for-posix_spawn-interface.patch,
  glibc-2.29-posix-Use-posix_spawn-on-popen.patch,
  backtrace-powerpc.patch, pthread-rwlock-pwn.patch,
  manual-memory-protection.patch, ldbl-96-rem-pio2l.patch,
  dl-sort-maps.patch, dlopen-filter-object.patch,
  glob-use-after-free.patch, nptl-setxid-race.patch, nscd-senfile.patch,
  ldd-system-interp.patch, abort-no-flush.patch,
  fnmatch-collating-elements.patch, nss-files-long-lines-2.patch,
  iconv-reset-input-buffer.patch, nscd-prune.patch, syslog-locking.patch:
  Removed.
- long-double-alias.patch, glibc-nsswitch-usr.diff, euc-kr-overrun.patch,
  riscv-syscall-clobber.patch, nscd-gc-cycle.patch: Added.</changelog>
  <changelog author="schwab@suse.de" date="1604923200">- power10-support.patch: Add support for POWER10 (jsc#SLE-13520)
- iconv-option-parsing.patch: Rewrite iconv option parsing
  (CVE-2016-10228, bsc#1027496, BZ #19519)</changelog>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
</package>
<package pkgid="fc5232f229db493963d698fecf3350324b874ce1c5511f59e54a027dfe571078" name="glibc-locale-base" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="e13d47fd5e6a0cc73f5c469d16360b40c7c77ae560425c34c96e5fd67e8edae6" name="glibc-locale-base" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.37.1"/>
  <changelog author="schwab@suse.de" date="1608120000">- aarch64-getauxval.patch: aarch64: Accept PLT calls to __getauxval within
  libc.so (bsc#1167939)
- iconv-redundant-shift.patch: iconv: Accept redundant shift sequences in
  IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
- iconv-ucs4-loop-bounds.patch: iconv: Fix incorrect UCS4 inner loop
  bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
- printf-long-double-non-normal.patch: x86: Harden printf against
  non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
- get-nprocs-cpu-online-parsing.patch: Fix parsing of
  /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)</changelog>
  <changelog author="schwab@suse.de" date="1609848000">- sysvipc-sem-stat-any.patch: sysvipc: Fix SEM_STAT_ANY kernel argument
  pass (bsc#1180557, BZ #26637)</changelog>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
</package>
<package pkgid="2fca079d57f23293bdf52d76ab8c667307fb122e9c87a65cf0bcc0b0ba6efeb7" name="glibc-locale-base" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.41.1"/>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
</package>
<package pkgid="0e56440bef3ceeb0090174fdb3360a0d42f35a8d73c4e857c970a0ae91beba61" name="glibc-locale-base" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.41.1"/>
  <changelog author="schwab@suse.de" date="1611835200">- gconv-assertion-iso-2022-jp.patch: gconv: Fix assertion failure in
  ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)</changelog>
  <changelog author="schwab@suse.de" date="1614772800">- nscd-netgroupcache.patch: nscd: Fix double free in netgroupcache
  (CVE-2021-27645, bsc#1182733, BZ #27462)</changelog>
  <changelog author="rguenther@suse.com" date="1615377600">- Add glibc-2.31-HTM-vzeroupper.diff to avoid VZEROUPPER in the
  AVX2 accelerated string routines which cause HTM transaction
  aborts.  Instead use EVEX or SSE.  (bsc#1181403)</changelog>
  <changelog author="rguenther@suse.com" date="1615377601">- Update glibc-2.31-HTM-vzeroupper.diff with a AVX-SSE transition
  fix.</changelog>
  <changelog author="schwab@suse.de" date="1617019200">- s390-memmove-ifunc-selector-arch13.patch: S390: Also check vector
  support in memmove ifunc-selector (bsc#1184035, BZ #27511)</changelog>
  <changelog author="schwab@suse.de" date="1625140800">- wordexp-param-overflow.patch: wordexp: handle overflow in positional
  parameter number (CVE-2021-35942, bsc#1187911, BZ #28011)</changelog>
  <changelog author="schwab@suse.de" date="1630584000">- mq-notify-use-after-free.patch: Use __pthread_attr_copy in mq_notify
  (CVE-2021-33574, bsc#1186489, BZ #27896)</changelog>
  <changelog author="schwab@suse.de" date="1636027200">- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1640174400">- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.</changelog>
  <changelog author="schwab@suse.de" date="1642420800">- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "unix" (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)</changelog>
  <changelog author="schwab@suse.de" date="1642593600">- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0002-powerpc-Optimized-stpcpy-for-POWER9.patch,
  0003-powerpc-Optimized-rawmemchr-for-POWER9.patch,
  0004-powerpc64le-add-optimized-strlen-for-P9.patch,
  0005-powerpc-fix-ifunc-implementation-list-for-POWER9-str.patch,
  0006-powerpc-Add-optimized-strncpy-for-POWER9.patch,
  0007-powerpc-Add-optimized-stpncpy-for-POWER9.patch,
  0008-powerpc-Add-optimized-ilogb-for-POWER9.patch,
  0009-powerpc-Add-optimized-llogb-for-POWER9.patch,
  0010-powerpc-Add-optimized-strlen-for-POWER10.patch,
  0011-powerpc64le-Optimized-memmove-for-POWER10.patch,
  0012-powerpc64le-Optimize-memcpy-for-POWER10.patch,
  0013-powerpc64le-Optimize-memset-for-POWER10.patch,
  0014-powerpc64le-Fix-ifunc-selection-for-memset-memmove-b.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)</changelog>
  <changelog author="schwab@suse.de" date="1643025600">- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)</changelog>
  <changelog author="matz@suse.com" date="1650888000">- Add s390-add-z16-name.diff for bsc#1198751.</changelog>
  <changelog author="schwab@suse.de" date="1652702400">- selinux-deprecated.patch: Disable warnings due to deprecated libselinux
  symbols used by nss and nscd (bsc#1197718)
- systemtap-altmacro.patch: i386: Remove broken CAN_USE_REGISTER_ASM_EBP
  (bsc#1197718, BZ #28771)</changelog>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
</package>
<package pkgid="15894e684ac3fcec4c02d1301bab9e134ec387fd0b7d279df14a22f760362ae9" name="gnutls" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.19.2"/>
  <changelog author="vcizek@suse.com" date="1558008000">- Explicitly require libnettle 3.4.1 (bsc#1134856)
  * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order
    to fix CVE-2018-16868, the new implementation makes use of a new
    rsa_sec_decrypt() function introduced in libnettle 3.4.1
  * libnettle was recently updated to the 3.4.1 version but we need
    to add explicit dependency on it to prevent missing symbol errors
    with the older versions</changelog>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
</package>
<package pkgid="be3031a8d3e7d98cb4e5bda3f8c4b4a7e826841c6249322f24828e3e5d197035" name="gnutls" arch="src">
  <version epoch="0" ver="3.6.7" rel="150200.14.19.2"/>
  <changelog author="vcizek@suse.com" date="1558008000">- Explicitly require libnettle 3.4.1 (bsc#1134856)
  * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order
    to fix CVE-2018-16868, the new implementation makes use of a new
    rsa_sec_decrypt() function introduced in libnettle 3.4.1
  * libnettle was recently updated to the 3.4.1 version but we need
    to add explicit dependency on it to prevent missing symbol errors
    with the older versions</changelog>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
</package>
<package pkgid="f62a5e0626c8c2dd42819f348116c6bfeb23651055ee581fd5e86cf7e388c543" name="gnutls" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.19.2"/>
  <changelog author="vcizek@suse.com" date="1558008000">- Explicitly require libnettle 3.4.1 (bsc#1134856)
  * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order
    to fix CVE-2018-16868, the new implementation makes use of a new
    rsa_sec_decrypt() function introduced in libnettle 3.4.1
  * libnettle was recently updated to the 3.4.1 version but we need
    to add explicit dependency on it to prevent missing symbol errors
    with the older versions</changelog>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
</package>
<package pkgid="2c6b1135e23f1ea0073b4e3c8ef73fb927d0e6fb6a0e93f16debbc841a39f9ad" name="gnutls" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.22.1"/>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
</package>
<package pkgid="acd2063ef27e1e71fe642d48f5e0b2d6a05e2b7a783185c16a1872b0107cabc9" name="gnutls" arch="src">
  <version epoch="0" ver="3.6.7" rel="150200.14.22.1"/>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
</package>
<package pkgid="e25627ced421f6f609d5b79b9dfeef8283a6d90487b7c2b72c030ec0dbefdf7f" name="gnutls" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.22.1"/>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
</package>
<package pkgid="9bb7b1fc8eadaea22d1bade9c559fab11408dde2b6b5395c3409c1facbf6d66b" name="gnutls" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.25.2"/>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676548800">- Security Fix: [bsc#1208143, CVE-2023-0361]
  * Bleichenbacher oracle in TLS RSA key exchange
  * Add gnutls-CVE-2023-0361.patch</changelog>
</package>
<package pkgid="a6374586e5afa99c9a2e89a979dfc3fa9f29f113f051a8e80441167644fd0c58" name="gnutls" arch="src">
  <version epoch="0" ver="3.6.7" rel="150200.14.25.2"/>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676548800">- Security Fix: [bsc#1208143, CVE-2023-0361]
  * Bleichenbacher oracle in TLS RSA key exchange
  * Add gnutls-CVE-2023-0361.patch</changelog>
</package>
<package pkgid="5351d9bbdeb61382020a5489fd05d9732ab6f4bfc1f26a0c0959dc0b6389e0a0" name="gnutls" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.25.2"/>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676548800">- Security Fix: [bsc#1208143, CVE-2023-0361]
  * Bleichenbacher oracle in TLS RSA key exchange
  * Add gnutls-CVE-2023-0361.patch</changelog>
</package>
<package pkgid="3b2925399447577f2e652ef0b666fa80a75d1038b0dfd078a10a5b82901979a3" name="gpg2" arch="aarch64">
  <version epoch="0" ver="2.2.27" rel="150300.3.5.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1574856000">- Update to 2.2.18 [bsc#1157900, CVE-2019-14855]
  * gpg: Changed the way keys are detected on a smartcards; this
    allows the use of non-OpenPGP cards.  In the case of a not very
    likely regression the new option --use-only-openpgp-card is
    available.  [#4681]
  * gpg: The commands --full-gen-key and --quick-gen-key now allow
    direct key generation from supported cards.  [#4681]
  * gpg: Prepare against chosen-prefix SHA-1 collisions in key
    signatures.  This change removes all SHA-1 based key signature
    newer than 2019-01-19 from the web-of-trust.  Note that this
    includes all key signature created with dsa1024 keys.  The new
    option --allow-weak-key-signatues can be used to override the new
    and safer behaviour.  [#4755,CVE-2019-14855]
  * gpg: Improve performance for import of large keyblocks.  [#4592]
  * gpg: Implement a keybox compression run.  [#4644]
  * gpg: Show warnings from dirmngr about redirect and certificate
    problems (details require --verbose as usual).
  * gpg: Allow to pass the empty string for the passphrase if the
    '--passphase=' syntax is used.  [#4633]
  * gpg: Fix printing of the KDF object attributes.
  * gpg: Avoid surprises with --locate-external-key and certain
  - -auto-key-locate settings.  [#4662]
  * gpg: Improve selection of best matching key.  [#4713]
  * gpg: Delete key binding signature when deletring a subkey.
    [#4665,#4457]
  * gpg: Fix a potential loss of key sigantures during import with
    self-sigs-only active.  [#4628]
  * gpg: Silence "marked as ultimately trusted" diagnostics if
    option --quiet is used.  [#4634]
  * gpg: Silence some diagnostics during in key listsing even with
    option --verbose.  [#4627]
  * gpg, gpgsm: Change parsing of agent's pkdecrypt results.  [#4652]
  * gpgsm: Support AES-256 keys.
  * gpgsm: Fix a bug in triggering a keybox compression run if
  - -faked-system-time is used.
  * dirmngr: System CA certificates are no longer used for the SKS
    pool if GNUTLS instead of NTBTLS is used as TLS library.  [#4594]
  * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
    to avoid long timeouts.  [#4165]
  * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
    Shield and Trustica Cryptoucan work.  [#4654,#4566]
  * wkd: gpg-wks-client --install-key now installs the required policy
    file.
- Rebase patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1575720000">- update to 2.2.19:
  * gpg: Fix double free when decrypting for hidden recipients
  * gpg: Use auto-key-locate for encryption even for mail addressed
    given with angle brackets
  * gpgsm: Add special case for certain expired intermediate
    certificates</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578571200">- Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534]
  * Web of Trust forgeries using collisions in SHA-1 signatures
  * Ignore all SHA-1 signatures in 3rd party key signatures.
  * Forbid the creation of SHA-1 third-party key signatures.
  * Add option --allow-weak-key-signatures
- Add gnupg-CVE-2019-14855.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578657600">- Accept key updates even without UIDs [bsc#1143158]
- Add patches:
  * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
  * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
  * gnupg-add-test-cases-for-import-without-uid.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582113600">- Fix build with GCC-10: [bsc#1160394]
  * Always use EXTERN_UNLESS_MAIN_MODULE pattern
  * In GCC-10, the default option -fcommon will change to -fno-common
- Add gpg2-gcc10-build-fno-common.patch</changelog>
  <changelog author="fvogt@suse.com" date="1584100800">- Split dirmngr into a subpackage to avoid a hard dependency of
  gpg2 on libgnutls</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1584705600">- GnuPG 2.2.20:
  * Protect the error counter against overflow to guarantee that the
    tools can't be tricked into returning success after an error
  * gpg: Make really sure that --verify-files always returns an error
  * gpg: Fix key listing --with-secret if a pattern is given
  * gpg: Fix detection of certain keys used as default-key
  * gpg: Fix default-key selection when a card is available
  * gpg: Fix key expiration and key usage for keys created with a
    creation date of zero
  * gpgsm: Fix import of some CR,LF terminated certificates
  * gpg: New options --include-key-block and --auto-key-import to
    allow encrypted replies after an initial signed message
  * gpg: Allow the use of a fingerprint with --trusted-key
  * gpg: New property "fpr" for use by --export-filter
  * scdaemon: Disable the pinpad if a KDF DO is used
  * dirmngr: Improve finding OCSP certificates
- drop gpg2-gcc10-build-fno-common.patch, upstream</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588248000">- Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811]
- Refresh patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590062400">- Fix warning: agent returned different signature type ssh-rsa
  * The gpg-agent's ssh-agent does not handle flags in signing
    requests properly [bsc#1161268, bsc#1172308]
  * Add gnupg-gpg-agent-ssh-agent.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594296000">- GnuPG 2.2.21:
  * gpg: Improve symmetric decryption speed by about 25%
  * gpg: Support decryption of AEAD encrypted data packets
  * gpg: Add option --no-include-key-block
  * gpg: Allow for extra padding in ECDH
  * gpg: Only a single pinentry is shown for symmetric encryption if
    the pinentry supports this
  * gpg: Print a note if no keys are given to --delete-key
  * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
    shown
  * gpgsm: Certificates without a CRL distribution point are now
    considered valid without looking up a CRL. The new option
  - -enable-issuer-based-crl-check can be used to revert to the
    former behaviour
  * gpgsm: Support rsaPSS signature verification
  * gpgsm: Unless CRL checking is disabled lookup a missing issuer
    certificate using the certificate's authorityInfoAccess
  * gpgsm: Print the certificate's serial number also in decimal
    notation
  * gpgsm: Fix possible NULL-deref in messages of --gen-key
  * scd: Support the CardOS 5 based D-Trust Card 3.1
  * dirmngr: Allow http URLs with "LOOKUP --url"
  * wkd: Take name of sendmail from configure. Fixes an OpenBSD
    specific bug</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1594728000">- Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007]
- Add gnupg-gpgme-t-encrypt-sym.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1598961600">- GnuPG 2.2.22:
  * gpg: Change the default key algorithm to rsa3072
  * gpg: Add regular expression support for Trust Signatures on
    all platforms
  * gpg: Ignore --personal-digest-prefs for ECDSA keys
  * gpgsm: Make rsaPSS a de-vs compliant scheme
  * gpgsm: Show also the SHA256 fingerprint in key listings
  * gpgsm: Do not require a default keyring for --gpgconf-list
  * gpg-agent: Default to extended key format and record the
    creation time of keys
    Add new option --disable-extended-key-format
  * gpg-agent: Support the WAYLAND_DISPLAY envvar
  * gpg-agent: Allow using --gpgconf-list even if HOME does not
    exist
  * gpg-agent: Make the Pinentry work even if the envvar TERM is
    set to the empty string
  * scdaemon: Add a workaround for Gnuk tokens &lt;= 2.15 which
    wrongly incremented the error counter when using the
    "verify" command of "gpg --edit-key" with only the signature
    key being present
  * dirmngr: Better handle systems with disabled IPv6
  * gpgpslit: Install tool.  It was not installed in the past to
    avoid conflicts with the version installed by GnuPG 1.4
  * gpgtar: Make --files-from and --null work as documented
- drop gnupg-gpgme-t-encrypt-sym.patch, upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Fix segv importing certain keys (e.g. ed25519). [bsc#1176034]
- Add gnupg-2.2.22-fix-segv-import-keys.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599134400">- GnuPG 2.2.23:
  * gpg: fix AHEAD preference list overflow boo#1176034 /  CVE-2020-25125
  * gpg: fix possible segv in the key cleaning code
  * gpgsm: fix a minor RFC2253 parser gub
  * scdaemon: Fix a PIN verify failure on certain OpenPGP card
    implementations</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1605614400">- GnuPG 2.2.24:
  * gpg: New command --quick-revoke-sig
  * gpg: Do not use weak digest algos if selected by recipient
    preference during sign+encrypt
  * gpg: Switch to AES256 for symmetric encryption in de-vs mode
  * gpg: Silence weak digest warnings with --quiet
  * gpg: Print new status line CANCELED_BY_USER for a cancel during
    symmetric encryption
  * gpg: Fix the encrypt+sign hash algo preference selection for
    ECDSA.  This is in particular needed for keys created from
    existing smartcard based keys
  * agent: Fix secret key import of GnuPG 2.3 generated Ed25519
    keys
  * agent: Keep some permissions of private-keys-v1.d
  * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
    gnutls builds
  * dirmngr: Fix the pool keyserver case for a single host in the
    pool
  * scd: Fix the use case of verify_chv2 by CHECKPIN
  * scd: Various improvements to the ccid-driver
  * scd: Minor fixes for Yubikey
  * gpgconf: New option --show-versions
  * i18n: Complete overhaul and completion of the Italian
    translation</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606132800">- GnuPG 2.2.25:
  * scd: Fix regression in 2.2.24 requiring gpg --card-status
    before signing or decrypting
  * gpgsm: Using Libksba 1.5.0 signatures with a rarely used
    combination of attributes can now be verified</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610452800">- GnuPG 2.2.27:
  * gpgconf: Fix case with neither local nor global gpg.conf
  * gpgconf: Fix description of two new options
- includes changes from 2.2.26:
  * gpg: New AKL method "ntds"
  * gpg: Fix --trusted-key with fingerprint arg
  * scd: Fix writing of ECC keys to an OpenPGP card
  * scd: Make an USB error fix specific to SPR532 readers
  * dirmngr: With new LDAP keyservers store the new attributes.
    Never store the useless pgpSignerID. Fix a long standing
    bug storing some keys on an ldap server.
  * dirmngr: Support the new Active Direcory LDAP schema for
    keyservers
  * dirmngr: Allow LDAP OpenPGP searches via fingerprint
  * dirmngr: Do not block other threads during keyserver LDAP calls
  * Support global configuration files
  * Fix the iconv fallback handling to UTF-8</changelog>
  <changelog author="pmonreal@suse.com" date="1613995200">- Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572]
- Remove patches fixed upstream:
  * gnupg-gpg-agent-ssh-agent.patch
  * gnupg-2.2.22-fix-segv-import-keys.patch
  * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
  * gnupg-CRL-fetching-via-https.patch
  * gnupg-CVE-2018-1000858.patch
  * gnupg-CVE-2018-12020.patch
  * gnupg-CVE-2019-13050_0_of_5.patch
  * gnupg-CVE-2019-13050_1_of_5.patch
  * gnupg-CVE-2019-13050_2_of_5.patch
  * gnupg-CVE-2019-13050_3_of_5.patch
  * gnupg-CVE-2019-13050_4_of_5.patch
  * gnupg-CVE-2019-13050_5_of_5.patch
  * gnupg-CVE-2019-14855.patch
- Update gpg2.keyring</changelog>
  <changelog author="meissner@suse.com" date="1654689600">- gnupg-detect_FIPS_mode.patch: use AES as default cipher instead
  of 3DES if we are in FIPS mode. (bsc#1196125)</changelog>
  <changelog author="david.anes@suse.com" date="1658145600">- Security fix [CVE-2022-34903, bsc#1201225]
  - Vulnerable to status injection
  - Added patch gnupg-CVE-2022-34903.patch</changelog>
</package>
<package pkgid="e846a7625d5483b08424630435f2a3cceb1c948f60f447c6200f58ce27ab8020" name="gpg2" arch="src">
  <version epoch="0" ver="2.2.27" rel="150300.3.5.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1574856000">- Update to 2.2.18 [bsc#1157900, CVE-2019-14855]
  * gpg: Changed the way keys are detected on a smartcards; this
    allows the use of non-OpenPGP cards.  In the case of a not very
    likely regression the new option --use-only-openpgp-card is
    available.  [#4681]
  * gpg: The commands --full-gen-key and --quick-gen-key now allow
    direct key generation from supported cards.  [#4681]
  * gpg: Prepare against chosen-prefix SHA-1 collisions in key
    signatures.  This change removes all SHA-1 based key signature
    newer than 2019-01-19 from the web-of-trust.  Note that this
    includes all key signature created with dsa1024 keys.  The new
    option --allow-weak-key-signatues can be used to override the new
    and safer behaviour.  [#4755,CVE-2019-14855]
  * gpg: Improve performance for import of large keyblocks.  [#4592]
  * gpg: Implement a keybox compression run.  [#4644]
  * gpg: Show warnings from dirmngr about redirect and certificate
    problems (details require --verbose as usual).
  * gpg: Allow to pass the empty string for the passphrase if the
    '--passphase=' syntax is used.  [#4633]
  * gpg: Fix printing of the KDF object attributes.
  * gpg: Avoid surprises with --locate-external-key and certain
  - -auto-key-locate settings.  [#4662]
  * gpg: Improve selection of best matching key.  [#4713]
  * gpg: Delete key binding signature when deletring a subkey.
    [#4665,#4457]
  * gpg: Fix a potential loss of key sigantures during import with
    self-sigs-only active.  [#4628]
  * gpg: Silence "marked as ultimately trusted" diagnostics if
    option --quiet is used.  [#4634]
  * gpg: Silence some diagnostics during in key listsing even with
    option --verbose.  [#4627]
  * gpg, gpgsm: Change parsing of agent's pkdecrypt results.  [#4652]
  * gpgsm: Support AES-256 keys.
  * gpgsm: Fix a bug in triggering a keybox compression run if
  - -faked-system-time is used.
  * dirmngr: System CA certificates are no longer used for the SKS
    pool if GNUTLS instead of NTBTLS is used as TLS library.  [#4594]
  * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
    to avoid long timeouts.  [#4165]
  * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
    Shield and Trustica Cryptoucan work.  [#4654,#4566]
  * wkd: gpg-wks-client --install-key now installs the required policy
    file.
- Rebase patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1575720000">- update to 2.2.19:
  * gpg: Fix double free when decrypting for hidden recipients
  * gpg: Use auto-key-locate for encryption even for mail addressed
    given with angle brackets
  * gpgsm: Add special case for certain expired intermediate
    certificates</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578571200">- Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534]
  * Web of Trust forgeries using collisions in SHA-1 signatures
  * Ignore all SHA-1 signatures in 3rd party key signatures.
  * Forbid the creation of SHA-1 third-party key signatures.
  * Add option --allow-weak-key-signatures
- Add gnupg-CVE-2019-14855.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578657600">- Accept key updates even without UIDs [bsc#1143158]
- Add patches:
  * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
  * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
  * gnupg-add-test-cases-for-import-without-uid.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582113600">- Fix build with GCC-10: [bsc#1160394]
  * Always use EXTERN_UNLESS_MAIN_MODULE pattern
  * In GCC-10, the default option -fcommon will change to -fno-common
- Add gpg2-gcc10-build-fno-common.patch</changelog>
  <changelog author="fvogt@suse.com" date="1584100800">- Split dirmngr into a subpackage to avoid a hard dependency of
  gpg2 on libgnutls</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1584705600">- GnuPG 2.2.20:
  * Protect the error counter against overflow to guarantee that the
    tools can't be tricked into returning success after an error
  * gpg: Make really sure that --verify-files always returns an error
  * gpg: Fix key listing --with-secret if a pattern is given
  * gpg: Fix detection of certain keys used as default-key
  * gpg: Fix default-key selection when a card is available
  * gpg: Fix key expiration and key usage for keys created with a
    creation date of zero
  * gpgsm: Fix import of some CR,LF terminated certificates
  * gpg: New options --include-key-block and --auto-key-import to
    allow encrypted replies after an initial signed message
  * gpg: Allow the use of a fingerprint with --trusted-key
  * gpg: New property "fpr" for use by --export-filter
  * scdaemon: Disable the pinpad if a KDF DO is used
  * dirmngr: Improve finding OCSP certificates
- drop gpg2-gcc10-build-fno-common.patch, upstream</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588248000">- Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811]
- Refresh patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590062400">- Fix warning: agent returned different signature type ssh-rsa
  * The gpg-agent's ssh-agent does not handle flags in signing
    requests properly [bsc#1161268, bsc#1172308]
  * Add gnupg-gpg-agent-ssh-agent.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594296000">- GnuPG 2.2.21:
  * gpg: Improve symmetric decryption speed by about 25%
  * gpg: Support decryption of AEAD encrypted data packets
  * gpg: Add option --no-include-key-block
  * gpg: Allow for extra padding in ECDH
  * gpg: Only a single pinentry is shown for symmetric encryption if
    the pinentry supports this
  * gpg: Print a note if no keys are given to --delete-key
  * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
    shown
  * gpgsm: Certificates without a CRL distribution point are now
    considered valid without looking up a CRL. The new option
  - -enable-issuer-based-crl-check can be used to revert to the
    former behaviour
  * gpgsm: Support rsaPSS signature verification
  * gpgsm: Unless CRL checking is disabled lookup a missing issuer
    certificate using the certificate's authorityInfoAccess
  * gpgsm: Print the certificate's serial number also in decimal
    notation
  * gpgsm: Fix possible NULL-deref in messages of --gen-key
  * scd: Support the CardOS 5 based D-Trust Card 3.1
  * dirmngr: Allow http URLs with "LOOKUP --url"
  * wkd: Take name of sendmail from configure. Fixes an OpenBSD
    specific bug</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1594728000">- Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007]
- Add gnupg-gpgme-t-encrypt-sym.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1598961600">- GnuPG 2.2.22:
  * gpg: Change the default key algorithm to rsa3072
  * gpg: Add regular expression support for Trust Signatures on
    all platforms
  * gpg: Ignore --personal-digest-prefs for ECDSA keys
  * gpgsm: Make rsaPSS a de-vs compliant scheme
  * gpgsm: Show also the SHA256 fingerprint in key listings
  * gpgsm: Do not require a default keyring for --gpgconf-list
  * gpg-agent: Default to extended key format and record the
    creation time of keys
    Add new option --disable-extended-key-format
  * gpg-agent: Support the WAYLAND_DISPLAY envvar
  * gpg-agent: Allow using --gpgconf-list even if HOME does not
    exist
  * gpg-agent: Make the Pinentry work even if the envvar TERM is
    set to the empty string
  * scdaemon: Add a workaround for Gnuk tokens &lt;= 2.15 which
    wrongly incremented the error counter when using the
    "verify" command of "gpg --edit-key" with only the signature
    key being present
  * dirmngr: Better handle systems with disabled IPv6
  * gpgpslit: Install tool.  It was not installed in the past to
    avoid conflicts with the version installed by GnuPG 1.4
  * gpgtar: Make --files-from and --null work as documented
- drop gnupg-gpgme-t-encrypt-sym.patch, upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Fix segv importing certain keys (e.g. ed25519). [bsc#1176034]
- Add gnupg-2.2.22-fix-segv-import-keys.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599134400">- GnuPG 2.2.23:
  * gpg: fix AHEAD preference list overflow boo#1176034 /  CVE-2020-25125
  * gpg: fix possible segv in the key cleaning code
  * gpgsm: fix a minor RFC2253 parser gub
  * scdaemon: Fix a PIN verify failure on certain OpenPGP card
    implementations</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1605614400">- GnuPG 2.2.24:
  * gpg: New command --quick-revoke-sig
  * gpg: Do not use weak digest algos if selected by recipient
    preference during sign+encrypt
  * gpg: Switch to AES256 for symmetric encryption in de-vs mode
  * gpg: Silence weak digest warnings with --quiet
  * gpg: Print new status line CANCELED_BY_USER for a cancel during
    symmetric encryption
  * gpg: Fix the encrypt+sign hash algo preference selection for
    ECDSA.  This is in particular needed for keys created from
    existing smartcard based keys
  * agent: Fix secret key import of GnuPG 2.3 generated Ed25519
    keys
  * agent: Keep some permissions of private-keys-v1.d
  * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
    gnutls builds
  * dirmngr: Fix the pool keyserver case for a single host in the
    pool
  * scd: Fix the use case of verify_chv2 by CHECKPIN
  * scd: Various improvements to the ccid-driver
  * scd: Minor fixes for Yubikey
  * gpgconf: New option --show-versions
  * i18n: Complete overhaul and completion of the Italian
    translation</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606132800">- GnuPG 2.2.25:
  * scd: Fix regression in 2.2.24 requiring gpg --card-status
    before signing or decrypting
  * gpgsm: Using Libksba 1.5.0 signatures with a rarely used
    combination of attributes can now be verified</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610452800">- GnuPG 2.2.27:
  * gpgconf: Fix case with neither local nor global gpg.conf
  * gpgconf: Fix description of two new options
- includes changes from 2.2.26:
  * gpg: New AKL method "ntds"
  * gpg: Fix --trusted-key with fingerprint arg
  * scd: Fix writing of ECC keys to an OpenPGP card
  * scd: Make an USB error fix specific to SPR532 readers
  * dirmngr: With new LDAP keyservers store the new attributes.
    Never store the useless pgpSignerID. Fix a long standing
    bug storing some keys on an ldap server.
  * dirmngr: Support the new Active Direcory LDAP schema for
    keyservers
  * dirmngr: Allow LDAP OpenPGP searches via fingerprint
  * dirmngr: Do not block other threads during keyserver LDAP calls
  * Support global configuration files
  * Fix the iconv fallback handling to UTF-8</changelog>
  <changelog author="pmonreal@suse.com" date="1613995200">- Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572]
- Remove patches fixed upstream:
  * gnupg-gpg-agent-ssh-agent.patch
  * gnupg-2.2.22-fix-segv-import-keys.patch
  * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
  * gnupg-CRL-fetching-via-https.patch
  * gnupg-CVE-2018-1000858.patch
  * gnupg-CVE-2018-12020.patch
  * gnupg-CVE-2019-13050_0_of_5.patch
  * gnupg-CVE-2019-13050_1_of_5.patch
  * gnupg-CVE-2019-13050_2_of_5.patch
  * gnupg-CVE-2019-13050_3_of_5.patch
  * gnupg-CVE-2019-13050_4_of_5.patch
  * gnupg-CVE-2019-13050_5_of_5.patch
  * gnupg-CVE-2019-14855.patch
- Update gpg2.keyring</changelog>
  <changelog author="meissner@suse.com" date="1654689600">- gnupg-detect_FIPS_mode.patch: use AES as default cipher instead
  of 3DES if we are in FIPS mode. (bsc#1196125)</changelog>
  <changelog author="david.anes@suse.com" date="1658145600">- Security fix [CVE-2022-34903, bsc#1201225]
  - Vulnerable to status injection
  - Added patch gnupg-CVE-2022-34903.patch</changelog>
</package>
<package pkgid="ae0837de302a651edd446f0ca4fe79e94ef7af86ff59cc029a5e0c858f41c11c" name="gpg2" arch="x86_64">
  <version epoch="0" ver="2.2.27" rel="150300.3.5.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1574856000">- Update to 2.2.18 [bsc#1157900, CVE-2019-14855]
  * gpg: Changed the way keys are detected on a smartcards; this
    allows the use of non-OpenPGP cards.  In the case of a not very
    likely regression the new option --use-only-openpgp-card is
    available.  [#4681]
  * gpg: The commands --full-gen-key and --quick-gen-key now allow
    direct key generation from supported cards.  [#4681]
  * gpg: Prepare against chosen-prefix SHA-1 collisions in key
    signatures.  This change removes all SHA-1 based key signature
    newer than 2019-01-19 from the web-of-trust.  Note that this
    includes all key signature created with dsa1024 keys.  The new
    option --allow-weak-key-signatues can be used to override the new
    and safer behaviour.  [#4755,CVE-2019-14855]
  * gpg: Improve performance for import of large keyblocks.  [#4592]
  * gpg: Implement a keybox compression run.  [#4644]
  * gpg: Show warnings from dirmngr about redirect and certificate
    problems (details require --verbose as usual).
  * gpg: Allow to pass the empty string for the passphrase if the
    '--passphase=' syntax is used.  [#4633]
  * gpg: Fix printing of the KDF object attributes.
  * gpg: Avoid surprises with --locate-external-key and certain
  - -auto-key-locate settings.  [#4662]
  * gpg: Improve selection of best matching key.  [#4713]
  * gpg: Delete key binding signature when deletring a subkey.
    [#4665,#4457]
  * gpg: Fix a potential loss of key sigantures during import with
    self-sigs-only active.  [#4628]
  * gpg: Silence "marked as ultimately trusted" diagnostics if
    option --quiet is used.  [#4634]
  * gpg: Silence some diagnostics during in key listsing even with
    option --verbose.  [#4627]
  * gpg, gpgsm: Change parsing of agent's pkdecrypt results.  [#4652]
  * gpgsm: Support AES-256 keys.
  * gpgsm: Fix a bug in triggering a keybox compression run if
  - -faked-system-time is used.
  * dirmngr: System CA certificates are no longer used for the SKS
    pool if GNUTLS instead of NTBTLS is used as TLS library.  [#4594]
  * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
    to avoid long timeouts.  [#4165]
  * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
    Shield and Trustica Cryptoucan work.  [#4654,#4566]
  * wkd: gpg-wks-client --install-key now installs the required policy
    file.
- Rebase patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1575720000">- update to 2.2.19:
  * gpg: Fix double free when decrypting for hidden recipients
  * gpg: Use auto-key-locate for encryption even for mail addressed
    given with angle brackets
  * gpgsm: Add special case for certain expired intermediate
    certificates</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578571200">- Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534]
  * Web of Trust forgeries using collisions in SHA-1 signatures
  * Ignore all SHA-1 signatures in 3rd party key signatures.
  * Forbid the creation of SHA-1 third-party key signatures.
  * Add option --allow-weak-key-signatures
- Add gnupg-CVE-2019-14855.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1578657600">- Accept key updates even without UIDs [bsc#1143158]
- Add patches:
  * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
  * gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
  * gnupg-add-test-cases-for-import-without-uid.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582113600">- Fix build with GCC-10: [bsc#1160394]
  * Always use EXTERN_UNLESS_MAIN_MODULE pattern
  * In GCC-10, the default option -fcommon will change to -fno-common
- Add gpg2-gcc10-build-fno-common.patch</changelog>
  <changelog author="fvogt@suse.com" date="1584100800">- Split dirmngr into a subpackage to avoid a hard dependency of
  gpg2 on libgnutls</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1584705600">- GnuPG 2.2.20:
  * Protect the error counter against overflow to guarantee that the
    tools can't be tricked into returning success after an error
  * gpg: Make really sure that --verify-files always returns an error
  * gpg: Fix key listing --with-secret if a pattern is given
  * gpg: Fix detection of certain keys used as default-key
  * gpg: Fix default-key selection when a card is available
  * gpg: Fix key expiration and key usage for keys created with a
    creation date of zero
  * gpgsm: Fix import of some CR,LF terminated certificates
  * gpg: New options --include-key-block and --auto-key-import to
    allow encrypted replies after an initial signed message
  * gpg: Allow the use of a fingerprint with --trusted-key
  * gpg: New property "fpr" for use by --export-filter
  * scdaemon: Disable the pinpad if a KDF DO is used
  * dirmngr: Improve finding OCSP certificates
- drop gpg2-gcc10-build-fno-common.patch, upstream</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1588248000">- Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811]
- Refresh patches:
  * gnupg-2.2.8-files-are-digests.patch
  * gnupg-add_legacy_FIPS_mode_option.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590062400">- Fix warning: agent returned different signature type ssh-rsa
  * The gpg-agent's ssh-agent does not handle flags in signing
    requests properly [bsc#1161268, bsc#1172308]
  * Add gnupg-gpg-agent-ssh-agent.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1594296000">- GnuPG 2.2.21:
  * gpg: Improve symmetric decryption speed by about 25%
  * gpg: Support decryption of AEAD encrypted data packets
  * gpg: Add option --no-include-key-block
  * gpg: Allow for extra padding in ECDH
  * gpg: Only a single pinentry is shown for symmetric encryption if
    the pinentry supports this
  * gpg: Print a note if no keys are given to --delete-key
  * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
    shown
  * gpgsm: Certificates without a CRL distribution point are now
    considered valid without looking up a CRL. The new option
  - -enable-issuer-based-crl-check can be used to revert to the
    former behaviour
  * gpgsm: Support rsaPSS signature verification
  * gpgsm: Unless CRL checking is disabled lookup a missing issuer
    certificate using the certificate's authorityInfoAccess
  * gpgsm: Print the certificate's serial number also in decimal
    notation
  * gpgsm: Fix possible NULL-deref in messages of --gen-key
  * scd: Support the CardOS 5 based D-Trust Card 3.1
  * dirmngr: Allow http URLs with "LOOKUP --url"
  * wkd: Take name of sendmail from configure. Fixes an OpenBSD
    specific bug</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1594728000">- Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007]
- Add gnupg-gpgme-t-encrypt-sym.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1598961600">- GnuPG 2.2.22:
  * gpg: Change the default key algorithm to rsa3072
  * gpg: Add regular expression support for Trust Signatures on
    all platforms
  * gpg: Ignore --personal-digest-prefs for ECDSA keys
  * gpgsm: Make rsaPSS a de-vs compliant scheme
  * gpgsm: Show also the SHA256 fingerprint in key listings
  * gpgsm: Do not require a default keyring for --gpgconf-list
  * gpg-agent: Default to extended key format and record the
    creation time of keys
    Add new option --disable-extended-key-format
  * gpg-agent: Support the WAYLAND_DISPLAY envvar
  * gpg-agent: Allow using --gpgconf-list even if HOME does not
    exist
  * gpg-agent: Make the Pinentry work even if the envvar TERM is
    set to the empty string
  * scdaemon: Add a workaround for Gnuk tokens &lt;= 2.15 which
    wrongly incremented the error counter when using the
    "verify" command of "gpg --edit-key" with only the signature
    key being present
  * dirmngr: Better handle systems with disabled IPv6
  * gpgpslit: Install tool.  It was not installed in the past to
    avoid conflicts with the version installed by GnuPG 1.4
  * gpgtar: Make --files-from and --null work as documented
- drop gnupg-gpgme-t-encrypt-sym.patch, upstream</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Fix segv importing certain keys (e.g. ed25519). [bsc#1176034]
- Add gnupg-2.2.22-fix-segv-import-keys.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1599134400">- GnuPG 2.2.23:
  * gpg: fix AHEAD preference list overflow boo#1176034 /  CVE-2020-25125
  * gpg: fix possible segv in the key cleaning code
  * gpgsm: fix a minor RFC2253 parser gub
  * scdaemon: Fix a PIN verify failure on certain OpenPGP card
    implementations</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1605614400">- GnuPG 2.2.24:
  * gpg: New command --quick-revoke-sig
  * gpg: Do not use weak digest algos if selected by recipient
    preference during sign+encrypt
  * gpg: Switch to AES256 for symmetric encryption in de-vs mode
  * gpg: Silence weak digest warnings with --quiet
  * gpg: Print new status line CANCELED_BY_USER for a cancel during
    symmetric encryption
  * gpg: Fix the encrypt+sign hash algo preference selection for
    ECDSA.  This is in particular needed for keys created from
    existing smartcard based keys
  * agent: Fix secret key import of GnuPG 2.3 generated Ed25519
    keys
  * agent: Keep some permissions of private-keys-v1.d
  * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
    gnutls builds
  * dirmngr: Fix the pool keyserver case for a single host in the
    pool
  * scd: Fix the use case of verify_chv2 by CHECKPIN
  * scd: Various improvements to the ccid-driver
  * scd: Minor fixes for Yubikey
  * gpgconf: New option --show-versions
  * i18n: Complete overhaul and completion of the Italian
    translation</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606132800">- GnuPG 2.2.25:
  * scd: Fix regression in 2.2.24 requiring gpg --card-status
    before signing or decrypting
  * gpgsm: Using Libksba 1.5.0 signatures with a rarely used
    combination of attributes can now be verified</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610452800">- GnuPG 2.2.27:
  * gpgconf: Fix case with neither local nor global gpg.conf
  * gpgconf: Fix description of two new options
- includes changes from 2.2.26:
  * gpg: New AKL method "ntds"
  * gpg: Fix --trusted-key with fingerprint arg
  * scd: Fix writing of ECC keys to an OpenPGP card
  * scd: Make an USB error fix specific to SPR532 readers
  * dirmngr: With new LDAP keyservers store the new attributes.
    Never store the useless pgpSignerID. Fix a long standing
    bug storing some keys on an ldap server.
  * dirmngr: Support the new Active Direcory LDAP schema for
    keyservers
  * dirmngr: Allow LDAP OpenPGP searches via fingerprint
  * dirmngr: Do not block other threads during keyserver LDAP calls
  * Support global configuration files
  * Fix the iconv fallback handling to UTF-8</changelog>
  <changelog author="pmonreal@suse.com" date="1613995200">- Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572]
- Remove patches fixed upstream:
  * gnupg-gpg-agent-ssh-agent.patch
  * gnupg-2.2.22-fix-segv-import-keys.patch
  * gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
  * gnupg-CRL-fetching-via-https.patch
  * gnupg-CVE-2018-1000858.patch
  * gnupg-CVE-2018-12020.patch
  * gnupg-CVE-2019-13050_0_of_5.patch
  * gnupg-CVE-2019-13050_1_of_5.patch
  * gnupg-CVE-2019-13050_2_of_5.patch
  * gnupg-CVE-2019-13050_3_of_5.patch
  * gnupg-CVE-2019-13050_4_of_5.patch
  * gnupg-CVE-2019-13050_5_of_5.patch
  * gnupg-CVE-2019-14855.patch
- Update gpg2.keyring</changelog>
  <changelog author="meissner@suse.com" date="1654689600">- gnupg-detect_FIPS_mode.patch: use AES as default cipher instead
  of 3DES if we are in FIPS mode. (bsc#1196125)</changelog>
  <changelog author="david.anes@suse.com" date="1658145600">- Security fix [CVE-2022-34903, bsc#1201225]
  - Vulnerable to status injection
  - Added patch gnupg-CVE-2022-34903.patch</changelog>
</package>
<package pkgid="1a90d9e0eeb61ec12aeae2246673cf44ba38a95ee749252f8f7b369aee0831f4" name="graphite2" arch="src">
  <version epoch="0" ver="1.3.11" rel="150000.4.3.1"/>
  <changelog author="dmueller@suse.com" date="1413892800">- add link-gcc-shared.diff: link -lgcc_s to fix undefined symbols
  on various ARM architectures</changelog>
  <changelog author="fstrba@suse.com" date="1432036800">- Remove unnecessary utf-8  characters from the spec file</changelog>
  <changelog author="tchvatal@suse.com" date="1438948800">- Version bump to 1.3.0:
  * Various tweaks for the arabic fonts
- Added patches:
  * graphite-nonvoid-return.patch
  * graphite2-1.2.0-cmakepath.patch
- Removed patches:
  * no-specific-nunit-version.diff
  * soname.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Version bump to 1.3.1:
  * Deprecation warning: Full bidi support is about to be deprecated. Make
    contact if this impacts you.
  * Change compression block format slightly to conform to LZ4
  * Handle mono direction text with diacritics consistently. Fonts
    now see the direction they expect consistently and bidi now
    gives expected results.
  * Fixed lots of fuzz bugs
  * Coverity cleanups
  * Build now works for clang and/or asan and/or afl etc.</changelog>
  <changelog author="tchvatal@suse.com" date="1441886400">- Version bump top 1.3.2:
  * Remove full bidi. All segments are assumed to be single directioned.
  * Bug fixes:
    + Decompressor corner cases
    + Various fuzz bugs</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- updated to 1.3.3
  * Slight speed up in Collision Avoidance
  * Remove dead bidi code
  * Bug fixes
    . Between pass bidi reorderings and at the end
    . Decompressor fuzz bugs
    . Other fuzz bugs</changelog>
  <changelog author="tchvatal@suse.com" date="1450699200">- Version update to 1.3.4:
  * Fix Collision Kerning ignoring some diacritics
  * Handle pass bits 16-31 to speed up fonts with &gt; 16 passes
  * Various minor fuzz bug fixes
  * Make Coverity happy
  * Add GR_FALLTHROUGH macro for clang c++11
- Upstream moved to github</changelog>
  <changelog author="pgajdos@suse.com" date="1455278400">- updated to 1.3.5 bnc#965803 CVE-2016-1521:
  * Security bug fix
  * Fix ARM misalignment problem
  * Track latest cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1456747200">- Update to 1.3.6
  * This fixes a number of security related bugs. There are no feature
    improvements or bug fixes in this release.</changelog>
  <changelog author="tchvatal@suse.com" date="1464868800">- Version update to 1.3.8:
  * Various bugfixes found by fuzzers</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- Version update to 1.3.9: fixes some bugs in the collision
  avoidance and may give slightly improved results in some cases.</changelog>
  <changelog author="pgajdos@suse.com" date="1493035200">- security update:
  * CVE-2017-5436 [bsc#1035204]
    + graphite2-CVE-2017-5436.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498046400">- Use %ctest macro
- Update license string to lgpl2.1+ and mpl2.0+
- Remove patch graphite2-CVE-2017-5436.patch
- Update to 1.3.10:
  * Upstream marks this as contianing various bugfixes without
    any specific mentions</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Add patches to fix tests when using python3:
  * graphite2-python3_tests.patch
  * graphite2-python3_tests_cornercases.patch
- Refresh all other patches
- Use fancy name for downloaded tarball
- Run spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1512475200">- Make sure we switch to python3 only on SLE15+ and not on SLE12</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Do not BR asciidoc as we do not install the generated html page</changelog>
  <changelog author="schwab@suse.de" date="1518696000">- gcc8.patch: return correct value from stream operator</changelog>
  <changelog author="pgajdos@suse.com" date="1520856000">- Update to 1.3.11:
- removed patches (upstreamed or not needed)
  * gcc8.patch (code commeted out)
  * graphite-nonvoid-return.patch (code commented out)
  * graphite2-python3_tests.patch (upstreamed)
  * graphite2-python3_tests_cornercases.patch (upstreamed
- refreshed patch
  * link-gcc-shared.diff
- fixes security issue: CVE-2018-7999 [bsc#1084850]
  + graphite2-CVE-2018-7999.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1521201600">- Use python3 everywhere
- Drop fonttools test dep as it pulls TON of py3 packages</changelog>
  <changelog author="pgajdos@suse.com" date="1675425600">- fixed license string [bsc#1207676]:
  LGPL-2.1-or-later OR MPL-2.0 OR GPL-2.0-or-later</changelog>
</package>
<package pkgid="75bba05206f693db2028f6618814aec507382a1fbb4bb7b1caa32b8171cafd8f" name="grub2" arch="aarch64">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="2c44069fb5a370a3d8b020c5f6ebec53b585ab216a4e01fd49c6a8900b0c17a6" name="grub2" arch="src">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="99315428eb6baa4bc2cd7e6651c8c98932b391aac91ae6c655b106b7c3cc9645" name="grub2" arch="x86_64">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="0d23ad13a3bf4a3e4421eb9e1be5cb81b22f90c1f38fffef3eed5d5d919b43f7" name="grub2-arm64-efi" arch="noarch">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="058863badda72b7f18fc1ba8416da101acba926f68d78dcbc2e3edb65858ac53" name="grub2-i386-pc" arch="noarch">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="0c9bf9690822ea6453caf0d5e8bdc4638e26247be4d9bb796d61414475fbb592" name="grub2-snapper-plugin" arch="noarch">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="64d5c336fc7a1357c2323d98536a0bd70633e38844f0c45eaef663bf1d84af8d" name="grub2-x86_64-efi" arch="noarch">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="96799f9b066f125b4b247d710c677763093851764a706d79246c537fa57547fd" name="grub2-x86_64-xen" arch="noarch">
  <version epoch="0" ver="2.04" rel="150300.22.25.1"/>
  <changelog author="mchang@suse.com" date="1613649600">- Restore compatibilty sym-links
  * grub2.spec
- Use rpmlintrc to filter out rpmlint 2.0 error (bsc#1179044)
  * grub2.rpmlintrc</changelog>
  <changelog author="mchang@suse.com" date="1613995200">- Fix build error in binutils 2.36 (bsc#1181741)
  * 0001-Fix-build-error-in-binutils-2.36.patch
- Fix executable stack in grub-emu (bsc#1181696)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1614340800">- VUL-0: grub2,shim: implement new SBAT method (bsc#1182057)
  * 0031-util-mkimage-Remove-unused-code-to-add-BSS-section.patch
  * 0032-util-mkimage-Use-grub_host_to_target32-instead-of-gr.patch
  * 0033-util-mkimage-Always-use-grub_host_to_target32-to-ini.patch
  * 0034-util-mkimage-Unify-more-of-the-PE32-and-PE32-header-.patch
  * 0035-util-mkimage-Reorder-PE-optional-header-fields-set-u.patch
  * 0036-util-mkimage-Improve-data_size-value-calculation.patch
  * 0037-util-mkimage-Refactor-section-setup-to-use-a-helper.patch
  * 0038-util-mkimage-Add-an-option-to-import-SBAT-metadata-i.patch
  * 0039-grub-install-common-Add-sbat-option.patch
- Fix CVE-2021-20225 (bsc#1182262)
  * 0022-lib-arg-Block-repeated-short-options-that-require-an.patch
- Fix CVE-2020-27749 (bsc#1179264)
  * 0024-kern-parser-Fix-resource-leak-if-argc-0.patch
  * 0025-kern-parser-Fix-a-memory-leak.patch
  * 0026-kern-parser-Introduce-process_char-helper.patch
  * 0027-kern-parser-Introduce-terminate_arg-helper.patch
  * 0028-kern-parser-Refactor-grub_parser_split_cmdline-clean.patch
  * 0029-kern-buffer-Add-variable-sized-heap-buffer.patch
  * 0030-kern-parser-Fix-a-stack-buffer-overflow.patch
- Fix CVE-2021-20233 (bsc#1182263)
  * 0023-commands-menuentry-Fix-quoting-in-setparams_prefix.patch
- Fix CVE-2020-25647 (bsc#1177883)
  * 0021-usb-Avoid-possible-out-of-bound-accesses-caused-by-m.patch
- Fix CVE-2020-25632 (bsc#1176711)
  * 0020-dl-Only-allow-unloading-modules-that-are-not-depende.patch
- Fix CVE-2020-27779, CVE-2020-14372 (bsc#1179265) (bsc#1175970)
  * 0001-include-grub-i386-linux.h-Include-missing-grub-types.patch
  * 0002-efi-Make-shim_lock-GUID-and-protocol-type-public.patch
  * 0003-efi-Return-grub_efi_status_t-from-grub_efi_get_varia.patch
  * 0004-efi-Add-a-function-to-read-EFI-variables-with-attrib.patch
  * 0005-efi-Add-secure-boot-detection.patch
  * 0006-efi-Only-register-shim_lock-verifier-if-shim_lock-pr.patch
  * 0007-verifiers-Move-verifiers-API-to-kernel-image.patch
  * 0008-efi-Move-the-shim_lock-verifier-to-the-GRUB-core.patch
  * 0009-kern-Add-lockdown-support.patch
  * 0010-kern-lockdown-Set-a-variable-if-the-GRUB-is-locked-d.patch
  * 0011-efi-Lockdown-the-GRUB-when-the-UEFI-Secure-Boot-is-e.patch
  * 0012-efi-Use-grub_is_lockdown-instead-of-hardcoding-a-dis.patch
  * 0013-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch
  * 0014-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch
  * 0015-commands-Restrict-commands-that-can-load-BIOS-or-DT-.patch
  * 0016-commands-setpci-Restrict-setpci-command-when-locked-.patch
  * 0017-commands-hdparm-Restrict-hdparm-command-when-locked-.patch
  * 0018-gdb-Restrict-GDB-access-when-locked-down.patch
  * 0019-loader-xnu-Don-t-allow-loading-extension-and-package.patch
  * 0040-shim_lock-Only-skip-loading-shim_lock-verifier-with-.patch
  * 0041-squash-Add-secureboot-support-on-efi-chainloader.patch
  * 0042-squash-grub2-efi-chainload-harder.patch
  * 0043-squash-Don-t-allow-insmod-when-secure-boot-is-enable.patch
  * 0044-squash-kern-Add-lockdown-support.patch
  * 0045-squash-Add-support-for-Linux-EFI-stub-loading-on-aar.patch
  * 0046-squash-verifiers-Move-verifiers-API-to-kernel-image.patch
- Drop patch supersceded by the new backport
  * 0001-linuxefi-fail-kernel-validation-without-shim-protoco.patch
  * 0001-shim_lock-Disable-GRUB_VERIFY_FLAGS_DEFER_AUTH-if-se.patch
  * 0007-linuxefi-fail-kernel-validation-without-shim-protoco.patch
- Add SBAT metadata section to grub.efi
- Drop shim_lock module as it is part of core of grub.efi
  * grub2.spec</changelog>
  <changelog author="mchang@suse.com" date="1615464000">- Fix chainloading windows on dual boot machine (bsc#1183073)
  * 0001-kern-efi-sb-Add-chainloaded-image-as-shim-s-verifiab.patch</changelog>
  <changelog author="mchang@suse.com" date="1615896000">- Fix powerpc-ieee1275 lpar takes long time to boot with increasing number of
  nvme namespace (bsc#1177751)
  0001-ieee1275-Avoiding-many-unecessary-open-close.patch</changelog>
  <changelog author="mchang@suse.com" date="1617883200">- Fix error grub_file_filters not found in Azure virtual machine (bsc#1182012)
  * 0001-Workaround-volatile-efi-boot-variable.patch</changelog>
  <changelog author="mchang@suse.com" date="1618833600">- Fix build error on armv6/armv7 (bsc#1184712)
  * 0001-emu-fix-executable-stack-marking.patch</changelog>
  <changelog author="mchang@suse.com" date="1619179200">- Fix obsolete syslog in systemd unit file and updating to use journal as
  StandardOutput (bsc#1185149)
  * grub2-once.service</changelog>
  <changelog author="mchang@suse.com" date="1624276800">- Fix boot failure after kdump due to the content of grub.cfg is not
  completed with pending modificaton in xfs journal (bsc#1186975)
  * grub-install-force-journal-draining-to-ensure-data-i.patch
- Patch refreshed
  * grub2-mkconfig-default-entry-correction.patch</changelog>
  <changelog author="mchang@suse.com" date="1624449600">- Fix error gfxterm isn't found with multiple terminals (bsc#1187565)
  * grub2-fix-error-terminal-gfxterm-isn-t-found.patch</changelog>
  <changelog author="mchang@suse.com" date="1624881600">- Fix error not a btrfs filesystem on s390x (bsc#1187645)
  * 80_suse_btrfs_snapshot</changelog>
  <changelog author="mchang@suse.com" date="1637928000">- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch</changelog>
  <changelog author="mchang@suse.com" date="1640260800">- Add support for simplefb (boo#1193532).
  * grub2-simplefb.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112000">- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch</changelog>
  <changelog author="mchang@suse.com" date="1643112001">- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch</changelog>
  <changelog author="mchang@suse.com" date="1646913600">- Fix error in grub-install when linux root device is on lvm thin volume
  (bsc#1192622) (bsc#1191974)
  * 0001-grub-install-bailout-root-device-probing.patch</changelog>
  <changelog author="mchang@suse.com" date="1647000000">- Fix grub-install error when efi system partition is created as mdadm software
  raid1 device (bsc#1179981) (bsc#1195204)
  * 0001-install-fix-software-raid1-on-esp.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998400">- Use boot disks in OpenFirmware, fixing regression caused by
  0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch, when
  the root LV is completely in the boot LUN (bsc#1197948)
  * 0001-ofdisk-improve-boot-time-by-lookup-boot-disk-first.patch</changelog>
  <changelog author="mchang@suse.com" date="1653998401">- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581)
  * 0001-video-Remove-trailing-whitespaces.patch
  * 0002-video-readers-jpeg-Test-for-an-invalid-next-marker-r.patch
  * 0003-video-readers-jpeg-Catch-files-with-unsupported-quan.patch
  * 0004-video-readers-jpeg-Catch-OOB-reads-writes-in-grub_jp.patch
  * 0005-video-readers-jpeg-Don-t-decode-data-before-start-of.patch
  * 0006-misc-Format-string-for-grub_error-should-be-a-litera.patch
  * 0007-loader-efi-chainloader-Simplify-the-loader-state.patch
  * 0008-commands-boot-Add-API-to-pass-context-to-loader.patch
- Fix CVE-2022-28736 (bsc#1198496)
  * 0009-loader-efi-chainloader-Use-grub_loader_set_ex.patch
- Fix CVE-2022-28735 (bsc#1198495)
  * 0010-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch
  * 0011-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch
  * 0012-video-readers-png-Abort-sooner-if-a-read-operation-f.patch
  * 0013-video-readers-png-Refuse-to-handle-multiple-image-he.patch
- Fix CVE-2021-3695 (bsc#1191184)
  * 0014-video-readers-png-Drop-greyscale-support-to-fix-heap.patch
- Fix CVE-2021-3696 (bsc#1191185)
  * 0015-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch
  * 0016-video-readers-png-Sanity-check-some-huffman-codes.patch
  * 0017-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch
  * 0018-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch
  * 0019-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch
- Fix CVE-2021-3697 (bsc#1191186)
  * 0020-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch
  * 0021-normal-charset-Fix-array-out-of-bounds-formatting-un.patch
- Fix CVE-2022-28733 (bsc#1198460)
  * 0022-net-ip-Do-IP-fragment-maths-safely.patch
  * 0023-net-netbuff-Block-overly-large-netbuff-allocs.patch
  * 0024-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch
  * 0025-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch
  * 0026-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch
  * 0027-net-tftp-Avoid-a-trivial-UAF.patch
  * 0028-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0029-net-http-Fix-OOB-write-for-split-http-headers.patch
- Fix CVE-2022-28734 (bsc#1198493)
  * 0030-net-http-Error-out-on-headers-with-LF-without-CR.patch
  * 0031-fs-f2fs-Do-not-read-past-the-end-of-nat-journal-entr.patch
  * 0032-fs-f2fs-Do-not-read-past-the-end-of-nat-bitmap.patch
  * 0033-fs-f2fs-Do-not-copy-file-names-that-are-too-long.patch
  * 0034-fs-btrfs-Fix-several-fuzz-issues-with-invalid-dir-it.patch
  * 0035-fs-btrfs-Fix-more-ASAN-and-SEGV-issues-found-with-fu.patch
  * 0036-fs-btrfs-Fix-more-fuzz-issues-related-to-chunks.patch
  * 0037-Use-grub_loader_set_ex-for-secureboot-chainloader.patch
- Update SBAT security contact (boo#1193282)
- Bump grub's SBAT generation to 2</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
</package>
<package pkgid="0fb46c9d53f95c85041ee12c45ed61048ae471378d749f8c65f8480db4bf2194" name="gstreamer-plugins-base" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="4e02a544014e4d1736fc318655e522c116e2da1ad8f7c460fbad7bbee0c233a6" name="gstreamer-plugins-base" arch="src">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="5552b97580745811c659172d8dc4c5e1a28fa3b2ea1781d62d6d2df2f5ff8d9d" name="gstreamer-plugins-base" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="9b3b58b007a8869686f76d832eb2c39523f6727bc755a63c2b8639a2af7779ff" name="harfbuzz" arch="src">
  <version epoch="0" ver="2.6.4" rel="150200.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1512907200">- Update to version 1.7.2:
  + Optimize hb_set_add_range().
  + Misc fixes.
  + New API: hb_coretext_font_create().</changelog>
  <changelog author="zaitor@opensuse.org" date="1513771200">- Update to version 1.7.4:
  + Fix collect_glyphs() regression caused by hb_set_t changes.
- Changes from version 1.7.3:
  + hb_set_t performance tuning and optimizations.
  + Speed up collect_glyphs() and reject garbage data.
  + In hb_coretext_font_create() set font point-size (ptem).
  + Misc fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1515499200">- Add pkgconfig(gobject-2.0) and
  pkgconfig(gobject-introspection-1.0) BuildRequires, and pass
  with-gobject=yes to configure, build GObject and Introspection
  support.
- Following this, package the new sub-packages libharfbuzz-gobject0
  and typelib-1_0-HarfBuzz-0_0.
- Clean up spec, use autosetup and make_build macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1515585600">- harfbuzz-devel hb-ft.h requires pkgconfig(freetype2) but it is
  not automatically added by the dependency generator.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1518177600">- Update to version 1.7.5:
  + Separate Khmer shaper from Indic.
  + First stab at AAT morx. Not hooked up.
  + Misc bug fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1520596800">- Fix build on Leap 42.3: don't use make_build.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1520769600">- Fix broken libharbuzz-gobject.so symlink by requiring Harfbuzz's
  Gobject library for the devel package.
- Add missing GI bindings requirement for the devel package.</changelog>
  <changelog author="jengelh@inai.de" date="1520942400">- Update summaries.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942401">- Update to version 1.7.6:
  + Fix to hb_set_t binary operations. Ouch.
  + New experimental harfbuzz-subset library. All of hb-subset.h is
    experimental right now and API WILL change.
  + New API:
  - hb_blob_copy_writable_or_fail().
  - HB_OT_TAG_BASE.
  - hb_set_previous().
  - hb_set_previous_range().
- Split out new sub-package libharfbuzz-subset0.
- Add libharfbuzz-gobject0 and libharfbuzz-subset0 to baselibs.
- Use make_build macro.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529150400">- Update to version 1.8.1:
  + Add correctness bug in hb_set_t operations, introduced in
    1.7.7.
- Changes from version 1.8.0:
  + Update to Unicode 11.0.0.
- Changes from version 1.7.7:
  + All HarfBuzz objects are significantly smaller in size now.
  + Sinhala: Position repha on top of post-consonant, not base.
  + Significant libharfbuzz-subset changes. API subject to change.
  + New API in libharfbuzz: hb_blob_create_from_file() and
    hb_face_count().
- Add missing post(un) ldconfig scriptlets for libharfbuzz-subset
  shared library.</changelog>
  <changelog author="tchvatal@suse.com" date="1538654400">- Update to 1.9.0:
  * Various gcc warning fixes
  * New Face-builder API
  * Internal source header name changes
  * Major Khmer shaper improvements
  * Couple of Indic bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1552910400">- Update to 2.3.1:
  * too many changes to ever iterate, see NEWS for the details</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Update to version 2.5.3:
  + Fix UCD script data for Unicode 10+ scripts. This was broken
    since 2.5.0.
  + More optimizations for HB_TINY.
- Changes from version 2.5.2:
  + More hb-config.hh facilities to shrink library size, namely
    when built as HB_TINY.
  + New documentation of custom configurations in CONFIG.md.
  + Fix build on gcc 4.8. That's supported again.
  + Universal Shaping Engine improvements.
  + API Changes: Undeprecate some horizontal-kerning API and
    re-enable in hb-ft, such that Type1 fonts will continue
    kerning.
- Changes from version 2.5.1:
  + Fix build with various versions of Visual Studio.
  + Improved documentation.
  + Bugfix in subsetting glyf table.
  + Improved scripts for cross-compiling for Windows using mingw.
  + Rename HB_MATH_GLYPH_PART_FLAG_EXTENDER to
    HB_OT_MATH_GLYPH_PART_FLAG_EXTENDER. A deprecated macro is
    added for backwards-compatibility.
- Changes from version 2.5.0:
  + This release does not include much functional changes, but
    includes major internal code-base changes. We now require
    C++11. Support for gcc 4.8 and earlier has been dropped.
  + New hb-config.hh facility for compiling smaller library for
    embedded and web usecases.
  + New Unicode Character Databse implementation that is half the
    size of previously-used UCDN.
  + Subsetter improvements.
  + Improved documentation.
  + isc shaping fixes.
- Changes from version 2.4.0:
  + Unicode 12.
  + Misc fixes.
  + Subsetter improvements.
  + New API: HB_BUFFER_FLAG_DO_NOT_INSERT_DOTTED_CIRCLE and
    hb_directwrite_face_create().</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568376000">- Update to version 2.6.1:
  + Fix regression with hb_font_create_sub_font scaling introduced
    in 2.6.0.
  + Change interpretation of font PTEM size / CoreText font size
    handling.
  + hb-ot-font: Prefer symbol cmap subtable if present.
  + Apply 'dist'/'abvm'/'blwm' features to all scripts.
  + Drop experimental DirectWrite API.
- Changes from version 2.6.0:
  + New OpenType metrics, baseline, and metadata table access APIs.
  + New API to set font variations to a named-instance.
  + New hb-gdi.h header and API for creating hb_face_t from HFONT.
  + Amalgam: Provide a single-file harfbuzz.cc file for easier
    alternate building.
  + More size-reduction configurable options, enabled by HB_TINY.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570104000">- Update to version 2.6.2:
  + Misc small fixes, mostly to build-related issues.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1570363200">- add upstream sigining keyring and verify source signature</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1572350400">- update to 2.6.3:
  + Misc small fixes, mostly to build-related issues
  + New API: hb_font_get_nominal_glyphs()</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1574596800">- update to 2.6.4:
  + small bug fixes and build fixes</changelog>
  <changelog author="mgorse@suse.com" date="1657886400">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
</package>
<package pkgid="0fdc18a8632f26b78b8908f22a93b5b6e56a2b68a0f71a4262fe1dd231d93904" name="hwdata" arch="noarch">
  <version epoch="0" ver="0.360" rel="150000.3.48.1"/>
  <changelog author="mpluskal@suse.com" date="1607342400">- Update to version 0.342:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1609934400">- Update to version 0.343:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1610020800">- Add merge-pciids.pl to fully duplicate behavior of pciutils-ids
  * Resolves SLE issue bsc#1180422 bsc#1180482</changelog>
  <changelog author="mpluskal@suse.com" date="1612267200">- Update to version 0.344:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1614600000">- Update to version 0.345:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="eb2d7b075fde64af7ed3b0774e9edfc613d6cc0121ea3c29477b5dce4491872d" name="hwdata" arch="src">
  <version epoch="0" ver="0.360" rel="150000.3.48.1"/>
  <changelog author="mpluskal@suse.com" date="1607342400">- Update to version 0.342:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1609934400">- Update to version 0.343:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1610020800">- Add merge-pciids.pl to fully duplicate behavior of pciutils-ids
  * Resolves SLE issue bsc#1180422 bsc#1180482</changelog>
  <changelog author="mpluskal@suse.com" date="1612267200">- Update to version 0.344:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1614600000">- Update to version 0.345:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="c568ba17663dfcc3e886404a217e491eeedb25947e6fea2c8983faa584466838" name="hwdata" arch="noarch">
  <version epoch="0" ver="0.363" rel="150000.3.51.1"/>
  <changelog author="mpluskal@suse.com" date="1612267200">- Update to version 0.344:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1614600000">- Update to version 0.345:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="dmueller@suse.com" date="1657540800">- update to 0.361:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1663156800">- update to 0.362:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1665662400">- update to 0.363:
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="915bc39b4a2b7ca8784b5fdd14db6ad156fc230e2bb4cf227a50ed798dc8ab66" name="hwdata" arch="src">
  <version epoch="0" ver="0.363" rel="150000.3.51.1"/>
  <changelog author="mpluskal@suse.com" date="1612267200">- Update to version 0.344:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1614600000">- Update to version 0.345:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="dmueller@suse.com" date="1657540800">- update to 0.361:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1663156800">- update to 0.362:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1665662400">- update to 0.363:
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="58c507892f06b9ad0822e4e78f78265ca77116b8cd4656dedb0b18bc193f4d8e" name="hwdata" arch="noarch">
  <version epoch="0" ver="0.365" rel="150000.3.54.1"/>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="dmueller@suse.com" date="1657540800">- update to 0.361:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1663156800">- update to 0.362:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1665662400">- update to 0.363:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1668513600">- update to 0.364:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1670328000">- update to 0.365:
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="96a61b1c8e204ff8f285a8b5413267366c4d16019bb686151e9b78701fc920ac" name="hwdata" arch="src">
  <version epoch="0" ver="0.365" rel="150000.3.54.1"/>
  <changelog author="mpluskal@suse.com" date="1617710400">- Update to version 0.346:
  + Updated pci, usb and vendor ids.
  + Resolves boo#1182482 jsc#SLE-13791 bnc#1170160</changelog>
  <changelog author="mpluskal@suse.com" date="1620302400">- Update to version 0.347 (bsc#1185697):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1622635200">- Update to version 0.348 (bsc#1186749):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1625745600">- Update to version 0.349 (bsc#1187948):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1627992000">- Update to version 0.350 (bsc#1189005):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1630584000">- Update to version 0.351 (bsc#1190091):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1633521600">- Update to version 0.352 (bsc#1191375):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version 0.353 (bsc#1192587):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1638878400">- Update to version 0.354:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1641384000">- Update to version 0.355 (bsc#1194338):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1644321600">- Update to version 0.356:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1646740800">- Update to version 0.357 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1650369600">- Update to version 0.358 (bsc#1196332):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1652270400">- Update to version 0.359:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1654084800">- Update to version 0.360 (bsc#1200110):
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="dmueller@suse.com" date="1657540800">- update to 0.361:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1663156800">- update to 0.362:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1665662400">- update to 0.363:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1668513600">- update to 0.364:
  + Updated pci, usb and vendor ids.</changelog>
  <changelog author="mpluskal@suse.com" date="1670328000">- update to 0.365:
  + Updated pci, usb and vendor ids.</changelog>
</package>
<package pkgid="70eaab6d2409e030632b5f27ccf51d241b96f449ebc30beaf206a173e46bcd39" name="hwinfo" arch="aarch64">
  <version epoch="0" ver="21.82" rel="150300.3.3.1"/>
  <changelog author="wfeldt@opensuse.org" date="1558612800">- merge gh#openSUSE/hwinfo#79
- return BIOS UUID in decoded (with '-'s) form (bsc#1135819)
- 21.65</changelog>
  <changelog author="wfeldt@opensuse.org" date="1558612801">- merge gh#openSUSE/hwinfo#80
- fix Makefile and allow building for old distros
- 21.66</changelog>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
</package>
<package pkgid="bf2423fc974d94680d907d24a277f3bd1636aa33e693f0c521f4f2bbc818c671" name="hwinfo" arch="src">
  <version epoch="0" ver="21.82" rel="150300.3.3.1"/>
  <changelog author="wfeldt@opensuse.org" date="1558612800">- merge gh#openSUSE/hwinfo#79
- return BIOS UUID in decoded (with '-'s) form (bsc#1135819)
- 21.65</changelog>
  <changelog author="wfeldt@opensuse.org" date="1558612801">- merge gh#openSUSE/hwinfo#80
- fix Makefile and allow building for old distros
- 21.66</changelog>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
</package>
<package pkgid="4cb0aad9e2148b3290877e3903a9792bfb31bfc7b9cb883a5088b6e04387d682" name="hwinfo" arch="x86_64">
  <version epoch="0" ver="21.82" rel="150300.3.3.1"/>
  <changelog author="wfeldt@opensuse.org" date="1558612800">- merge gh#openSUSE/hwinfo#79
- return BIOS UUID in decoded (with '-'s) form (bsc#1135819)
- 21.65</changelog>
  <changelog author="wfeldt@opensuse.org" date="1558612801">- merge gh#openSUSE/hwinfo#80
- fix Makefile and allow building for old distros
- 21.66</changelog>
  <changelog author="wfeldt@opensuse.org" date="1563537600">- merge gh#openSUSE/hwinfo#81
- fix DASD detection (bsc#1136475)
- don't include bcache devices
- 21.67</changelog>
  <changelog author="mliska@suse.cz" date="1564747200">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1579003200">- merge gh#openSUSE/hwinfo#84
- the /sbin/udevadm compat symlink is gone
- 21.68</changelog>
  <changelog author="dimstar@opensuse.org" date="1579780800">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavor.</changelog>
  <changelog author="wfeldt@opensuse.org" date="1585051200">- merge gh#openSUSE/hwinfo#85
- fix xen detection (bsc#1167561)
- add link to cpuid doc
- 21.69</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587470400">- merge gh#openSUSE/hwinfo#86
- update pci and usb ids (bsc#1169682)
- fix compiler warnings
- 21.70</changelog>
  <changelog author="wfeldt@opensuse.org" date="1605873600">- merge gh#openSUSE/hwinfo#89
- rework network device detection on aarch64 (bsc#1177600,
  bsc#1177261)
- 21.71</changelog>
  <changelog author="wfeldt@opensuse.org" date="1611748800">- merge gh#openSUSE/hwinfo#92
- improve getting video mode info (bsc#1181101)
- try harder to break out of infinite I/O loops
- 21.72</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618315200">- merge gh#openSUSE/hwinfo#95
- don't rely on select() updating its timeout arg (bsc#1184339)
- 21.73</changelog>
  <changelog author="wfeldt@opensuse.org" date="1621339200">- merge gh#openSUSE/hwinfo#98
- update pci and usb ids
- 21.74</changelog>
  <changelog author="wfeldt@opensuse.org" date="1625227200">- merge gh#openSUSE/hwinfo#100
- recognize loongarch64 architecture
- 21.75</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627041600">- merge gh#openSUSE/hwinfo#104
- Fix timezone issue in SOURCE_DATE_EPOCH code
- 21.76</changelog>
  <changelog author="wfeldt@opensuse.org" date="1633089600">- merge gh#openSUSE/hwinfo#105
- Use license file from gnu.org
- Fix spelling
- Add missing final newline
- Trim excess whitespace
- Simple maintenance improvements
- 21.77</changelog>
  <changelog author="wfeldt@opensuse.org" date="1636632000">- merge gh#openSUSE/hwinfo#106
- Always read numerical 32bit serial number from EDID header.
  Override this with ASCII serial number from display descriptor,
  if available.
- Display numerical 32bit serial number for monitors without serial
  number display descriptor
- 21.78</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639483200">- merge gh#openSUSE/hwinfo#108
- Donot close the open tray after read_cdrom_info.
- Donot close the open tray after read.
- 21.79</changelog>
  <changelog author="wfeldt@opensuse.org" date="1639742400">- merge gh#openSUSE/hwinfo#109
- fix logic around cdrom detection
- 21.80</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649851200">- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81</changelog>
  <changelog author="wfeldt@opensuse.org" date="1655985600">- merge gh#openSUSE/hwinfo#113
- Keep NVMe's namespace output consistency when
  nvme_core.multipath=1 (bsc#1199948)
- 21.82</changelog>
</package>
<package pkgid="8da415adb6e4b4fc760912bfa8d7e43794ece7d805d4a1990f53493a21693185" name="hyper-v" arch="src">
  <version epoch="0" ver="8" rel="150200.14.8.1"/>
  <changelog author="ohering@suse.de" date="1416916800">- introduce -n/--no-daemon option (fate#317533)</changelog>
  <changelog author="ohering@suse.de" date="1418817600">- Start hv_kvp_daemon after network-online.target (bnc#910353)
- ignore ENOBUFS and ENOMEM in the KVP daemon
- vssdaemon: skip all filesystems mounted readonly (bnc#909864)
- vssdaemon: report freeze errors</changelog>
  <changelog author="ohering@suse.de" date="1421064000">- Check return value of setsockopt call
- Improve error logging in VSS daemon.
- Check return value of poll call
- Properly pack the data for file copy functionality
- make struct hv_do_fcopy match Hyper-V host messages</changelog>
  <changelog author="ohering@suse.de" date="1429185600">- Add runlevel script for fcopy daemon in SLE11 (bnc#926534)</changelog>
  <changelog author="ohering@suse.de" date="1430395200">- hv: hypervvssd: call endmntent before call setmntent again
- remove unused bytes_written from kvp_update_file()
- address compiler warnings for hv_kvp_daemon.c
- kvp_daemon: make IPv6-only-injection work
- address compiler warnings for hv_fcopy_daemon.c
- do not add redundant '/' in hv_start_fcopy()</changelog>
  <changelog author="ohering@suse.de" date="1442577600">- add a python script lsvmbus to list VMBus devices (fate#315887)</changelog>
  <changelog author="ohering@suse.de" date="1462363200">- add Conflicts with kernel &lt; 4.2 (fate#320485)
- vss: fix the write()'s argument: error -&gt; vss_msg
- remove repeated HV_FCOPY string
- report ENOSPC errors in hv_fcopy_daemon
- fcopy: full handshake support
- vss: full handshake support
- vss: use misc char device to communicate with kernel
- kvp: use misc char device to communicate with kernel</changelog>
  <changelog author="ohering@suse.de" date="1498651200">- Check VSS daemon is listening before a hot backup (bnc#1029693)
- fix a compile warning in snprintf
- kvp: ensure kvp device fd is closed on exec
- lsvmbus: add pci pass-through UUID</changelog>
  <changelog author="ohering@suse.de" date="1515412800">- update buffer handling in hv_fcopy_daemon
- remove unnecessary header files and netlink related code
- Avoid reading past allocated blocks from KVP file (bnc#1087658)
- fix snprintf warning in kvp_daemon
- properly handle long paths
- kvp: configurable external scripts path
- vss: Thaw the filesystem and continue if freeze call has timed out
- vss: Skip freezing filesystems backed by loop</changelog>
  <changelog author="ohering@suse.de" date="1526990400">- Update lsvmbus interpreter from env(1) to python3(1) (bsc#1093910)</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- hyper-v.tools.hv.hv_vss_daemon.c: Include &lt;sys/sysmacros.h&gt; for major</changelog>
  <changelog author="ohering@suse.de" date="1537876800">- vss: fix loop device detection (07136793)
- Fix IP reporting by KVP daemon with SRIOV (4ba63412)
- Fix a bug in the key delete code (86503bd3)
- fix compiler warnings about major/target_fname (1330fc35)
- PRIVATE hyper-v.compare-with-upstream.sh</changelog>
  <changelog author="ohering@suse.de" date="1539000000">- Update lsvmbus interpreter from python3(1) to python(1)
  because SLE12 lacks python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1539086400">- fcopy: set 'error' in case an unknown operation was requested (c2d68afb)</changelog>
  <changelog author="ohering@suse.de" date="1574856000">- async name resolution in kvp_daemon (bsc#1100758)
- kvp: eliminate 'may be used uninitialized' warning (89eb4d8d)
- fix typos in toolchain (2d35c660)
- fixed Python pep8/flake8 warnings for lsvmbus (5912e791)
- Replace GPLv2 boilerplate/reference with SPDX (43aa3132)
- Fix a warning of buffer overflow with gcc 8.0.1 (4fcba780)</changelog>
  <changelog author="ohering@suse.de" date="1575028800">- Update lsvmbus interpreter from python(1) to python3(1) again
  because only SLE12 lacked proper python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Revert previous non-upstream change for async name resolution
  Just use gethostname via hyper-v.kvp.gethostname.patch (bsc#1100758)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1595419200">- Enable build on aarch64</changelog>
  <changelog author="ohering@suse.de" date="1595419201">- Remove dependency to network-online.target now that gethostname
  is used in kvp_daemon (bsc#1174443, bsc#1174444)
- Reopen the devices if read() or write() returns errors (9fc3c01a)
- Use either python2 or python3 for lsvmbus (bsc#1093910)
- Remove sysv init scripts</changelog>
  <changelog author="ohering@suse.de" date="1597924800">- Allow daemon restart again (bsc#1116957)
  Since some time the kernel moved from netlink sockets to char
  devices, which is supposed to handle a connection reopen for the
  kernel&lt;-&gt;daemon interface</changelog>
</package>
<package pkgid="767187bad20b34fa26b19b745d0474c039d15dd53e7149169707bb441c0595ff" name="hyper-v" arch="x86_64">
  <version epoch="0" ver="8" rel="150200.14.8.1"/>
  <changelog author="ohering@suse.de" date="1416916800">- introduce -n/--no-daemon option (fate#317533)</changelog>
  <changelog author="ohering@suse.de" date="1418817600">- Start hv_kvp_daemon after network-online.target (bnc#910353)
- ignore ENOBUFS and ENOMEM in the KVP daemon
- vssdaemon: skip all filesystems mounted readonly (bnc#909864)
- vssdaemon: report freeze errors</changelog>
  <changelog author="ohering@suse.de" date="1421064000">- Check return value of setsockopt call
- Improve error logging in VSS daemon.
- Check return value of poll call
- Properly pack the data for file copy functionality
- make struct hv_do_fcopy match Hyper-V host messages</changelog>
  <changelog author="ohering@suse.de" date="1429185600">- Add runlevel script for fcopy daemon in SLE11 (bnc#926534)</changelog>
  <changelog author="ohering@suse.de" date="1430395200">- hv: hypervvssd: call endmntent before call setmntent again
- remove unused bytes_written from kvp_update_file()
- address compiler warnings for hv_kvp_daemon.c
- kvp_daemon: make IPv6-only-injection work
- address compiler warnings for hv_fcopy_daemon.c
- do not add redundant '/' in hv_start_fcopy()</changelog>
  <changelog author="ohering@suse.de" date="1442577600">- add a python script lsvmbus to list VMBus devices (fate#315887)</changelog>
  <changelog author="ohering@suse.de" date="1462363200">- add Conflicts with kernel &lt; 4.2 (fate#320485)
- vss: fix the write()'s argument: error -&gt; vss_msg
- remove repeated HV_FCOPY string
- report ENOSPC errors in hv_fcopy_daemon
- fcopy: full handshake support
- vss: full handshake support
- vss: use misc char device to communicate with kernel
- kvp: use misc char device to communicate with kernel</changelog>
  <changelog author="ohering@suse.de" date="1498651200">- Check VSS daemon is listening before a hot backup (bnc#1029693)
- fix a compile warning in snprintf
- kvp: ensure kvp device fd is closed on exec
- lsvmbus: add pci pass-through UUID</changelog>
  <changelog author="ohering@suse.de" date="1515412800">- update buffer handling in hv_fcopy_daemon
- remove unnecessary header files and netlink related code
- Avoid reading past allocated blocks from KVP file (bnc#1087658)
- fix snprintf warning in kvp_daemon
- properly handle long paths
- kvp: configurable external scripts path
- vss: Thaw the filesystem and continue if freeze call has timed out
- vss: Skip freezing filesystems backed by loop</changelog>
  <changelog author="ohering@suse.de" date="1526990400">- Update lsvmbus interpreter from env(1) to python3(1) (bsc#1093910)</changelog>
  <changelog author="schwab@suse.de" date="1533211200">- hyper-v.tools.hv.hv_vss_daemon.c: Include &lt;sys/sysmacros.h&gt; for major</changelog>
  <changelog author="ohering@suse.de" date="1537876800">- vss: fix loop device detection (07136793)
- Fix IP reporting by KVP daemon with SRIOV (4ba63412)
- Fix a bug in the key delete code (86503bd3)
- fix compiler warnings about major/target_fname (1330fc35)
- PRIVATE hyper-v.compare-with-upstream.sh</changelog>
  <changelog author="ohering@suse.de" date="1539000000">- Update lsvmbus interpreter from python3(1) to python(1)
  because SLE12 lacks python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1539086400">- fcopy: set 'error' in case an unknown operation was requested (c2d68afb)</changelog>
  <changelog author="ohering@suse.de" date="1574856000">- async name resolution in kvp_daemon (bsc#1100758)
- kvp: eliminate 'may be used uninitialized' warning (89eb4d8d)
- fix typos in toolchain (2d35c660)
- fixed Python pep8/flake8 warnings for lsvmbus (5912e791)
- Replace GPLv2 boilerplate/reference with SPDX (43aa3132)
- Fix a warning of buffer overflow with gcc 8.0.1 (4fcba780)</changelog>
  <changelog author="ohering@suse.de" date="1575028800">- Update lsvmbus interpreter from python(1) to python3(1) again
  because only SLE12 lacked proper python3 support (bsc#1093910)</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Revert previous non-upstream change for async name resolution
  Just use gethostname via hyper-v.kvp.gethostname.patch (bsc#1100758)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1595419200">- Enable build on aarch64</changelog>
  <changelog author="ohering@suse.de" date="1595419201">- Remove dependency to network-online.target now that gethostname
  is used in kvp_daemon (bsc#1174443, bsc#1174444)
- Reopen the devices if read() or write() returns errors (9fc3c01a)
- Use either python2 or python3 for lsvmbus (bsc#1093910)
- Remove sysv init scripts</changelog>
  <changelog author="ohering@suse.de" date="1597924800">- Allow daemon restart again (bsc#1116957)
  Since some time the kernel moved from netlink sockets to char
  devices, which is supposed to handle a connection reopen for the
  kernel&lt;-&gt;daemon interface</changelog>
</package>
<package pkgid="64e85f1ce8a81796ce116fb0eaff7ce2836b0279f4e5e2561007240d538fcaf7" name="icu" arch="src">
  <version epoch="0" ver="65.1" rel="150200.4.5.1"/>
  <changelog author="jengelh@inai.de" date="1458907200">- Update to new upstream release 57.1
  * CLDR 29 support
  * Grapheme/word/line breaking for emoji sequences, based on
  Unicode 9 proposed rules.
  * Four new Unicode emoji properties
  * DateFormat day period formatting of "noon", "at night", etc. via
  new pattern characters b &amp; B, and DateTimePatternGenerator
  support of C for selecting the customary form.
  * RelativeDateTimeFormatter: Simpler formatting API.
  * New simple &amp; fast SimpleFormatter class for a trivial subset of
  MessageFormat as used in CLDR data.</changelog>
  <changelog author="jengelh@inai.de" date="1477051200">- Update to new upstream release 58.1
  * CLDR 30.0.2: For details of the many changes in CLDR, see
  CLDR 30. Some things to note:
  * For some combinations of numbering system (arab, arabext, latn)
  and/or locale (ar, fa, he), there were changes to the
  bidirectional control characters used with certain symbols
  (percent, minus, plus), and changes to number patterns (currency
  and/or percent, including addition of bidirectional control
  characters in some cases).
  * Thhe bidirectional controls used for such purposes include U+061C
  ARABIC LETTER MARK (ALM), which requires use of the bidirectional
  algorithm from Unicode 6.3 or later.
  * The time separator for Norwegian locales (nb, nn) was changed to
  be ':' throughout.
  * Unicode 9.0: Version 9.0 adds exactly 7,500 characters, for a
  total of 128,172 characters. These additions include six new
  scripts, 19 symbols for the new 4K TV standard, and 72 new
  emoji characters.
  * Draft Emoji 4.0 data
  * Emoji updates for word &amp; line breaking
  * UBiDiTransform/BidiTransform API for convenient transformation of
  text between different Bidi layouts.
  * MeasureFormat API for measurement unit display names
  * Most COUNT and LIMIT enum constants have been deprecated
  * SpoofChecker: Handling of "whole script confusables" has been
  removed from ICU, in accordance with its removal from UTS #39
  Version 9.0.0 and the removal of the corresponding Unicode data
  file.
  * Greek uppercasing ("el" locale ID) removes most diacritics.
  * More robust locale data loading across ICU implementation code.
  * Reduced heap memory usage in DateTimePatternGenerator</changelog>
  <changelog author="idonmez@suse.com" date="1481371200">- Update to new upstream release 58.2
  * CLDR 30.0.3:
    + Fix incorrect data for number of Cantonese speakers in China.
    + Hani_Latn transform was not updated with Unihan 9.0 kMandarin
    readings.
  * Time zone database version 2016j
  * #12815 uspoof_getSkeleton sets backwards-incompatible illegal
    argument exception
  * #12825 uspoof_check goes into an "infinite loop" when U+30FB
    is in an input string
  * #12832 GreekUpper::toUpper skips the final character on a
    non-terminated UTF-8 string
  * #12849 u_strToTitle returns incorrect length if destination
    is NULL</changelog>
  <changelog author="jengelh@inai.de" date="1493294400">- Update to new upstream release 59.1
  * Emoji 5.0 data
  * CLDR 31.0.1
  * * GMT and UTC are no longer unified, and CLDR provides
    distinct UTC display names, avoiding confusion with standard
    (winter) time in Britain.
  * New case mapping API (C++ &amp; Java classes CaseMap) supports
    styled text
  * ICU4C now uses and requires C++11 language features and
    libraries.
  * ICU4C has also moved to char16_t as the type for UTF-16. This
    is a breaking change. Please see the detail section below.</changelog>
  <changelog author="rguenther@suse.com" date="1495022400">- Add icu-avoid-x87-excess-precision.diff to avoid
  FixedPrecision::initVisibleDigits failure on i586 with GCC 7.
  (bnc#1030253)</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- xlocale.patch: don't use obsolete &lt;xlocale.h&gt;</changelog>
  <changelog author="jengelh@inai.de" date="1501675200">- refresh icu-avoid-x87-excess-precision.diff with p1</changelog>
  <changelog author="jengelh@inai.de" date="1513252800">- Update to new upstream release 60.2
  * ICU 60 provides full support for the Unicode 10.0 release
    with many new characters and many property improvements.
    Locale data is updated to CLDR 32, which adds several
    languages and data improvements. A new number formatting API
    has been added.</changelog>
  <changelog author="jengelh@inai.de" date="1514289600">- Drop dangling symlinks /usr/lib64/icu/*.inc</changelog>
  <changelog author="jengelh@inai.de" date="1522843200">- Update to new upstream release 61.1
  * ICU 61 upgrades to CLDR 33 locale data.
- Add icu-number-grouping.diff</changelog>
  <changelog author="jengelh@inai.de" date="1528113600">- Add icu-susevers.diff and disable UTF-8 assumption
  [boo#1095425]</changelog>
  <changelog author="jengelh@inai.de" date="1532865600">- Update to new upstream release 62.1
  * Unicode 11: 684 new characters, including 7 new scripts,
    Mtavruli Georgian capital letters, 5 new Han characters, and
    66 new emoji characters.
  * CLDR 33.1
  * Under-the-hood overhaul of number parsing. Behavior is mostly
    compatible with previous versions, but there are some known
    differences.
- Remove xlocale.patch (code to patch is gone),
  icu-number-grouping.diff (merged upstream)</changelog>
  <changelog author="idonmez@suse.com" date="1539777600">- Update to new upstream release 63.1
  * CLDR 34
    + Segmentation rules and emoji sort order adjusted for
    Unicode 11
    + Somali and Javanese data now up to moderate level
    (document content)
    + Tongan, Konkani, Maori, Dzongkha, Tatar, Kurdish (ku),
    and Xhosa data now up to basic level
    + Many data additions and corrections in many other
    languages
    + The following languages have been added to ICU: Sindhi,
    Maori, Turkmen, Javanese, Interlingua, Kurdish (ku), Xhosa
  * New currency: Venezuela's Bolívar Soberano (VES)
  * New Japanese calendar era from 2019: CLDR and ICU include
    data for testing that can be enabled.
    (ICU #12973, CLDR #10750)
  * To enable CLDR new Japanese era placeholder name, set
    environment variable (and Java system property for ICU4J)
    ICU_ENABLE_TENTATIVE_ERA=true.
  * New API for number and currency range formatting
    (class NumberRangeFormatter, #11276)
  * Support for additional Unicode properties:
    Indic_Positional_Category &amp; Indic_Syllabic_Category (#8966)
    and Vertical_Orientation (#12850)
  * New API for code point maps and tries, mapping Unicode
    code points (U+0000..U+10FFFF) to integer values. (#13530)
  * Java classes CodePointMap, CodePointTrie, MutableCodePointTrie
  * C types UCPMap, UCPTrie, UMutableCPTrie
  * New API for getting a UnicodeSet per binary property and a code
    point map per enumerated/int-value property. (#20086)
  * Full conformance with UAX #14 Line Breaking
    (required BreakIterator feature work). (#7270)
  * C++ Locale class
    + Additional functions forLanguageTag()/toLanguageTag(),
    and functions that are easier and safer to use by using
    StringPiece and ByteSink rather than raw buffers. (#13417)
    + Move semantics. (#13645)
  * Various Out-Of-Memory (OOM) issues have been fixed.
- Refresh icu-versioning.diff</changelog>
  <changelog author="jengelh@inai.de" date="1554120000">- Update to new upstream release 64.1
  * Updates to Unicode 12 and to CLDR 35 locale data with many
    additions and corrections, and some new languages. ICU adds a
    data filtering/subsetting mechanism, improved formatting API,
    and a C++ LocaleBuilder.
- New python3 dependency to build intermediate file
  test/testdata/rules.mk.</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Update to new upstream release 64.2
  * This maintenance update for ICU 64 includes draft Unicode
    12.1 update, CLDR 35.1 locale data and support for the new
    Japanese era Reiwa (??). (boo#1112183, bnc#1103893,
    FATE#325570)</changelog>
  <changelog author="idonmez@suse.com" date="1557835200">- Add 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch to fix a
  regression with the C.UTF-8 locale
  https://unicode-org.atlassian.net/browse/ICU-20575</changelog>
  <changelog author="kukuk@suse.de" date="1566388800">- Remove old obsoletes/provides for migration from very old
  products, as they break our shared library policy (bsc#1146907).</changelog>
  <changelog author="jengelh@inai.de" date="1570276800">- Update to release 65.1 (jsc#SLE-11118).
  * Updated to CLDR 36 locale data with many additions and
    corrections, and some new measurement units.
  * The Java LocaleMatcher API is improved, and ported to C++.
- Drop 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch
  (merged)</changelog>
  <changelog author="qzhao@suse.com" date="1590926400">- Add the provides for libicu to Make .Net core can install
  successfully. (bsc#1167603, bsc#1161007)</changelog>
  <changelog author="qzhao@suse.com" date="1660305600">- Backport icu-CVE-2020-21913.patch: backport commit 727505bdd
  from upstream, use LocalMemory for cmd to prevent use after free
  (bsc#1193951 CVE-2020-21913).</changelog>
</package>
<package pkgid="4e87d8993e55d3a34af66cd0fbae34dda5e4d364f39aeae489ffb17ae36fef5e" name="ignition" arch="aarch64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="a5a04fc99879def108512c83cb3a9a44a9059c72b20242771121069caafad956" name="ignition" arch="src">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="0bc626a1719c1026daa0c348264649049948bcbfb672871ae74d4e74d9508bf6" name="ignition" arch="x86_64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="c6430653fe131607cf560c6bd41ef07b5864fc053dac0f8ae6f370412bfa21db" name="ignition-dracut-grub2" arch="aarch64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="3d9c4e6e95fe38cd7e92a6ba96af1d3f2bdb97d8b223e7cf37328b6a6147ced5" name="ignition-dracut-grub2" arch="x86_64">
  <version epoch="0" ver="2.14.0" rel="150300.6.7.1"/>
  <changelog author="iforster@suse.de" date="1603108800">- Update to version 2.7.0:
  * news: add notes for 2.7.0
  * docs: stabilize spec
  * gomod: bump go.opencensus.io to v0.22.5
  * docs: add section to spec stabilization for failing external tests
  * news: fix error in 2.3.0 changelog
  * tests: update for spec stabilization
  * internal: update for new experimental spec
  * config/v3_3_experimental: create new experimental package
  * config/v3_2_experimental: mark stable
  * interal/providers/*stack: drop timeout for config fetch
  * internal/providers/*stack: exit early if all configs error out
  * internal/providers/*stack: make ErrNotFound authoritative
  * doc: add clevis custom documentation
  * internal/exec/stages: add clevis custom support
  * config: add custom options for clevis devices
  * fetch-offline: immediately return ErrNeedNet on OpenStack
  * ci: unfreeze kernel
  * tests/*: add test for resizing an existing partition
  * docs/*: add resize partition info
  * stages/disks: support resizing an existing partition
  * config: add resize to schema
  * README: Minor changes for consistency
  * test: Use alternative marker for testing ignition config examples
  * docs: Convert and improve formatting for INI sections
  * docs: Add spec ordering instructions for new stable releases
  * docs: Add ToC for some long pages
  * docs: Rename Migrating ... to Upgrading Configs
  * docs: Fix link in Development page
  * docs: Add specs reference page
  * docs: Add index page inspired from README
  * docs: Add Config Validation example from README
  * docs: Add Jekyll front matter for existing pages
  * docs: Add Jekyll and theme config
  * internal: fix S3 region detection
  * docs: Follow-up for doc-&gt;docs renaming
  * docs: Rename doc to docs for GitHub Pages support
  * docs/getting-started: tiny cleanups
  * README: drop stray link target
  * doc: drop references to Container Linux
  * doc/development: drop section on running blackbox tests on CL
  * doc: add gs url scheme for bare metal platform
  * fetch: don't run if fetch-offline fetched a config
  * doc: fix LUKS indentation for configuration-v3_2_experimental docs
  * doc: Add shouldExist for users and groups
  * engine: fix logging interactions with fetch-offline
  * AzureStack: fix unfortunate typo of iso9660
  * *: add wipeVolume LUKS field
  * types: Use "path" instead of "path/filepath"
  * Add support for building 32 bit ARM version
  * Install Dracut modules with correct permissions
  * Add support for building 32 bit x86 version
  * doc: add LUKS examples &amp; operator notes
  * internal/stages/disks: allow LUKS device re-use
  * internal: use device aliases for LUKS
  * tests: fix partition.number0 partition size specification
  * blkid: drop some unsafe pointer casts
  * blkid: fix invalid pointer cast in DumpDisk()
  * {sgdisk,blkid}: use int64 for sector counts
  * sgdisk: stop putting sector counts in MiB fields
  * README: note that spec2x is unmaintained
  * release-checklist: drop support for Ignition 0.x
  * release-checklist: minor updates
- Remove upstreamed patches
  * 0001-fix-install-permissions.patch
  * 0003-fix-i386-build.patch
  * ignition-fix-arm32-installation.patch
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="fbui@suse.com" date="1604404800">- Replace  '%service_del_postun -n' with '%service_del_postun_without_restart'
  '-n' is deprecated and will be removed in the future.</changelog>
  <changelog author="hello@anthonyrabbito.com" date="1617192000">- Update to version 2.9.0:
  * news: add notes for 2.9.0
  * internal/providers: Run platform Init function before fetching config
  * internal/providers/aws: fix panic when an IMDSv2 token is present
  * internal/resource/http: re-order initial backoff ramping
  * internal/providers/util: drop dead code
  * ci: move Travis jobs to GitHub actions
  * *: fix errcheck warnings
  * internal/log: drop the error return to appease golanci-lint
  * internal/providers/packet: fix ineffassign warning
  * internal/exec/stages/files: fix the EntrySort test
  * internal: support IMDSv2 for AWS metadata service
  * config/*: require filesystems.format with wipeFilesystem or mountOptions
  * docs: make storage.filesystems.path field optional
  * aws: Log if we fail to determine the EC2 region
  * docs: move systemd.units.name uniqueness constraint to units
  * *: fix gosimple warnings
  * *: fix deadcode warnings
  * *: fix staticcheck warnings
  * config/*: fix nil deref on partitions with no number or label
  * config: add specs newer than 3.0 to TestConfigStructure
  * news: add notes for 2.8.1
  * config/merge: support struct pointers
  * test: drop stale comment
  * tests: Remove unused checkOnStrings
  * news: add notes for 2.8.0
  * config: deprecate MergeStruct()
  * config/merge: allow obtaining a transcript of merge operations
  * config/merge: access field name as fieldMeta.Name
  * config/merge: test primitive list items in slice case 1
  * config/merge: fix typo
  * config/merge: fix comments and add a couple more
  * config/util: remove stray print when parsing invalid JSON
  * vendor: update vcontext
  * docs/development: update dep list for blackbox tests
  * tests/positive: Add tests for masking and unmasking units
  * units: add support for unmasking systemd units
  * release-checklist: minor updates to the release instructions
  * tests/positive/general: add test for merging multiple base configs
  * tests/positive/general: update base config reference
  * docs/development: update spec stabilization to avoid CI breakage
  * release-checklist: drop download_ignition.sh
  * providers/system: support .d directory for base config fragments
  * docs/migrating-configs: spell out Google Cloud Storage
  * release-checklist: update packaging section</changelog>
  <changelog author="rpm@fthiessen.de" date="1622462400">- Update to version 2.10.1:
  * Breaking Changes:
  * Rename Custom struct to ClevisCustom
  * Embed Clevis and ClevisCustom structs in parents
  * Always include interior nodes in merge transcript
  * Add kernel argument support
  * Fix fetching userdata on AWS when IMDSv1 is disabled
  * Fix creating Tang-based LUKS volumes before network is up
  * Document storage.filesystems.wipeFilesystem default
  * Fix file mode of ignition-kargs-helper script
- Fix Go dependency, 1.13+ is required</changelog>
  <changelog author="iforster@suse.com" date="1625659200">- Implement missing ignition-kargs-helper script for kernel
  argument support</changelog>
  <changelog author="iforster@suse.com" date="1625659201">- Update to version 2.11.0:
  * news: add notes for 2.11.0
  * Upgraded docs
  * config/*: return report from previous parser when chaining
  * config/*: re-order testcases by version
  * tree: update for stable v3.3.0 and new v3.4.0-experimental
  * config/v3_4_experimental: adapt for experimental
  * config/v3_4_experimental: copy from config/v3_3
  * config/v3_3: adapt for stabilization
  * config/v3_3_experimental: rename to config/v3_3
  * config/v3_3_exp: pointerify ClevisCustom Config and Pin
  * config/v3_3_exp: pointerify Raid.Level
  * config/v3_3_exp: pointerify LinkEmbedded1.Target
  * stages/disks: simplify a check
  * config/v3_1/translate: don't point to field from input struct
  * config/v3_3_exp: drop devices from schema "required" field
  * config/*: validate that storage.raid.devices is non-empty
  * config/*/types: add RAID validation tests
  * config/shared/errors: fix ErrSparesUnsupportedForLevel message
  * config: fix comment
  * *: formally bump Go to 1.13
  * platform: add powervs platform
  * internal/providers/*stack: drop dead timeout code
  * stages/disks: improve error reporting for LUKS device reuse
  * ignition-setup-user.service: drop Before=multipathd.service
  * Dockerfile: build ignition-validate container using Fedora
  * workflows: test on Go 1.16
  * tests/*: verify deletion of block device w/o creating a FS
  * *: allow erasing block device without creating a filesystem
  * *: rename other projects' master branches to main
  * *: rename master branch to main
  * config/*: add export functions for parsing any config version &lt; N
  * config/*: refactor config.go's Parse() to use GetConfigVersion
  * config/* : minor cleanup
- Refreshed to match new Ignition spec
  * 0002-allow-multiple-mounts-of-same-device.patch</changelog>
  <changelog author="iforster@suse.com" date="1625745600">- If a Combustion device was mounted, then unmount it in
  ignition-kargs-helper - the replacement script will be put on
  the same location</changelog>
  <changelog author="iforster@suse.com" date="1626868800">- Ignore error return code if no virtualization environment
  detected. [bsc#1188479]
  This makes it possible to use Ignition also on bare metal (e.g.
  when dumping images directly to disk) without adding a
  ignition.platform.id parameter.</changelog>
  <changelog author="kukuk@suse.com" date="1627473600">- Include vfat and nls kernel modules into initrd so that we can
  read the ignition configuration from USB drives [bsc#1184202]</changelog>
  <changelog author="iforster@suse.com" date="1628510400">- Update to version 2.12.0:
  * news: add notes for 2.12.0
  * stages/files: add previousReport to result report
  * tests: fix linter warning
  * workflows: limit permissions to reading repo contents
  * workflows: bump linter version
  * go.mod: revendor
  * Drop EOL Go versions
  * internal/distro: drop DiskByIDDir
  * providers/azure: add support for azure gen2 VMs [bsc#1196679]
  * stages/mount: correctly relabel the root of a fresh ext4 filesystem
  * exec: fix permissions for mountpoints in home dirs
  * tests: drop os.ModeDir requirement in mode of output directories
  * examples: reboot with --force
  * exec/util: add blkid API to query block devices based on FSTYPE
  * stages/files: use IntToPtr() in createCrypttabEntries()
  * stages/files: write result report to /var/lib/ignition
  * engine: persist fetched config summaries in State
  * stages/disks: use State to persist keyfiles for files stage
  * *: add general mechanism for persisting state between stages
  * main: drop -clear-cache flag
  * engine: don't hardcode neednet path
  * fetch-offline: return ErrNeedNet if we need net
  * engine: switch Engine.logReport() to pointer receiver
  * engine: fix incorrect error in log message
  * dracut: drop ignition-setup-user.service
  * dracut: drop reference to ignition-setup-base.service
  * providers/gcp: access GCP metadata service by IP address
  * Remove ignition-firstboot-complete.service
  * OWNERS: remove
  * internal/exec/util: drop device argument from cResultToErr()
  * docs/config*: document storage.luks.clevis.threshold default
  * ci: disable spec bump external test workaround
  * docs: Add Ignition release / Spec version table
  * templates: update example releng signing ticket
  * templates: don't update %gotest lines
  * Provide ignition-firstboot-complete.service (removed by upstream
  due to correctly being considered distro spcific), based on the
  old upstream version; removed all non-SUSE specific stuff and
  integrated our own changes
  * Removed change-ignition-firstboot-path.conf (changes are
  integrated into ignition-firstboot-complete.service now).
  * Provide ignition-setup-user.service  (removed by upstream due
  to correctly being considered distro spcific), based on the old
  upstream version.
  * Renamed ignition-setup-user-suse.sh to ignition-setup-user.sh
  * Adapted ignition-generator-suse and module-setup.sh to use the
  custom ignition-setup-user.service (no overriding of parts of the
  service file necessary any more).
  * Synced ignition-kargs-helper script with upstream example
  * Raising minimum Go version to 1.15 as required by upstream</changelog>
  <changelog author="iforster@suse.com" date="1628769600">- is-live-image doesn't exist on *SUSE, and our live images don't
  use Ignition, so just add the Ignition device dependency to the
  service file directly.</changelog>
  <changelog author="iforster@suse.com" date="1629720000">- Make sure to create /boot/writable (may not be present in some
  images)</changelog>
  <changelog author="iforster@suse.com" date="1638360000">- Update to version 2.13.0:
  * news: add notes for 2.13.0
  * config/v3_4_exp: noProxy entries cannot be null
  * config/v3_4_exp: mark ignition.version as required
  * docs/supported-platforms: add some description about Nutanix
  * providers/nutanix: add Nutanix platform
  * tests: use umountPath as a thin wrapper around umountPartition
  * internal/providers: refactor handling of unmounting the mount path
  * tests: address gostatic-check warning
  * tests: Add base64 decoding test
  * Dockerfile.validate: build with Fedora 35
  * go.mod: update dataurl to 1.0.0
  * ci: give blackbox tests two hours to run
  * tests/filesystem: fix umountPartition retry loop
  * templates: skip vendoring the new version in favor of dependabot
  * go.mod: update vcontext
  * providers/virtualbox: read config from /Ignition/Config guest property
  * stages/filesystems: use mkfs.fat instead of mkfs.vfat
  * docs/supported-platforms: switch to Afterburn docs URL
  * docs/supported-platforms: drop reference to platform-specific agents
  * test: ensure all platforms are documented
  * docs/supported-platforms: add missing platforms
  * stages/files: rename `relabelDirsForFile` and add docstring
  * stages/files: make variable name follow Go convention
  * docs/supported-platforms: update platform names and URLs
  * docs/supported-platforms: sort by platform ID
  * docs/supported-platforms: add platform IDs
  * docs: Remove default layout from front matter
  * docs: Do not convert -- &amp; --- to en/em-dash
  * internal/*: change the location of Ignition report
  * internal/exec/util: rename FindFirstMissingDirForFile and tweak docs
  * providers/qemu: start reporting progress reading fw_cfg after 10 s
  * providers/qemu: optimize fw_cfg read size
  * ci: use coreos-ci-lib helper for kola testiso
  * *: gofmt 1.17
  * workflows: bump Go and golangci-lint
  * config: update versions in comments
- Removed obsolete ignition-rpmlintrc</changelog>
  <changelog author="fvogt@suse.com" date="1646395200">- Add support for NetworkManager in dracut:
  * ignition-enable-network.service, ignition-enable-network.sh</changelog>
  <changelog author="fvogt@suse.com" date="1646395201">- Remove /var/lib/YaST2/reconfig_system if a config was provided:
  * ignition-remove-reconfig_system.service</changelog>
  <changelog author="iforster@suse.com" date="1648209600">- Add ignition-touch-selinux-autorelabel.conf:
  Trigger SELinux autorelabel after Ignition runs; Ignition would
  support SELinux itself, however this is a compile time option, so
  it can't be used here.
- Filter commented lines in ignition-mount-initrd-fstab.service</changelog>
  <changelog author="iforster@suse.com" date="1649073600">- Don't include non-MarkDown files in documentation</changelog>
  <changelog author="iforster@suse.com" date="1649160000">- ignition-mount-initrd-fstab.service:
  - Don't ignore errors in loops
  - Unmount mount points recursively - a new submount may have
    appeared
  - Split umount part into own service file:
- ignition-umount-initrd-fstab.service:
  - Unmounts the additional mounts as soon as they are not
    required for Ignition any more; the ExecStop operation is
    running quite late in initrd and may unmount essential mount
    points flagged with "x-initrd.mount" (e.g. when storing /usr on
    a separate mount point). In theory this will also affect
    Ignition itself, but it hasn't been reported as a problem so
    far.</changelog>
  <changelog author="iforster@suse.com" date="1649419200">- Use /bin/sh instead of /usr/bin/sh (for backwards compatibility
  with SLE Micro 5.1) [bsc#1196679]</changelog>
  <changelog author="iforster@suse.com" date="1652875200">- Update to version 2.14.0:
  * NEWS: update v2.14.0
  * docs/operator-notes: add section on provisioning secrets
  * Dockerfile.validate: build with Fedora 36
  * internal/resource: fix gs:// fetches in GCE without a service account
  * docs/operator-notes: document supported S3 URL formats
  * internal/resource: fix S3 access point object ARNs
  * exec/util: fix infinite loop in Depth() if -root is relative
  * Add ignition-delete-config.service and ignition-rmcfg symlink
  * providers/virtualbox: support deleting Ignition configs
  * providers/virtualbox: add comment referencing VirtualBox source
  * providers/virtualbox: add define for GUEST_PROP_FN_GET_PROP
  * providers/virtualbox: add helper to set up hypervisor connection
  * providers/vmware: support deleting Ignition configs
  * main: add ignition-rmcfg multicall binary
  * go.mod: add github.com/beevik/etree
  * providers/vmware: switch to internal copy of OVF parser
  * internal/resource: fix bucket field in error message
  * internal/resource: derive AWS region hint from ARN partition field
  * internal/resource: simplify test
  * internal/resource: fix minor nits
  * provider/azure: try to fetch userdata from IMDS
  * providers/vmware: convert OVF tests to testify
  * providers/vmware: drop vmw-ovflib docs
  * providers/vmware: add verbatim copy of vmw-ovflib
  * providers/vmware: add constants for guestinfo and OVF property names
  * providers/virtualbox: fix reading properties with flags
  * internal/resource: support S3 access point URLs
- Update fixes CVE-2022-1706 from [bsc#1199524]; this introduces a new
  service "ignition-delete-config.service"
- Add ignition-rmcfg-suse.conf dropin to adapt to SUSE environment
- Use fixed paths in spec file for hardcoded installation paths</changelog>
</package>
<package pkgid="127d56c8336a3cfebf58c40ea27d8486f9c6b491cacb837c0abbe152143dacf3" name="iputils" arch="aarch64">
  <version epoch="0" ver="s20161105" rel="150000.8.6.1"/>
  <changelog author="tiwai@suse.de" date="1429531200">- Fix a bogus kernel version check (boo#927831):
  iputils-remove-bogus-check-required-for-2.4.9-kernels.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1448971200">- Update to version s20150815
  * use syntax compatible with busybox date in Makefile
  * Makefile: use #define as in previous code changes
  * ping: status() now returns received/transmitted instead of trans/recv
  * ping: don't mess with internals of struct msghdr
  * tracepath,doc: fix corrupted tag
  * made ping functions protocol independent
  * Allow ping to use IPv6 addresses
  * if IPv4 resolving fails fallback to ping6
  * ping: in usage print the 'ping -6' options as well
  * ping: allow option -4 which forces IPv4
  * combine sock and errno into a single structure
  * This patch allows running ping and ping6 without root privileges on
  * use better names for socket variables
  * travis.yml: install nettle-dev
  * Allow using nettle instead of libgcrypt for MD5
  * avoid compiler warning caused by snapshot.h
  * make `getaddrinfo()` and `getnameinfo()` usage consistent
  * enable IDN by default
  * ping: perform dual-stack ping by default
  * remove IPV4_TARGETS and IPV6_TARGETS
  * ping: remove obsolete preprocessor directives
  * ping: avoid name clashes between IPv4 and IPv6 code
  * ping: merge all ping header files into a single one
  * ping: merge `ping6` command into `ping`
  * ping: refactor ping options
  * ping: refactor ping socket code
  * ping: merge IPv4 and IPv6 `pr_addr()`
  * Use svg instead of png to get better image quality
  * iputils ping/ping6: Add a function to check if a packet is ours
  * ping: Add &lt;linux/types.h&gt; to fix compilation error.
  * ping6: Use GNUTLS API directly for MD5. (v2)
  * ping6: Use libgcrypt instead of gnutls for MD5.
  * ninfod: Regenerate configure by autoconf-2.69.
  * ninfod: libgcrypt support.
  * spec: Configure before building ninfod.
  * spec: Fix date in %changelog.
  * make,spec: Add rpm target.
  * ping,ping6 doc: More description on CAP_NET_RAW usage.
- Update patches
  * iputils-s20101006-ping-interrupt.diff &gt; iputils-ping-interrupt.diff
  * iputils-s20101006-sec-ping-unblock.diff &gt; iputils-sec-ping-unblock.diff
  * iputils-remove-bogus-check-required-for-2.4.9-kernels.patch
- Update home project page and download Url
- Remove obsolete %clean section
- Remove UsrMerge process; it has been done for more than two
  openSUSE releases now</changelog>
  <changelog author="mchandras@suse.de" date="1463486400">- Update to version s20160308 (Changes taken from the RELNOTES file)
  * use syntax compatible with busybox date in Makefile
  * 'admin prohibited' should print !X not !S.
  * Makefile: use #define as in previous code changes
  * doc/Makefile: require bash, because we use pushd and popd
  * doc: don't timestamp manpages by default
  * ping: status() now returns received/transmitted instead of trans/recv
  * ping: don't mess with internals of struct msghdr
  * ping: ICMP error replies while errno &lt; 0 is a hard error
  * ping: always use POSIX locale when parsing -i
  * ping: link against libm
  * made ping functions protocol independent
  * ping: perform dual-stack ping by default
  * ping: remove obsolete preprocessor directives
  * ping: avoid name clashes between IPv4 and IPv6 code
  * ping: merge all ping header files into a single one
  * ping: merge `ping6` command into `ping`
  * ping: refactor ping options
  * ping: refactor ping socket code
  * ping: merge IPv4 and IPv6 `pr_addr()`
  * ping: fix defines and libs in Makefile
  * ping: handle single protocol systems
  * iputils ping/ping6: Add a function to check if a packet is ours
  * ping: Add &lt;linux/types.h&gt; to fix compilation error.
  * ping6: Use GNUTLS API directly for MD5. (v2)
  * ping6: Use libgcrypt instead of gnutls for MD5.
  * Allow ping to use IPv6 addresses
  * ping,ping6 doc: More description on CAP_NET_RAW usage.
  * if IPv4 resolving fails fallback to ping6
  * ping: in usage print the 'ping -6' options as well
  * ping: allow option -4 which forces IPv4
  * combine sock and errno into a single structure
  * This patch allows running ping and ping6 without root privileges on
  * use better names for socket variables
  * tracepath,doc: fix corrupted tag
  * doc: ping: add missing options and remove ping6
  * ninfod: remove unused variables
  * ninfod: Regenerate configure by autoconf-2.69.
  * ninfod: libgcrypt support.
  * Fix building with musl
  * travis.yml: install nettle-dev
  * Allow using nettle instead of libgcrypt for MD5
  * avoid compiler warning caused by snapshot.h
  * make `getaddrinfo()` and `getnameinfo()` usage consistent
  * enable IDN by default
  * remove IPV4_TARGETS and IPV6_TARGETS
  * Use svg instead of png to get better image quality
  * spec: Configure before building ninfod.
  * spec: Fix date in %changelog.
  * make,spec: Add rpm target.
- Refreshed patches
  * iputils-ping-interrupt.diff
  * iputils-sec-ping-unblock.diff
- Remove ifenslave.c. It has been removed in the linux kernel commit
  b1098bbe1b24("bonding: remove ifenslave.c from kernel source").
  bonding can be done via iproute (netlink)
- dropped iputils-ifenslave.diff
- Append our CFLAGS to the upstream ones instead of overriding them.
- Cleanup old make command since the upstream Makefile does things right
  it seems.
- Use Provides: for old /{,s}bin utils to satisfy reverse dependencies.
- Install utilities to /bin and /sbin until reverse dependencies are
  properly fixed.
- Do not install tftp and traceroute to avoid conflicts with the tftp and
  traceroute packages. Stick to what iputils used to provide in the past.
- Remove iputils-traceroute6-stdint.diff patch since we are not building
  the traceroute* utilities.
- Install tracepath to /usr/bin. (boo#795788)</changelog>
  <changelog author="meissner@suse.com" date="1464091200">- do not install rarpd and rarpd.8 manpage (comes from rarpd rpm currently)</changelog>
  <changelog author="mchandras@suse.de" date="1483444800">- Add ping6 symlink (boo#1017616)</changelog>
  <changelog author="pvorel@suse.cz" date="1504785600">- Update to version s20161105 (Changes taken from the RELNOTES file)
  * ping: eliminate deadcode &amp; simplify
  * ping: do not allow oversized packets to root
  * correctly initialize first hop
  * ping: fix ping -6 -I
  * arping,doc: fix documentation of -I
  * ping: fix error message when getting EACCES from connect()
  * renamed INSTALL to INSTALL.md
  * (re)structured INSTALL.md and transformed into markdown; added hint that installation into prefix has to be done with DESTDIR make variable and that there's no prefix support in configure, close #21
  * ping: Silence GCC warnings when building with -fstrict-aliasing
  * tftpd: Drop supplementary groups for root
  * libgcrypt: fix static linking
  * doc: Inserted a missing word
  * tracepath6: avoid redundant family variable
  * tracepath: borrow everything good from tracepath6
  * tracepath: switch to dual-stack operation
  * tracepath: remove now redundant tracepath6
  * docs: fix parallel build of manpages
  * ping: remove assignments of values that are never read
  * docs: remove references to ping6 and traceroute6
  * ping: work with older kernels that don't support ping sockets
  * Revert "ping_common.c: fix message flood when EPERM is encountered in ping"
  * reorder -I option parsing (boo#1057664)
  * ping: also bind the ICMP socket to the specific device
- tracepath6 is now symlink to tracepath.</changelog>
  <changelog author="mpluskal@suse.com" date="1510574400">- Cleanup with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1511870400">- Reintroduce rarpd as subpackage
- Explicitly list content in filelist as we have two subpackages
  now</changelog>
  <changelog author="meissner@suse.com" date="1512043200">- mark ping also verify not caps, as these are changed by the
  permissions package. (bsc#1065835)</changelog>
  <changelog author="mpluskal@suse.com" date="1512820800">- Add systemd service for rarpd</changelog>
  <changelog author="pvorel@suse.cz" date="1512993600">- iputils: remove man pages of unused binaries: ninfod, pg3, rdisc
  (rdisc is in a separate package)</changelog>
  <changelog author="mpluskal@suse.com" date="1512993601">- Install rdisc as rdisc, do not use in.rdisc anymore (xinetd which
  was using in.* names is obsolete anyways)</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1515153600">- Backport iputils-ping-fix-pmtu-for-ipv6.patch from upstream
  to fix PMTU discovery in ping6. (bsc#1072460)</changelog>
  <changelog author="jcaamano@suse.com" date="1523880000">- Backport license information from upstream (bnc#1082788):
  iputils-add-license-info.diff</changelog>
  <changelog author="pvorel@suse.cz" date="1597752000">- Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff)
  Although not documented, they both belong to bsc#674304. Fix from 2011 was
  resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on
  start-up.") [1], released in s20121112.
- Update iputils-remove-bogus-check-required-for-2.4.9-kernels.patch
  (backport 4471ac6 to add changes in header files)
- Use git format for iputils-ping-fix-pmtu-for-ipv6.patch (required by
  %autosetup -p1)
- Use %autosetup -p1</changelog>
  <changelog author="pvorel@suse.cz" date="1653480000">- Add fix for ICMP datagram socket ping6-Fix-device-binding.patch
  (bsc#1196840, bsc#1199918, bsc#1199926, bsc#1199927).</changelog>
</package>
<package pkgid="609c1af3137668dc79958aabbdde4060e14e9e934637fbccaefa143dbd70ffab" name="iputils" arch="src">
  <version epoch="0" ver="s20161105" rel="150000.8.6.1"/>
  <changelog author="ms@suse.de" date="1374580800">- ping denpend on SIGALRM to exit sometime, so we mask it UNBLOCK (bnc #674304)</changelog>
  <changelog author="meissner@suse.com" date="1384344000">- also do the usr move with the permissions handlers bnc#841533</changelog>
  <changelog author="hare@suse.de" date="1390478400">- Update to upstream version s20121221 (FATE#316211)
  - See RELNOTES for full changelog
- Removed merges patches:
  * iputils-pingtypo.diff
  * iputils-s20101006-capabilities.diff
- Updated patches for apply
- Remove libsysfs dependency (FATE#316211)</changelog>
  <changelog author="hare@suse.de" date="1390910400">- Fixed ping segfaults (bnc#860616,bnc#860655)
  * Removed iputils-pingnamelookuponce.diff</changelog>
  <changelog author="tiwai@suse.de" date="1429531200">- Fix a bogus kernel version check (boo#927831):
  iputils-remove-bogus-check-required-for-2.4.9-kernels.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1448971200">- Update to version s20150815
  * use syntax compatible with busybox date in Makefile
  * Makefile: use #define as in previous code changes
  * ping: status() now returns received/transmitted instead of trans/recv
  * ping: don't mess with internals of struct msghdr
  * tracepath,doc: fix corrupted tag
  * made ping functions protocol independent
  * Allow ping to use IPv6 addresses
  * if IPv4 resolving fails fallback to ping6
  * ping: in usage print the 'ping -6' options as well
  * ping: allow option -4 which forces IPv4
  * combine sock and errno into a single structure
  * This patch allows running ping and ping6 without root privileges on
  * use better names for socket variables
  * travis.yml: install nettle-dev
  * Allow using nettle instead of libgcrypt for MD5
  * avoid compiler warning caused by snapshot.h
  * make `getaddrinfo()` and `getnameinfo()` usage consistent
  * enable IDN by default
  * ping: perform dual-stack ping by default
  * remove IPV4_TARGETS and IPV6_TARGETS
  * ping: remove obsolete preprocessor directives
  * ping: avoid name clashes between IPv4 and IPv6 code
  * ping: merge all ping header files into a single one
  * ping: merge `ping6` command into `ping`
  * ping: refactor ping options
  * ping: refactor ping socket code
  * ping: merge IPv4 and IPv6 `pr_addr()`
  * Use svg instead of png to get better image quality
  * iputils ping/ping6: Add a function to check if a packet is ours
  * ping: Add &lt;linux/types.h&gt; to fix compilation error.
  * ping6: Use GNUTLS API directly for MD5. (v2)
  * ping6: Use libgcrypt instead of gnutls for MD5.
  * ninfod: Regenerate configure by autoconf-2.69.
  * ninfod: libgcrypt support.
  * spec: Configure before building ninfod.
  * spec: Fix date in %changelog.
  * make,spec: Add rpm target.
  * ping,ping6 doc: More description on CAP_NET_RAW usage.
- Update patches
  * iputils-s20101006-ping-interrupt.diff &gt; iputils-ping-interrupt.diff
  * iputils-s20101006-sec-ping-unblock.diff &gt; iputils-sec-ping-unblock.diff
  * iputils-remove-bogus-check-required-for-2.4.9-kernels.patch
- Update home project page and download Url
- Remove obsolete %clean section
- Remove UsrMerge process; it has been done for more than two
  openSUSE releases now</changelog>
  <changelog author="mchandras@suse.de" date="1463486400">- Update to version s20160308 (Changes taken from the RELNOTES file)
  * use syntax compatible with busybox date in Makefile
  * 'admin prohibited' should print !X not !S.
  * Makefile: use #define as in previous code changes
  * doc/Makefile: require bash, because we use pushd and popd
  * doc: don't timestamp manpages by default
  * ping: status() now returns received/transmitted instead of trans/recv
  * ping: don't mess with internals of struct msghdr
  * ping: ICMP error replies while errno &lt; 0 is a hard error
  * ping: always use POSIX locale when parsing -i
  * ping: link against libm
  * made ping functions protocol independent
  * ping: perform dual-stack ping by default
  * ping: remove obsolete preprocessor directives
  * ping: avoid name clashes between IPv4 and IPv6 code
  * ping: merge all ping header files into a single one
  * ping: merge `ping6` command into `ping`
  * ping: refactor ping options
  * ping: refactor ping socket code
  * ping: merge IPv4 and IPv6 `pr_addr()`
  * ping: fix defines and libs in Makefile
  * ping: handle single protocol systems
  * iputils ping/ping6: Add a function to check if a packet is ours
  * ping: Add &lt;linux/types.h&gt; to fix compilation error.
  * ping6: Use GNUTLS API directly for MD5. (v2)
  * ping6: Use libgcrypt instead of gnutls for MD5.
  * Allow ping to use IPv6 addresses
  * ping,ping6 doc: More description on CAP_NET_RAW usage.
  * if IPv4 resolving fails fallback to ping6
  * ping: in usage print the 'ping -6' options as well
  * ping: allow option -4 which forces IPv4
  * combine sock and errno into a single structure
  * This patch allows running ping and ping6 without root privileges on
  * use better names for socket variables
  * tracepath,doc: fix corrupted tag
  * doc: ping: add missing options and remove ping6
  * ninfod: remove unused variables
  * ninfod: Regenerate configure by autoconf-2.69.
  * ninfod: libgcrypt support.
  * Fix building with musl
  * travis.yml: install nettle-dev
  * Allow using nettle instead of libgcrypt for MD5
  * avoid compiler warning caused by snapshot.h
  * make `getaddrinfo()` and `getnameinfo()` usage consistent
  * enable IDN by default
  * remove IPV4_TARGETS and IPV6_TARGETS
  * Use svg instead of png to get better image quality
  * spec: Configure before building ninfod.
  * spec: Fix date in %changelog.
  * make,spec: Add rpm target.
- Refreshed patches
  * iputils-ping-interrupt.diff
  * iputils-sec-ping-unblock.diff
- Remove ifenslave.c. It has been removed in the linux kernel commit
  b1098bbe1b24("bonding: remove ifenslave.c from kernel source").
  bonding can be done via iproute (netlink)
- dropped iputils-ifenslave.diff
- Append our CFLAGS to the upstream ones instead of overriding them.
- Cleanup old make command since the upstream Makefile does things right
  it seems.
- Use Provides: for old /{,s}bin utils to satisfy reverse dependencies.
- Install utilities to /bin and /sbin until reverse dependencies are
  properly fixed.
- Do not install tftp and traceroute to avoid conflicts with the tftp and
  traceroute packages. Stick to what iputils used to provide in the past.
- Remove iputils-traceroute6-stdint.diff patch since we are not building
  the traceroute* utilities.
- Install tracepath to /usr/bin. (boo#795788)</changelog>
  <changelog author="meissner@suse.com" date="1464091200">- do not install rarpd and rarpd.8 manpage (comes from rarpd rpm currently)</changelog>
  <changelog author="mchandras@suse.de" date="1483444800">- Add ping6 symlink (boo#1017616)</changelog>
  <changelog author="pvorel@suse.cz" date="1504785600">- Update to version s20161105 (Changes taken from the RELNOTES file)
  * ping: eliminate deadcode &amp; simplify
  * ping: do not allow oversized packets to root
  * correctly initialize first hop
  * ping: fix ping -6 -I
  * arping,doc: fix documentation of -I
  * ping: fix error message when getting EACCES from connect()
  * renamed INSTALL to INSTALL.md
  * (re)structured INSTALL.md and transformed into markdown; added hint that installation into prefix has to be done with DESTDIR make variable and that there's no prefix support in configure, close #21
  * ping: Silence GCC warnings when building with -fstrict-aliasing
  * tftpd: Drop supplementary groups for root
  * libgcrypt: fix static linking
  * doc: Inserted a missing word
  * tracepath6: avoid redundant family variable
  * tracepath: borrow everything good from tracepath6
  * tracepath: switch to dual-stack operation
  * tracepath: remove now redundant tracepath6
  * docs: fix parallel build of manpages
  * ping: remove assignments of values that are never read
  * docs: remove references to ping6 and traceroute6
  * ping: work with older kernels that don't support ping sockets
  * Revert "ping_common.c: fix message flood when EPERM is encountered in ping"
  * reorder -I option parsing (boo#1057664)
  * ping: also bind the ICMP socket to the specific device
- tracepath6 is now symlink to tracepath.</changelog>
  <changelog author="mpluskal@suse.com" date="1510574400">- Cleanup with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1511870400">- Reintroduce rarpd as subpackage
- Explicitly list content in filelist as we have two subpackages
  now</changelog>
  <changelog author="meissner@suse.com" date="1512043200">- mark ping also verify not caps, as these are changed by the
  permissions package. (bsc#1065835)</changelog>
  <changelog author="mpluskal@suse.com" date="1512820800">- Add systemd service for rarpd</changelog>
  <changelog author="pvorel@suse.cz" date="1512993600">- iputils: remove man pages of unused binaries: ninfod, pg3, rdisc
  (rdisc is in a separate package)</changelog>
  <changelog author="mpluskal@suse.com" date="1512993601">- Install rdisc as rdisc, do not use in.rdisc anymore (xinetd which
  was using in.* names is obsolete anyways)</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1515153600">- Backport iputils-ping-fix-pmtu-for-ipv6.patch from upstream
  to fix PMTU discovery in ping6. (bsc#1072460)</changelog>
  <changelog author="jcaamano@suse.com" date="1523880000">- Backport license information from upstream (bnc#1082788):
  iputils-add-license-info.diff</changelog>
  <changelog author="pvorel@suse.cz" date="1597752000">- Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff)
  Although not documented, they both belong to bsc#674304. Fix from 2011 was
  resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on
  start-up.") [1], released in s20121112.
- Update iputils-remove-bogus-check-required-for-2.4.9-kernels.patch
  (backport 4471ac6 to add changes in header files)
- Use git format for iputils-ping-fix-pmtu-for-ipv6.patch (required by
  %autosetup -p1)
- Use %autosetup -p1</changelog>
  <changelog author="pvorel@suse.cz" date="1653480000">- Add fix for ICMP datagram socket ping6-Fix-device-binding.patch
  (bsc#1196840, bsc#1199918, bsc#1199926, bsc#1199927).</changelog>
</package>
<package pkgid="95c0955f6a9be01850fcb4451501092cbfc4904b1b10a50241a0f7e1d1225a99" name="iputils" arch="x86_64">
  <version epoch="0" ver="s20161105" rel="150000.8.6.1"/>
  <changelog author="tiwai@suse.de" date="1429531200">- Fix a bogus kernel version check (boo#927831):
  iputils-remove-bogus-check-required-for-2.4.9-kernels.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1448971200">- Update to version s20150815
  * use syntax compatible with busybox date in Makefile
  * Makefile: use #define as in previous code changes
  * ping: status() now returns received/transmitted instead of trans/recv
  * ping: don't mess with internals of struct msghdr
  * tracepath,doc: fix corrupted tag
  * made ping functions protocol independent
  * Allow ping to use IPv6 addresses
  * if IPv4 resolving fails fallback to ping6
  * ping: in usage print the 'ping -6' options as well
  * ping: allow option -4 which forces IPv4
  * combine sock and errno into a single structure
  * This patch allows running ping and ping6 without root privileges on
  * use better names for socket variables
  * travis.yml: install nettle-dev
  * Allow using nettle instead of libgcrypt for MD5
  * avoid compiler warning caused by snapshot.h
  * make `getaddrinfo()` and `getnameinfo()` usage consistent
  * enable IDN by default
  * ping: perform dual-stack ping by default
  * remove IPV4_TARGETS and IPV6_TARGETS
  * ping: remove obsolete preprocessor directives
  * ping: avoid name clashes between IPv4 and IPv6 code
  * ping: merge all ping header files into a single one
  * ping: merge `ping6` command into `ping`
  * ping: refactor ping options
  * ping: refactor ping socket code
  * ping: merge IPv4 and IPv6 `pr_addr()`
  * Use svg instead of png to get better image quality
  * iputils ping/ping6: Add a function to check if a packet is ours
  * ping: Add &lt;linux/types.h&gt; to fix compilation error.
  * ping6: Use GNUTLS API directly for MD5. (v2)
  * ping6: Use libgcrypt instead of gnutls for MD5.
  * ninfod: Regenerate configure by autoconf-2.69.
  * ninfod: libgcrypt support.
  * spec: Configure before building ninfod.
  * spec: Fix date in %changelog.
  * make,spec: Add rpm target.
  * ping,ping6 doc: More description on CAP_NET_RAW usage.
- Update patches
  * iputils-s20101006-ping-interrupt.diff &gt; iputils-ping-interrupt.diff
  * iputils-s20101006-sec-ping-unblock.diff &gt; iputils-sec-ping-unblock.diff
  * iputils-remove-bogus-check-required-for-2.4.9-kernels.patch
- Update home project page and download Url
- Remove obsolete %clean section
- Remove UsrMerge process; it has been done for more than two
  openSUSE releases now</changelog>
  <changelog author="mchandras@suse.de" date="1463486400">- Update to version s20160308 (Changes taken from the RELNOTES file)
  * use syntax compatible with busybox date in Makefile
  * 'admin prohibited' should print !X not !S.
  * Makefile: use #define as in previous code changes
  * doc/Makefile: require bash, because we use pushd and popd
  * doc: don't timestamp manpages by default
  * ping: status() now returns received/transmitted instead of trans/recv
  * ping: don't mess with internals of struct msghdr
  * ping: ICMP error replies while errno &lt; 0 is a hard error
  * ping: always use POSIX locale when parsing -i
  * ping: link against libm
  * made ping functions protocol independent
  * ping: perform dual-stack ping by default
  * ping: remove obsolete preprocessor directives
  * ping: avoid name clashes between IPv4 and IPv6 code
  * ping: merge all ping header files into a single one
  * ping: merge `ping6` command into `ping`
  * ping: refactor ping options
  * ping: refactor ping socket code
  * ping: merge IPv4 and IPv6 `pr_addr()`
  * ping: fix defines and libs in Makefile
  * ping: handle single protocol systems
  * iputils ping/ping6: Add a function to check if a packet is ours
  * ping: Add &lt;linux/types.h&gt; to fix compilation error.
  * ping6: Use GNUTLS API directly for MD5. (v2)
  * ping6: Use libgcrypt instead of gnutls for MD5.
  * Allow ping to use IPv6 addresses
  * ping,ping6 doc: More description on CAP_NET_RAW usage.
  * if IPv4 resolving fails fallback to ping6
  * ping: in usage print the 'ping -6' options as well
  * ping: allow option -4 which forces IPv4
  * combine sock and errno into a single structure
  * This patch allows running ping and ping6 without root privileges on
  * use better names for socket variables
  * tracepath,doc: fix corrupted tag
  * doc: ping: add missing options and remove ping6
  * ninfod: remove unused variables
  * ninfod: Regenerate configure by autoconf-2.69.
  * ninfod: libgcrypt support.
  * Fix building with musl
  * travis.yml: install nettle-dev
  * Allow using nettle instead of libgcrypt for MD5
  * avoid compiler warning caused by snapshot.h
  * make `getaddrinfo()` and `getnameinfo()` usage consistent
  * enable IDN by default
  * remove IPV4_TARGETS and IPV6_TARGETS
  * Use svg instead of png to get better image quality
  * spec: Configure before building ninfod.
  * spec: Fix date in %changelog.
  * make,spec: Add rpm target.
- Refreshed patches
  * iputils-ping-interrupt.diff
  * iputils-sec-ping-unblock.diff
- Remove ifenslave.c. It has been removed in the linux kernel commit
  b1098bbe1b24("bonding: remove ifenslave.c from kernel source").
  bonding can be done via iproute (netlink)
- dropped iputils-ifenslave.diff
- Append our CFLAGS to the upstream ones instead of overriding them.
- Cleanup old make command since the upstream Makefile does things right
  it seems.
- Use Provides: for old /{,s}bin utils to satisfy reverse dependencies.
- Install utilities to /bin and /sbin until reverse dependencies are
  properly fixed.
- Do not install tftp and traceroute to avoid conflicts with the tftp and
  traceroute packages. Stick to what iputils used to provide in the past.
- Remove iputils-traceroute6-stdint.diff patch since we are not building
  the traceroute* utilities.
- Install tracepath to /usr/bin. (boo#795788)</changelog>
  <changelog author="meissner@suse.com" date="1464091200">- do not install rarpd and rarpd.8 manpage (comes from rarpd rpm currently)</changelog>
  <changelog author="mchandras@suse.de" date="1483444800">- Add ping6 symlink (boo#1017616)</changelog>
  <changelog author="pvorel@suse.cz" date="1504785600">- Update to version s20161105 (Changes taken from the RELNOTES file)
  * ping: eliminate deadcode &amp; simplify
  * ping: do not allow oversized packets to root
  * correctly initialize first hop
  * ping: fix ping -6 -I
  * arping,doc: fix documentation of -I
  * ping: fix error message when getting EACCES from connect()
  * renamed INSTALL to INSTALL.md
  * (re)structured INSTALL.md and transformed into markdown; added hint that installation into prefix has to be done with DESTDIR make variable and that there's no prefix support in configure, close #21
  * ping: Silence GCC warnings when building with -fstrict-aliasing
  * tftpd: Drop supplementary groups for root
  * libgcrypt: fix static linking
  * doc: Inserted a missing word
  * tracepath6: avoid redundant family variable
  * tracepath: borrow everything good from tracepath6
  * tracepath: switch to dual-stack operation
  * tracepath: remove now redundant tracepath6
  * docs: fix parallel build of manpages
  * ping: remove assignments of values that are never read
  * docs: remove references to ping6 and traceroute6
  * ping: work with older kernels that don't support ping sockets
  * Revert "ping_common.c: fix message flood when EPERM is encountered in ping"
  * reorder -I option parsing (boo#1057664)
  * ping: also bind the ICMP socket to the specific device
- tracepath6 is now symlink to tracepath.</changelog>
  <changelog author="mpluskal@suse.com" date="1510574400">- Cleanup with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1511870400">- Reintroduce rarpd as subpackage
- Explicitly list content in filelist as we have two subpackages
  now</changelog>
  <changelog author="meissner@suse.com" date="1512043200">- mark ping also verify not caps, as these are changed by the
  permissions package. (bsc#1065835)</changelog>
  <changelog author="mpluskal@suse.com" date="1512820800">- Add systemd service for rarpd</changelog>
  <changelog author="pvorel@suse.cz" date="1512993600">- iputils: remove man pages of unused binaries: ninfod, pg3, rdisc
  (rdisc is in a separate package)</changelog>
  <changelog author="mpluskal@suse.com" date="1512993601">- Install rdisc as rdisc, do not use in.rdisc anymore (xinetd which
  was using in.* names is obsolete anyways)</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1515153600">- Backport iputils-ping-fix-pmtu-for-ipv6.patch from upstream
  to fix PMTU discovery in ping6. (bsc#1072460)</changelog>
  <changelog author="jcaamano@suse.com" date="1523880000">- Backport license information from upstream (bnc#1082788):
  iputils-add-license-info.diff</changelog>
  <changelog author="pvorel@suse.cz" date="1597752000">- Remove 2 old patches (iputils-sec-ping-unblock.diff, iputils-ping-interrupt.diff)
  Although not documented, they both belong to bsc#674304. Fix from 2011 was
  resolved upstream in commit 810dd7f ("ping,ping6: Unmask signals on
  start-up.") [1], released in s20121112.
- Update iputils-remove-bogus-check-required-for-2.4.9-kernels.patch
  (backport 4471ac6 to add changes in header files)
- Use git format for iputils-ping-fix-pmtu-for-ipv6.patch (required by
  %autosetup -p1)
- Use %autosetup -p1</changelog>
  <changelog author="pvorel@suse.cz" date="1653480000">- Add fix for ICMP datagram socket ping6-Fix-device-binding.patch
  (bsc#1196840, bsc#1199918, bsc#1199926, bsc#1199927).</changelog>
</package>
<package pkgid="73a9f70eddbf024a64f14fbdc5921a2117a987c552641dc9dfa1c011c15fd729" name="irqbalance" arch="aarch64">
  <version epoch="0" ver="1.4.0" rel="150200.12.11.1"/>
  <changelog author="mpluskal@suse.com" date="1426507200">- Clenup spec file with spec-cleaner
- Remove bug-893478_warn-once.patch
- Update to 1.0.9
  * PCI quirk support
  * System Logging compatibility
  * isolcpus inheritance
  * Misc. Bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1447070400">- enable build for %arm</changelog>
  <changelog author="mbrugger@suse.com" date="1447761600">- enable build for aarch64</changelog>
  <changelog author="mbrugger@suse.com" date="1447848000">- Only exclude arch s390 and s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1453032000">- Update to 1.1.0
  * Banning support fixes
  * Load calculation improvements
  * Documentation fixes
  * Fix command line preservation across re-scan
  * Memory leak fixes
  * Misc. bug fixes
  * ARM irq support
  * New --banmod option
  * New sleep interval option</changelog>
  <changelog author="schwab@suse.de" date="1456228800">- fix-aarch64-support.patch: Fix AArch64 support</changelog>
  <changelog author="msuchanek@suse.com" date="1476446400">- Set-fd-limit.patch: Increase limit on file descriptors (bsc#998399) (fate#321645)</changelog>
  <changelog author="dmueller@suse.com" date="1484222400">- update to 1.2.0:
  * sort_irq logic rework to fix unintended ordering
  * removal of the affinity_hint infrastructure as its not needed
  * fixes for invalid cpumask parsing
  * many other minior fixes (see git log)
  * Aarch64 support
  * live interactive monitoring of irqbalance and live adjustment with irqbalance-ui
- remove fix-aarch64-support.patch: upstreamed
- add install-man-pages.patch
- add aarch64-compile-fixes.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1486382400">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries (boo#1021328).</changelog>
  <changelog author="fschnizlein@suse.com" date="1488369600">- Remove superfluous comment out man package packing</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="egotthold@suse.com" date="1538395200">- Removed aarch64-compile-fixes.patch because it is mainline now.
- Update to version 1.4.0:
  * Fixed an erroneous calculation of min_load that restricted candidates to a
    subset of objects
  * Fixed powerpc hotplug detection
  * Cleaned up syslog target dependency
  * Added some self test infrastructure (via make check)
- Update to version 1.3.0
  * New features in this release:
    optimization of platform device irq detection
    Added sample udev rules to trigger irq rescans on device add/remove
    Made irqbalance ui an optional compile component
    Added support for Intel CoD
    Add -v | --version option to command line
  * Bug fixes in this release:
    Misc compiler warning fixes and spelling errors
    Compilation error fix on aarch64
    Compilation error fix when using clang in c99 mode
    Unused variable cleanup
    Lots of memory leak cleanup in irqbalance-ui
    Prevent irqbalance from running in a container
    Fix irq affinity assignment in some cases to wrong numa node
    Fix oneshot mode
    exclude legacy irq 255
  * Deprecations:
    without-glib2 is removed, we just need it enough that we can't dummy it up
    anymore</changelog>
  <changelog author="trenn@suse.de" date="1538654400">- Allow compilation with SLE-12 and before by:
  * removing -std=C99 Latest compiler version does not complain
  anymore, SLE12 SPx and before did.
  * Fix a possible buffer overflow compiler warning
  A fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="ohering@suse.de" date="1572004800">- In HyperV VMs all NVME MSI interrupts are set to unmanaged to
  compensate the lack of matrix.c in pre-v4.20 kernels.
  Irqbalanced is supposed to spread the load. (bsc#1119461, bsc#1154905, bsc#1138190)
  Performance can be improved further with --hintpolicy=subset
- add 0001-Revert-remove-affinity_hint-infrastructure.patch
- add set-numa-node.patch
- add 0001-Revert-Types-clean-out-unused-variables-from-irq_inf.patch</changelog>
  <changelog author="ohering@suse.de" date="1573732800">- Revert previous changes for kernel 5.3+
- remove 0001-Revert-remove-affinity_hint-infrastructure.patch
- remove set-numa-node.patch
- remove 0001-Revert-Types-clean-out-unused-variables-from-irq_inf.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1614859200">- Due to a bug in irqbalance's parsing of /sys/devices/system/cpu/cpu*/node*
  entries, all CPUs is considered to be on NUMA node 0. Backport fix for
  ambiguous parsing of *node* entries in /sys from upstream to fix this issue.
  (bsc#1156315, bsc#1182254)
- add fix-ambiguous-parsing-of-node-entries-in-sys.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1615291200">- Correctly detect the NUMA node of non-PCI devices.
  (bsc#1156315 bsc#1183157)
- add also-fetch-node-info-for-non-PCI-devices.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1615550400">- Adapt also-fetch-node-info-for-non-PCI-devices.patch to v1.4.0, and
  backport process_one_line() and get_int() which is required for it
  to work.</changelog>
  <changelog author="trenn@suse.de" date="1617278400">- not balancing interrupts in Xen guests (bsc#1178477, bsc#1183405)
  A procinterrupts-check-xen-dyn-event-more-flexible.patch</changelog>
  <changelog author="trenn@suse.de" date="1669204800">- Fix segfault from previous update (bsc#1206668)
- Fix version - Maintainer forgot to increase version to 1.4.0
  A fix_version_1_4_0
- Add mainline fixes (bnc#1204961):
  The first 2 patches are cleanup patches which should not have any
  functional change, but make life easier to backport the real fix.
  All patches are mainline:
  A    Update-classify.c.patch
  A    irqbalance-properly-check-if-irq-is-banned.patch
  A    remove-unused-path-in-check_for_irq_ban.patch</changelog>
</package>
<package pkgid="99bd5ae5cc405a7fb1e746642753c418b927eaf2cf1485e7f27e8b1db0af180d" name="irqbalance" arch="src">
  <version epoch="0" ver="1.4.0" rel="150200.12.11.1"/>
  <changelog author="mpluskal@suse.com" date="1426507200">- Clenup spec file with spec-cleaner
- Remove bug-893478_warn-once.patch
- Update to 1.0.9
  * PCI quirk support
  * System Logging compatibility
  * isolcpus inheritance
  * Misc. Bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1447070400">- enable build for %arm</changelog>
  <changelog author="mbrugger@suse.com" date="1447761600">- enable build for aarch64</changelog>
  <changelog author="mbrugger@suse.com" date="1447848000">- Only exclude arch s390 and s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1453032000">- Update to 1.1.0
  * Banning support fixes
  * Load calculation improvements
  * Documentation fixes
  * Fix command line preservation across re-scan
  * Memory leak fixes
  * Misc. bug fixes
  * ARM irq support
  * New --banmod option
  * New sleep interval option</changelog>
  <changelog author="schwab@suse.de" date="1456228800">- fix-aarch64-support.patch: Fix AArch64 support</changelog>
  <changelog author="msuchanek@suse.com" date="1476446400">- Set-fd-limit.patch: Increase limit on file descriptors (bsc#998399) (fate#321645)</changelog>
  <changelog author="dmueller@suse.com" date="1484222400">- update to 1.2.0:
  * sort_irq logic rework to fix unintended ordering
  * removal of the affinity_hint infrastructure as its not needed
  * fixes for invalid cpumask parsing
  * many other minior fixes (see git log)
  * Aarch64 support
  * live interactive monitoring of irqbalance and live adjustment with irqbalance-ui
- remove fix-aarch64-support.patch: upstreamed
- add install-man-pages.patch
- add aarch64-compile-fixes.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1486382400">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries (boo#1021328).</changelog>
  <changelog author="fschnizlein@suse.com" date="1488369600">- Remove superfluous comment out man package packing</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="egotthold@suse.com" date="1538395200">- Removed aarch64-compile-fixes.patch because it is mainline now.
- Update to version 1.4.0:
  * Fixed an erroneous calculation of min_load that restricted candidates to a
    subset of objects
  * Fixed powerpc hotplug detection
  * Cleaned up syslog target dependency
  * Added some self test infrastructure (via make check)
- Update to version 1.3.0
  * New features in this release:
    optimization of platform device irq detection
    Added sample udev rules to trigger irq rescans on device add/remove
    Made irqbalance ui an optional compile component
    Added support for Intel CoD
    Add -v | --version option to command line
  * Bug fixes in this release:
    Misc compiler warning fixes and spelling errors
    Compilation error fix on aarch64
    Compilation error fix when using clang in c99 mode
    Unused variable cleanup
    Lots of memory leak cleanup in irqbalance-ui
    Prevent irqbalance from running in a container
    Fix irq affinity assignment in some cases to wrong numa node
    Fix oneshot mode
    exclude legacy irq 255
  * Deprecations:
    without-glib2 is removed, we just need it enough that we can't dummy it up
    anymore</changelog>
  <changelog author="trenn@suse.de" date="1538654400">- Allow compilation with SLE-12 and before by:
  * removing -std=C99 Latest compiler version does not complain
  anymore, SLE12 SPx and before did.
  * Fix a possible buffer overflow compiler warning
  A fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="ohering@suse.de" date="1572004800">- In HyperV VMs all NVME MSI interrupts are set to unmanaged to
  compensate the lack of matrix.c in pre-v4.20 kernels.
  Irqbalanced is supposed to spread the load. (bsc#1119461, bsc#1154905, bsc#1138190)
  Performance can be improved further with --hintpolicy=subset
- add 0001-Revert-remove-affinity_hint-infrastructure.patch
- add set-numa-node.patch
- add 0001-Revert-Types-clean-out-unused-variables-from-irq_inf.patch</changelog>
  <changelog author="ohering@suse.de" date="1573732800">- Revert previous changes for kernel 5.3+
- remove 0001-Revert-remove-affinity_hint-infrastructure.patch
- remove set-numa-node.patch
- remove 0001-Revert-Types-clean-out-unused-variables-from-irq_inf.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1614859200">- Due to a bug in irqbalance's parsing of /sys/devices/system/cpu/cpu*/node*
  entries, all CPUs is considered to be on NUMA node 0. Backport fix for
  ambiguous parsing of *node* entries in /sys from upstream to fix this issue.
  (bsc#1156315, bsc#1182254)
- add fix-ambiguous-parsing-of-node-entries-in-sys.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1615291200">- Correctly detect the NUMA node of non-PCI devices.
  (bsc#1156315 bsc#1183157)
- add also-fetch-node-info-for-non-PCI-devices.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1615550400">- Adapt also-fetch-node-info-for-non-PCI-devices.patch to v1.4.0, and
  backport process_one_line() and get_int() which is required for it
  to work.</changelog>
  <changelog author="trenn@suse.de" date="1617278400">- not balancing interrupts in Xen guests (bsc#1178477, bsc#1183405)
  A procinterrupts-check-xen-dyn-event-more-flexible.patch</changelog>
  <changelog author="trenn@suse.de" date="1669204800">- Fix segfault from previous update (bsc#1206668)
- Fix version - Maintainer forgot to increase version to 1.4.0
  A fix_version_1_4_0
- Add mainline fixes (bnc#1204961):
  The first 2 patches are cleanup patches which should not have any
  functional change, but make life easier to backport the real fix.
  All patches are mainline:
  A    Update-classify.c.patch
  A    irqbalance-properly-check-if-irq-is-banned.patch
  A    remove-unused-path-in-check_for_irq_ban.patch</changelog>
</package>
<package pkgid="917431e7d5e78561ace02095148c9cff1257ea4d6a49a0f9533f7fc8d980b77b" name="irqbalance" arch="x86_64">
  <version epoch="0" ver="1.4.0" rel="150200.12.11.1"/>
  <changelog author="mpluskal@suse.com" date="1426507200">- Clenup spec file with spec-cleaner
- Remove bug-893478_warn-once.patch
- Update to 1.0.9
  * PCI quirk support
  * System Logging compatibility
  * isolcpus inheritance
  * Misc. Bugfixes</changelog>
  <changelog author="dmueller@suse.com" date="1447070400">- enable build for %arm</changelog>
  <changelog author="mbrugger@suse.com" date="1447761600">- enable build for aarch64</changelog>
  <changelog author="mbrugger@suse.com" date="1447848000">- Only exclude arch s390 and s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1453032000">- Update to 1.1.0
  * Banning support fixes
  * Load calculation improvements
  * Documentation fixes
  * Fix command line preservation across re-scan
  * Memory leak fixes
  * Misc. bug fixes
  * ARM irq support
  * New --banmod option
  * New sleep interval option</changelog>
  <changelog author="schwab@suse.de" date="1456228800">- fix-aarch64-support.patch: Fix AArch64 support</changelog>
  <changelog author="msuchanek@suse.com" date="1476446400">- Set-fd-limit.patch: Increase limit on file descriptors (bsc#998399) (fate#321645)</changelog>
  <changelog author="dmueller@suse.com" date="1484222400">- update to 1.2.0:
  * sort_irq logic rework to fix unintended ordering
  * removal of the affinity_hint infrastructure as its not needed
  * fixes for invalid cpumask parsing
  * many other minior fixes (see git log)
  * Aarch64 support
  * live interactive monitoring of irqbalance and live adjustment with irqbalance-ui
- remove fix-aarch64-support.patch: upstreamed
- add install-man-pages.patch
- add aarch64-compile-fixes.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1486382400">- Switch to ncurses6: use ncurses6-config to find the correct
  CFLAGS and libraries (boo#1021328).</changelog>
  <changelog author="fschnizlein@suse.com" date="1488369600">- Remove superfluous comment out man package packing</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="egotthold@suse.com" date="1538395200">- Removed aarch64-compile-fixes.patch because it is mainline now.
- Update to version 1.4.0:
  * Fixed an erroneous calculation of min_load that restricted candidates to a
    subset of objects
  * Fixed powerpc hotplug detection
  * Cleaned up syslog target dependency
  * Added some self test infrastructure (via make check)
- Update to version 1.3.0
  * New features in this release:
    optimization of platform device irq detection
    Added sample udev rules to trigger irq rescans on device add/remove
    Made irqbalance ui an optional compile component
    Added support for Intel CoD
    Add -v | --version option to command line
  * Bug fixes in this release:
    Misc compiler warning fixes and spelling errors
    Compilation error fix on aarch64
    Compilation error fix when using clang in c99 mode
    Unused variable cleanup
    Lots of memory leak cleanup in irqbalance-ui
    Prevent irqbalance from running in a container
    Fix irq affinity assignment in some cases to wrong numa node
    Fix oneshot mode
    exclude legacy irq 255
  * Deprecations:
    without-glib2 is removed, we just need it enough that we can't dummy it up
    anymore</changelog>
  <changelog author="trenn@suse.de" date="1538654400">- Allow compilation with SLE-12 and before by:
  * removing -std=C99 Latest compiler version does not complain
  anymore, SLE12 SPx and before did.
  * Fix a possible buffer overflow compiler warning
  A fix_buffer_overflow_compiler.patch</changelog>
  <changelog author="ohering@suse.de" date="1572004800">- In HyperV VMs all NVME MSI interrupts are set to unmanaged to
  compensate the lack of matrix.c in pre-v4.20 kernels.
  Irqbalanced is supposed to spread the load. (bsc#1119461, bsc#1154905, bsc#1138190)
  Performance can be improved further with --hintpolicy=subset
- add 0001-Revert-remove-affinity_hint-infrastructure.patch
- add set-numa-node.patch
- add 0001-Revert-Types-clean-out-unused-variables-from-irq_inf.patch</changelog>
  <changelog author="ohering@suse.de" date="1573732800">- Revert previous changes for kernel 5.3+
- remove 0001-Revert-remove-affinity_hint-infrastructure.patch
- remove set-numa-node.patch
- remove 0001-Revert-Types-clean-out-unused-variables-from-irq_inf.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1614859200">- Due to a bug in irqbalance's parsing of /sys/devices/system/cpu/cpu*/node*
  entries, all CPUs is considered to be on NUMA node 0. Backport fix for
  ambiguous parsing of *node* entries in /sys from upstream to fix this issue.
  (bsc#1156315, bsc#1182254)
- add fix-ambiguous-parsing-of-node-entries-in-sys.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1615291200">- Correctly detect the NUMA node of non-PCI devices.
  (bsc#1156315 bsc#1183157)
- add also-fetch-node-info-for-non-PCI-devices.patch</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1615550400">- Adapt also-fetch-node-info-for-non-PCI-devices.patch to v1.4.0, and
  backport process_one_line() and get_int() which is required for it
  to work.</changelog>
  <changelog author="trenn@suse.de" date="1617278400">- not balancing interrupts in Xen guests (bsc#1178477, bsc#1183405)
  A procinterrupts-check-xen-dyn-event-more-flexible.patch</changelog>
  <changelog author="trenn@suse.de" date="1669204800">- Fix segfault from previous update (bsc#1206668)
- Fix version - Maintainer forgot to increase version to 1.4.0
  A fix_version_1_4_0
- Add mainline fixes (bnc#1204961):
  The first 2 patches are cleanup patches which should not have any
  functional change, but make life easier to backport the real fix.
  All patches are mainline:
  A    Update-classify.c.patch
  A    irqbalance-properly-check-if-irq-is-banned.patch
  A    remove-unused-path-in-check_for_irq_ban.patch</changelog>
</package>
<package pkgid="d94397efd0df93fae5d167641299f82a5394cf33e14cbde8ba9a5ecea40ca4d7" name="iscsiuio" arch="aarch64">
  <version epoch="0" ver="0.7.8.6" rel="150300.32.21.1"/>
  <changelog author="lduncan@suse.com" date="1611662400">- Update to latest upstream (no new tag yet). To fix
  bsc#1181313. Changes since last update added to
  open-iscsi-SUSE-latest.diff.bz2:
  * Fix iscsiadm segfault when exiting
  * iscsid: Add NO_SYSTEMD to CFLAGS
  * Change mkdir permissions to 0770, adjust usmask
  * Fix typo in util.py
  * iscsid: Do not allow conflicting pid-file options
  * iscsiadm: Fix memory leak in iscsiadm
  * libopeniscsiusr: Fix memory leak in iscsi_sessions_get()
  * libopeniscsiusr: Fix memory leak in iscsi_nodes_get()
  * idbm: Fix memory leak and NULL pointer dereference in idbm_rec_update_param()
  * Add etc/systemd/iscsi-init.service to SYSTEMDFILES Makefile variable</changelog>
  <changelog author="lduncan@suse.com" date="1615464000">- Updated to latest upstream 2.1.4 as 2.1.4-suse, which contains
  these changes not already present:
  * Enable iscsi.service asynchronous logins, cleanup services
    (bsc#1183421)
  * libopeniscsiusr: dont error loudly if a session isn't found when
    working through iscsi_sessions_get()
  * libopeniscsiusr: skip over removed sessions
  * libopeniscsiusr: fix error messages
  * Avoid hardcoding pkg-config to fix cross build
  * Fix iscsistart login issue when target is delayed.</changelog>
  <changelog author="lduncan@suse.com" date="1619611200">- Merged with latest from upstream, which contains these fixes:
  * Add "no wait" option to iscsiadm firmware login
  * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart
  * Log proper error message when AUTH failure occurs</changelog>
  <changelog author="lduncan@suse.com" date="1619611201">- Local (SUSE) change: update iscsi.service so that it tries to
  logon to any "onboot" and firmware targets, in case a target
  was offline when booted but back up when the service is started.
  (bsc#1153806)</changelog>
  <changelog author="lduncan@suse.com" date="1620820800">- Merge latest upstream, which added fix (bsc#1185930):
  * Set default 'startup' to 'onboot' for FW nodes</changelog>
  <changelog author="lduncan@suse.com" date="1626868800">- Merge latest upstream, which includeds:
  * Support the "qede" CMA-card driver. (bsc#1188579)
  * iscsistart: fix null pointer deref before exit</changelog>
  <changelog author="lduncan@suse.com" date="1629460800">- Merged latest upstream, which includes:
  * iscsid: set PR_SET_IO_FLUSHER (bsc#1188869)</changelog>
  <changelog author="lduncan@suse.com" date="1631102400">- Updated to latest upstream 2.1.5 as 2.1.5-suse, which contains
  these changes not already present:
  * Handle IPv6 interfaces correctly. (bsc#1187958)
  * Handle qedi correctly in NPAR mode (bsc#1187958)
  * Update iscsiadm man page (bsc#1187958)
  * Update iface.example for ipv6
  * Change iscsi IP type from defines to enum.
  * Handle recv() returning 0 in iscsid_response()</changelog>
  <changelog author="lduncan@suse.com" date="1633003200">- Update to latest from upstream, fixing:
  * Moving the executables from /sbin to /usr/sbin (bsc#1191054)
  * Remove default dependencies from iscsi-init.service
  (bsc#1187190)</changelog>
  <changelog author="lduncan@suse.com" date="1633435200">- Fix possible systemd cycle by adding an "obsoletes" for
  the old libopeniscsiusr for older versions.</changelog>
  <changelog author="lduncan@suse.com" date="1635163200">- Fix the usr-merge changes (bsc#1192013). This includes catching
  all the places that /sbin was still used directly, as well as
  making the SPEC file build using /usr/sbin for openSUSE but
  still use /sbin for SLE, for now.</changelog>
  <changelog author="lduncan@suse.com" date="1636632000">- Merged latest upstream. Mostly cleanup, but includes a fix for
  iscsi-init.service when trying to write to the root volume too
  early (bsc#1192568), as well as an upstream fix for possible
  deadlock when dealing with sysfs.</changelog>
  <changelog author="lduncan@suse.com" date="1644840000">- Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains
  bug fixes and cleanups. See the Changelog for more details.</changelog>
  <changelog author="lduncan@suse.com" date="1646481600">- Update to latest upstream, including test cleanup, minor
  bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656).</changelog>
  <changelog author="lduncan@suse.com" date="1649246400">- Updated to latest upstream, including bug fixes and cleanups.
  Changes included:
  * add handling name/value pairs for firmware login (bsc#1196113),
    including man page update for same
  * Fix bug where some package parts were installed using
    DESTDIR twice
  * general build cleanup (in prep for removing DB files from
    /etc/iscsi some day soon)
  Also, now delivering a "package config" file for libopeniscsiusr.</changelog>
  <changelog author="lduncan@suse.com" date="1651838400">- Updated to latest upstream version, tagged 2.1.7. Changes
  included:
  * updated/fixed test script
  * updated build system
  * several bug fixes, including one for bsc#1199264</changelog>
  <changelog author="lduncan@suse.com" date="1652097600">- Update to latest upstream, including:
  * Added 'distclean' to Makefile targets
  * Ensure Makefile '.PHONY' targets set up correctly
  * fix an iscsid logout bug generating a false error
    and cleanup logout error messages</changelog>
  <changelog author="lduncan@suse.com" date="1652443200">- Set initiatorname in %post (at end of install), for cases
  where root is read-only at startup time (bsc#1198457)</changelog>
  <changelog author="lduncan@suse.com" date="1655467200">- For Tumbleweed, moved logrotate files from user-specific
  directory /etc/logrotate.d to vendor-specific
  /usr/etc/logrotate.d
  (for Stefan Schubert &lt;schubi@suse.com&gt;)</changelog>
  <changelog author="lduncan@suse.com" date="1657108800">- Modify SPEC file so systemd unit files are mode 644 (not 755)
  (bsc#1200570)</changelog>
</package>
<package pkgid="c092ff63c2f323ec85212f10ccb048a16336a8be18eaec0e66ebfc17cbd83809" name="iscsiuio" arch="x86_64">
  <version epoch="0" ver="0.7.8.6" rel="150300.32.21.1"/>
  <changelog author="lduncan@suse.com" date="1611662400">- Update to latest upstream (no new tag yet). To fix
  bsc#1181313. Changes since last update added to
  open-iscsi-SUSE-latest.diff.bz2:
  * Fix iscsiadm segfault when exiting
  * iscsid: Add NO_SYSTEMD to CFLAGS
  * Change mkdir permissions to 0770, adjust usmask
  * Fix typo in util.py
  * iscsid: Do not allow conflicting pid-file options
  * iscsiadm: Fix memory leak in iscsiadm
  * libopeniscsiusr: Fix memory leak in iscsi_sessions_get()
  * libopeniscsiusr: Fix memory leak in iscsi_nodes_get()
  * idbm: Fix memory leak and NULL pointer dereference in idbm_rec_update_param()
  * Add etc/systemd/iscsi-init.service to SYSTEMDFILES Makefile variable</changelog>
  <changelog author="lduncan@suse.com" date="1615464000">- Updated to latest upstream 2.1.4 as 2.1.4-suse, which contains
  these changes not already present:
  * Enable iscsi.service asynchronous logins, cleanup services
    (bsc#1183421)
  * libopeniscsiusr: dont error loudly if a session isn't found when
    working through iscsi_sessions_get()
  * libopeniscsiusr: skip over removed sessions
  * libopeniscsiusr: fix error messages
  * Avoid hardcoding pkg-config to fix cross build
  * Fix iscsistart login issue when target is delayed.</changelog>
  <changelog author="lduncan@suse.com" date="1619611200">- Merged with latest from upstream, which contains these fixes:
  * Add "no wait" option to iscsiadm firmware login
  * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart
  * Log proper error message when AUTH failure occurs</changelog>
  <changelog author="lduncan@suse.com" date="1619611201">- Local (SUSE) change: update iscsi.service so that it tries to
  logon to any "onboot" and firmware targets, in case a target
  was offline when booted but back up when the service is started.
  (bsc#1153806)</changelog>
  <changelog author="lduncan@suse.com" date="1620820800">- Merge latest upstream, which added fix (bsc#1185930):
  * Set default 'startup' to 'onboot' for FW nodes</changelog>
  <changelog author="lduncan@suse.com" date="1626868800">- Merge latest upstream, which includeds:
  * Support the "qede" CMA-card driver. (bsc#1188579)
  * iscsistart: fix null pointer deref before exit</changelog>
  <changelog author="lduncan@suse.com" date="1629460800">- Merged latest upstream, which includes:
  * iscsid: set PR_SET_IO_FLUSHER (bsc#1188869)</changelog>
  <changelog author="lduncan@suse.com" date="1631102400">- Updated to latest upstream 2.1.5 as 2.1.5-suse, which contains
  these changes not already present:
  * Handle IPv6 interfaces correctly. (bsc#1187958)
  * Handle qedi correctly in NPAR mode (bsc#1187958)
  * Update iscsiadm man page (bsc#1187958)
  * Update iface.example for ipv6
  * Change iscsi IP type from defines to enum.
  * Handle recv() returning 0 in iscsid_response()</changelog>
  <changelog author="lduncan@suse.com" date="1633003200">- Update to latest from upstream, fixing:
  * Moving the executables from /sbin to /usr/sbin (bsc#1191054)
  * Remove default dependencies from iscsi-init.service
  (bsc#1187190)</changelog>
  <changelog author="lduncan@suse.com" date="1633435200">- Fix possible systemd cycle by adding an "obsoletes" for
  the old libopeniscsiusr for older versions.</changelog>
  <changelog author="lduncan@suse.com" date="1635163200">- Fix the usr-merge changes (bsc#1192013). This includes catching
  all the places that /sbin was still used directly, as well as
  making the SPEC file build using /usr/sbin for openSUSE but
  still use /sbin for SLE, for now.</changelog>
  <changelog author="lduncan@suse.com" date="1636632000">- Merged latest upstream. Mostly cleanup, but includes a fix for
  iscsi-init.service when trying to write to the root volume too
  early (bsc#1192568), as well as an upstream fix for possible
  deadlock when dealing with sysfs.</changelog>
  <changelog author="lduncan@suse.com" date="1644840000">- Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains
  bug fixes and cleanups. See the Changelog for more details.</changelog>
  <changelog author="lduncan@suse.com" date="1646481600">- Update to latest upstream, including test cleanup, minor
  bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656).</changelog>
  <changelog author="lduncan@suse.com" date="1649246400">- Updated to latest upstream, including bug fixes and cleanups.
  Changes included:
  * add handling name/value pairs for firmware login (bsc#1196113),
    including man page update for same
  * Fix bug where some package parts were installed using
    DESTDIR twice
  * general build cleanup (in prep for removing DB files from
    /etc/iscsi some day soon)
  Also, now delivering a "package config" file for libopeniscsiusr.</changelog>
  <changelog author="lduncan@suse.com" date="1651838400">- Updated to latest upstream version, tagged 2.1.7. Changes
  included:
  * updated/fixed test script
  * updated build system
  * several bug fixes, including one for bsc#1199264</changelog>
  <changelog author="lduncan@suse.com" date="1652097600">- Update to latest upstream, including:
  * Added 'distclean' to Makefile targets
  * Ensure Makefile '.PHONY' targets set up correctly
  * fix an iscsid logout bug generating a false error
    and cleanup logout error messages</changelog>
  <changelog author="lduncan@suse.com" date="1652443200">- Set initiatorname in %post (at end of install), for cases
  where root is read-only at startup time (bsc#1198457)</changelog>
  <changelog author="lduncan@suse.com" date="1655467200">- For Tumbleweed, moved logrotate files from user-specific
  directory /etc/logrotate.d to vendor-specific
  /usr/etc/logrotate.d
  (for Stefan Schubert &lt;schubi@suse.com&gt;)</changelog>
  <changelog author="lduncan@suse.com" date="1657108800">- Modify SPEC file so systemd unit files are mode 644 (not 755)
  (bsc#1200570)</changelog>
</package>
<package pkgid="2027d0a3909a216e870912a9be183b8ba7f394cc6874ec0fb775fd0cf7f687b0" name="kdump" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="150300.18.15.1"/>
  <changelog author="ptesarik@suse.com" date="1576238400">- kdump-Add-force-option-to-KDUMP_NETCONFIG.patch: Add ":force"
  option to KDUMP_NETCONFIG (bsc#1108919).
- kdump-Add-fence_kdump_send-when-fence-agents-installed.patch: Add
  fence_kdump_send when fence-agents installed (bsc#1108919).
- kdump-FENCE_KDUMP_SEND-variable.patch: Use var for path of
  fence_kdump_send and remove the unnecessary PRESCRIPT check
  (bsc#1108919).
- kdump-Document-fence_kdump_send.patch: Document kdump behaviour
  for fence_kdump_send (bsc#1108919).</changelog>
  <changelog author="ptesarik@suse.com" date="1576238401">- kdump-powerpc-no-reload-on-CPU-removal.patch: powerpc: Do not
  reload on CPU hot removal (bsc#1133407, LTC#176111).</changelog>
  <changelog author="ptesarik@suse.com" date="1576584000">- kdump-prefer-by-path-and-device-mapper.patch: Prefer by-path and
  device-mapper aliases over kernel device names (bsc#1101149,
  LTC#168532).</changelog>
  <changelog author="ptesarik@suse.com" date="1576584001">- kdump-calibrate-Update-values.patch: calibrate: Update values
  (bsc#1130529).</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- Use BuildRequire(udev) instead of udev: allow OBS to shortcut
  through the -mini flavors.
- Use systemd_ordering instead of systemd_requires: systemd is not
  a strict requirement, but if the system is going to use it, we
  want it to beinstalled prior to kdump.</changelog>
  <changelog author="mwilck@suse.com" date="1580126400">- kdump-activate-udev-rules-late-during-boot.patch: Activate
  kdump udev rules late during boot (bsc#1154837)</changelog>
  <changelog author="ptesarik@suse.com" date="1585569600">- kdump-make-sure-that-the-udev-runtime-directory-exists.patch:
  Make sure that the udev runtime directory exists (bsc#1164713).</changelog>
  <changelog author="ptesarik@suse.com" date="1605873600">- kdump-do-not-add-rd.neednet.patch: Do not add 'rd.neednet=1' to
  dracut command line (bsc#1177196).</changelog>
  <changelog author="ptesarik@suse.com" date="1606132800">- kdump-remove-console-hvc0-from-commandline.patch: remove
  console=hvc0 from commandline (bsc#1173914).
- kdump-set-serial-console-from-Xen-cmdline.patch: set serial
  console from Xen cmdline (bsc#1173914).</changelog>
  <changelog author="ptesarik@suse.com" date="1614945600">- kdump-query-systemd-network.service.patch: Query systemd
  network.service to find out if wicked is used (bsc#1182309).
- kdump-check-explicit-ip-options.patch: Do not add
  network-related dracut options if ip= is set explicitly
  (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1617192000">- Increase extra crash kernel reservation for LUKS Argon2 PBKDF
  (bsc#1180513):
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398400">- kdump-ensure-initrd.target.wants-directory.patch: Make sure that
  initrd.target.wants directory exists (bsc#1172670).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398401">- kdump-avoid-endless-loop-EAI_AGAIN.patch: Avoid an endless loop
  when resolving a hostname fails with EAI_AGAIN (bsc#1183070).
- kdump-install-etc-resolv.conf-using-resolved-path.patch: Install
  /etc/resolv.conf using its resolved path (bsc#1183070).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398402">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616
  LTC#192282).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398403">- kdump-do-not-iterate-past-end-of-string.patch:
  URLParser::extractAuthority(): Do not iterate past end of string
  (bsc#1186037).</changelog>
  <changelog author="jbohac@suse.com" date="1643803200">- kdump-add-watchdog-modules.patch
  Add watchdog modules to kdump initrd (bsc#1189923)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1647345600">- Update kdump-add-watchdog-modules.patch
  Fix return code when no watchdog sysfs entry is found (bsc#1197069)</changelog>
  <changelog author="jbohac@suse.com" date="1660824000">- fix-network-related-dracut-options-handling-for-fadu.patch
  Fix network-related dracut options handling for fadump case
  (bsc#1201051)</changelog>
  <changelog author="jbohac@suse.com" date="1662552000">- unload.sh-support-kexec-unload-when-kexec_file_load.patch
  Fix unload when secure boot enabled (bsc#1186272)</changelog>
</package>
<package pkgid="18cdf5cf2fbb1071ccc6a8430e8ec88f9c0f052622f39add6f4a20c1975e9d1d" name="kdump" arch="src">
  <version epoch="0" ver="0.9.0" rel="150300.18.15.1"/>
  <changelog author="ptesarik@suse.com" date="1576238400">- kdump-Add-force-option-to-KDUMP_NETCONFIG.patch: Add ":force"
  option to KDUMP_NETCONFIG (bsc#1108919).
- kdump-Add-fence_kdump_send-when-fence-agents-installed.patch: Add
  fence_kdump_send when fence-agents installed (bsc#1108919).
- kdump-FENCE_KDUMP_SEND-variable.patch: Use var for path of
  fence_kdump_send and remove the unnecessary PRESCRIPT check
  (bsc#1108919).
- kdump-Document-fence_kdump_send.patch: Document kdump behaviour
  for fence_kdump_send (bsc#1108919).</changelog>
  <changelog author="ptesarik@suse.com" date="1576238401">- kdump-powerpc-no-reload-on-CPU-removal.patch: powerpc: Do not
  reload on CPU hot removal (bsc#1133407, LTC#176111).</changelog>
  <changelog author="ptesarik@suse.com" date="1576584000">- kdump-prefer-by-path-and-device-mapper.patch: Prefer by-path and
  device-mapper aliases over kernel device names (bsc#1101149,
  LTC#168532).</changelog>
  <changelog author="ptesarik@suse.com" date="1576584001">- kdump-calibrate-Update-values.patch: calibrate: Update values
  (bsc#1130529).</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- Use BuildRequire(udev) instead of udev: allow OBS to shortcut
  through the -mini flavors.
- Use systemd_ordering instead of systemd_requires: systemd is not
  a strict requirement, but if the system is going to use it, we
  want it to beinstalled prior to kdump.</changelog>
  <changelog author="mwilck@suse.com" date="1580126400">- kdump-activate-udev-rules-late-during-boot.patch: Activate
  kdump udev rules late during boot (bsc#1154837)</changelog>
  <changelog author="ptesarik@suse.com" date="1585569600">- kdump-make-sure-that-the-udev-runtime-directory-exists.patch:
  Make sure that the udev runtime directory exists (bsc#1164713).</changelog>
  <changelog author="ptesarik@suse.com" date="1605873600">- kdump-do-not-add-rd.neednet.patch: Do not add 'rd.neednet=1' to
  dracut command line (bsc#1177196).</changelog>
  <changelog author="ptesarik@suse.com" date="1606132800">- kdump-remove-console-hvc0-from-commandline.patch: remove
  console=hvc0 from commandline (bsc#1173914).
- kdump-set-serial-console-from-Xen-cmdline.patch: set serial
  console from Xen cmdline (bsc#1173914).</changelog>
  <changelog author="ptesarik@suse.com" date="1614945600">- kdump-query-systemd-network.service.patch: Query systemd
  network.service to find out if wicked is used (bsc#1182309).
- kdump-check-explicit-ip-options.patch: Do not add
  network-related dracut options if ip= is set explicitly
  (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1617192000">- Increase extra crash kernel reservation for LUKS Argon2 PBKDF
  (bsc#1180513):
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398400">- kdump-ensure-initrd.target.wants-directory.patch: Make sure that
  initrd.target.wants directory exists (bsc#1172670).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398401">- kdump-avoid-endless-loop-EAI_AGAIN.patch: Avoid an endless loop
  when resolving a hostname fails with EAI_AGAIN (bsc#1183070).
- kdump-install-etc-resolv.conf-using-resolved-path.patch: Install
  /etc/resolv.conf using its resolved path (bsc#1183070).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398402">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616
  LTC#192282).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398403">- kdump-do-not-iterate-past-end-of-string.patch:
  URLParser::extractAuthority(): Do not iterate past end of string
  (bsc#1186037).</changelog>
  <changelog author="jbohac@suse.com" date="1643803200">- kdump-add-watchdog-modules.patch
  Add watchdog modules to kdump initrd (bsc#1189923)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1647345600">- Update kdump-add-watchdog-modules.patch
  Fix return code when no watchdog sysfs entry is found (bsc#1197069)</changelog>
  <changelog author="jbohac@suse.com" date="1660824000">- fix-network-related-dracut-options-handling-for-fadu.patch
  Fix network-related dracut options handling for fadump case
  (bsc#1201051)</changelog>
  <changelog author="jbohac@suse.com" date="1662552000">- unload.sh-support-kexec-unload-when-kexec_file_load.patch
  Fix unload when secure boot enabled (bsc#1186272)</changelog>
</package>
<package pkgid="d6bacf87bf671e78d4a3a4b164a36dbc5435ebe73e707a877a6dee885fbeb08c" name="kdump" arch="x86_64">
  <version epoch="0" ver="0.9.0" rel="150300.18.15.1"/>
  <changelog author="ptesarik@suse.com" date="1576238400">- kdump-Add-force-option-to-KDUMP_NETCONFIG.patch: Add ":force"
  option to KDUMP_NETCONFIG (bsc#1108919).
- kdump-Add-fence_kdump_send-when-fence-agents-installed.patch: Add
  fence_kdump_send when fence-agents installed (bsc#1108919).
- kdump-FENCE_KDUMP_SEND-variable.patch: Use var for path of
  fence_kdump_send and remove the unnecessary PRESCRIPT check
  (bsc#1108919).
- kdump-Document-fence_kdump_send.patch: Document kdump behaviour
  for fence_kdump_send (bsc#1108919).</changelog>
  <changelog author="ptesarik@suse.com" date="1576238401">- kdump-powerpc-no-reload-on-CPU-removal.patch: powerpc: Do not
  reload on CPU hot removal (bsc#1133407, LTC#176111).</changelog>
  <changelog author="ptesarik@suse.com" date="1576584000">- kdump-prefer-by-path-and-device-mapper.patch: Prefer by-path and
  device-mapper aliases over kernel device names (bsc#1101149,
  LTC#168532).</changelog>
  <changelog author="ptesarik@suse.com" date="1576584001">- kdump-calibrate-Update-values.patch: calibrate: Update values
  (bsc#1130529).</changelog>
  <changelog author="dimstar@opensuse.org" date="1579867200">- Use BuildRequire(udev) instead of udev: allow OBS to shortcut
  through the -mini flavors.
- Use systemd_ordering instead of systemd_requires: systemd is not
  a strict requirement, but if the system is going to use it, we
  want it to beinstalled prior to kdump.</changelog>
  <changelog author="mwilck@suse.com" date="1580126400">- kdump-activate-udev-rules-late-during-boot.patch: Activate
  kdump udev rules late during boot (bsc#1154837)</changelog>
  <changelog author="ptesarik@suse.com" date="1585569600">- kdump-make-sure-that-the-udev-runtime-directory-exists.patch:
  Make sure that the udev runtime directory exists (bsc#1164713).</changelog>
  <changelog author="ptesarik@suse.com" date="1605873600">- kdump-do-not-add-rd.neednet.patch: Do not add 'rd.neednet=1' to
  dracut command line (bsc#1177196).</changelog>
  <changelog author="ptesarik@suse.com" date="1606132800">- kdump-remove-console-hvc0-from-commandline.patch: remove
  console=hvc0 from commandline (bsc#1173914).
- kdump-set-serial-console-from-Xen-cmdline.patch: set serial
  console from Xen cmdline (bsc#1173914).</changelog>
  <changelog author="ptesarik@suse.com" date="1614945600">- kdump-query-systemd-network.service.patch: Query systemd
  network.service to find out if wicked is used (bsc#1182309).
- kdump-check-explicit-ip-options.patch: Do not add
  network-related dracut options if ip= is set explicitly
  (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1617192000">- Increase extra crash kernel reservation for LUKS Argon2 PBKDF
  (bsc#1180513):
  * kdump-Implement-KString-isHexNumber.patch
  * kdump-Mount-and-device-resolution-using-libmount-and-lsblk.patch
  * kdump-calibrate-Add-LUKS2-Argon2-requirements-to-the-reser.patch
  * kdump-Do-not-list-all-block-devices-if-no-block-devices-ar.patch
  * kdump-Enumerate-all-BTRFS-devices-for-btrfs-mount-points.patch
  * kdump-calibrate-Fix-kernel-command-line-parsing.patch</changelog>
  <changelog author="ptesarik@suse.com" date="1617883200">- kdump-Add-bootdev-to-dracut-command-line.patch: Add 'bootdev=' to
  dracut command line (bsc#1182309).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398400">- kdump-ensure-initrd.target.wants-directory.patch: Make sure that
  initrd.target.wants directory exists (bsc#1172670).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398401">- kdump-avoid-endless-loop-EAI_AGAIN.patch: Avoid an endless loop
  when resolving a hostname fails with EAI_AGAIN (bsc#1183070).
- kdump-install-etc-resolv.conf-using-resolved-path.patch: Install
  /etc/resolv.conf using its resolved path (bsc#1183070).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398402">- kdump-fix-incorrect-exit-code-checking.patch: Fix incorrect exit
  code checking after "local" with assignment (bsc#1184616
  LTC#192282).</changelog>
  <changelog author="ptesarik@suse.com" date="1632398403">- kdump-do-not-iterate-past-end-of-string.patch:
  URLParser::extractAuthority(): Do not iterate past end of string
  (bsc#1186037).</changelog>
  <changelog author="jbohac@suse.com" date="1643803200">- kdump-add-watchdog-modules.patch
  Add watchdog modules to kdump initrd (bsc#1189923)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1647345600">- Update kdump-add-watchdog-modules.patch
  Fix return code when no watchdog sysfs entry is found (bsc#1197069)</changelog>
  <changelog author="jbohac@suse.com" date="1660824000">- fix-network-related-dracut-options-handling-for-fadu.patch
  Fix network-related dracut options handling for fadump case
  (bsc#1201051)</changelog>
  <changelog author="jbohac@suse.com" date="1662552000">- unload.sh-support-kexec-unload-when-kexec_file_load.patch
  Fix unload when secure boot enabled (bsc#1186272)</changelog>
</package>
<package pkgid="fb099234553802831c9a8bbeff86f6e6d1081bde63319db1c67c62adc4db5a06" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.101.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217600">- RDMA/siw: Fix a condition race issue in MPA request processing (git-fixes)
- commit 709fd3a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217601">- RDMA/hns: Remove unnecessary check for the sgid_attr when modifying QP (git-fixes)
- commit e806a5b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217602">- RDMA/rxe: Generate a completion for unsupported/invalid opcode (git-fixes)
- commit 92bff10</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217603">- RDMA/hfi1: Fix potential integer multiplication overflow errors (git-fixes)
- commit 9d4253b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217604">- RDMA/qedr: Fix reporting QP timeout attribute (git-fixes)
- commit 26de3e3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217605">- RDMA/cm: Fix memory leak in ib_cm_insert_listen (git-fixes)
- commit 3ec31d2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217606">- RDMA: remove useless condition in siw_create_cq() (git-fixes)
- commit 4c36066</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217607">- RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (git-fixes)
- commit e28b8f5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217608">- RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event (git-fixes)
- commit c8db39b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217609">- RDMA/rxe: Fix rnr retry behavior (git-fixes)
- commit db88b1b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217610">- RDMA/mlx5: Add missing check for return value in get namespace flow (git-fixes)
- commit 19e84c3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217611">- RDMA/rxe: Fix error unwind in rxe_create_qp() (git-fixes)
- commit 4332868</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217612">- RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL (git-fixes)
- commit cc2cd02</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217613">- RDMA/cma: Fix arguments order in net device validation (git-fixes)
- commit 7890ffd</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217614">- RDMA/siw: Pass a pointer to virt_to_page() (git-fixes)
- commit 7daf160</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217615">- RDMA/rxe: Fix "kernel NULL pointer dereference" error (git-fixes)
- commit 9205fa0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217616">- RDMA/rxe: Fix the error caused by qp-&gt;sk (git-fixes)
- commit 6d0ef48</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217617">- RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. (git-fixes)
- commit d355c79</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217618">- IB/rdmavt: Add __init/__exit annotations to module init/exit funcs (git-fixes)
- commit f7baf6a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217619">- RDMA/usnic: fix set-but-not-unused variable 'flags' warning (git-fixes)
- commit 293bf91</changelog>
</package>
<package pkgid="969abb933d31a13138bbaf6d0ea56a6e9ea244d0776423e018c8c0d52472fbbd" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.101.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217600">- RDMA/siw: Fix a condition race issue in MPA request processing (git-fixes)
- commit 709fd3a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217601">- RDMA/hns: Remove unnecessary check for the sgid_attr when modifying QP (git-fixes)
- commit e806a5b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217602">- RDMA/rxe: Generate a completion for unsupported/invalid opcode (git-fixes)
- commit 92bff10</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217603">- RDMA/hfi1: Fix potential integer multiplication overflow errors (git-fixes)
- commit 9d4253b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217604">- RDMA/qedr: Fix reporting QP timeout attribute (git-fixes)
- commit 26de3e3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217605">- RDMA/cm: Fix memory leak in ib_cm_insert_listen (git-fixes)
- commit 3ec31d2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217606">- RDMA: remove useless condition in siw_create_cq() (git-fixes)
- commit 4c36066</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217607">- RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (git-fixes)
- commit e28b8f5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217608">- RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event (git-fixes)
- commit c8db39b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217609">- RDMA/rxe: Fix rnr retry behavior (git-fixes)
- commit db88b1b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217610">- RDMA/mlx5: Add missing check for return value in get namespace flow (git-fixes)
- commit 19e84c3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217611">- RDMA/rxe: Fix error unwind in rxe_create_qp() (git-fixes)
- commit 4332868</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217612">- RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL (git-fixes)
- commit cc2cd02</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217613">- RDMA/cma: Fix arguments order in net device validation (git-fixes)
- commit 7890ffd</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217614">- RDMA/siw: Pass a pointer to virt_to_page() (git-fixes)
- commit 7daf160</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217615">- RDMA/rxe: Fix "kernel NULL pointer dereference" error (git-fixes)
- commit 9205fa0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217616">- RDMA/rxe: Fix the error caused by qp-&gt;sk (git-fixes)
- commit 6d0ef48</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217617">- RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. (git-fixes)
- commit d355c79</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217618">- IB/rdmavt: Add __init/__exit annotations to module init/exit funcs (git-fixes)
- commit f7baf6a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217619">- RDMA/usnic: fix set-but-not-unused variable 'flags' warning (git-fixes)
- commit 293bf91</changelog>
</package>
<package pkgid="c7da6100b3caef281413e6f7349f927c1c741bcde7f5a63d2763711cfbda5a92" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.101.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217600">- RDMA/siw: Fix a condition race issue in MPA request processing (git-fixes)
- commit 709fd3a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217601">- RDMA/hns: Remove unnecessary check for the sgid_attr when modifying QP (git-fixes)
- commit e806a5b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217602">- RDMA/rxe: Generate a completion for unsupported/invalid opcode (git-fixes)
- commit 92bff10</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217603">- RDMA/hfi1: Fix potential integer multiplication overflow errors (git-fixes)
- commit 9d4253b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217604">- RDMA/qedr: Fix reporting QP timeout attribute (git-fixes)
- commit 26de3e3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217605">- RDMA/cm: Fix memory leak in ib_cm_insert_listen (git-fixes)
- commit 3ec31d2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217606">- RDMA: remove useless condition in siw_create_cq() (git-fixes)
- commit 4c36066</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217607">- RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (git-fixes)
- commit e28b8f5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217608">- RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event (git-fixes)
- commit c8db39b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217609">- RDMA/rxe: Fix rnr retry behavior (git-fixes)
- commit db88b1b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217610">- RDMA/mlx5: Add missing check for return value in get namespace flow (git-fixes)
- commit 19e84c3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217611">- RDMA/rxe: Fix error unwind in rxe_create_qp() (git-fixes)
- commit 4332868</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217612">- RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL (git-fixes)
- commit cc2cd02</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217613">- RDMA/cma: Fix arguments order in net device validation (git-fixes)
- commit 7890ffd</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217614">- RDMA/siw: Pass a pointer to virt_to_page() (git-fixes)
- commit 7daf160</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217615">- RDMA/rxe: Fix "kernel NULL pointer dereference" error (git-fixes)
- commit 9205fa0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217616">- RDMA/rxe: Fix the error caused by qp-&gt;sk (git-fixes)
- commit 6d0ef48</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217617">- RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. (git-fixes)
- commit d355c79</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217618">- IB/rdmavt: Add __init/__exit annotations to module init/exit funcs (git-fixes)
- commit f7baf6a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217619">- RDMA/usnic: fix set-but-not-unused variable 'flags' warning (git-fixes)
- commit 293bf91</changelog>
</package>
<package pkgid="76ad63b25f5a597d1db1a3f553ce0441330077cee5fbb42166d3d9a44a710133" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.106.1"/>
  <changelog author="jgross@suse.com" date="1669809600">- blacklist.conf: add 5c13a4a0291b3019
- commit f414b37</changelog>
  <changelog author="jgross@suse.com" date="1669809601">- xen/privcmd: Corrected error handling path (git-fixes).
- commit 9273ea4</changelog>
  <changelog author="jgross@suse.com" date="1669809602">- xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  (git-fixes).
- commit a2d69de</changelog>
  <changelog author="tiwai@suse.de" date="1669809603">- net: ethernet: renesas: ravb: Fix promiscuous mode after system
  resumed (git-fixes).
- wifi: mac8021: fix possible oob access in
  ieee80211_get_rate_duration (git-fixes).
- wifi: cfg80211: fix buffer overflow in elem comparison
  (git-fixes).
- net: ethernet: nixge: fix NULL dereference (git-fixes).
- net: phy: fix null-ptr-deref while probe() failed (git-fixes).
- can: cc770: cc770_isa_probe(): add missing free_cc770dev()
  (git-fixes).
- can: sja1000_isa: sja1000_isa_probe(): add missing
  free_sja1000dev() (git-fixes).
- commit c233552</changelog>
  <changelog author="tiwai@suse.de" date="1669896000">- Move upstreamed i915 patch into sorted section
- commit 4f7c541</changelog>
  <changelog author="tiwai@suse.de" date="1669896001">- Update patch reference for ATM fix (CVE-2022-3635 bsc#1204631)
- commit f11d21c</changelog>
  <changelog author="tiwai@suse.de" date="1669896002">- atm: idt77252: fix use-after-free bugs caused by tst_timer
  (CVE-2022-3635 bsc#1204631).
- commit 81a86f3</changelog>
  <changelog author="ematsumiya@suse.de" date="1669982400">- cifs: skip extra NULL byte in filenames (bsc#1204791).
- commit 482b418</changelog>
  <changelog author="tiwai@suse.de" date="1669982401">- hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
  (git-fixes).
- hwmon: (coretemp) Check for null before removing sysfs attrs
  (git-fixes).
- hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc()
  fails (git-fixes).
- hwmon: (i5500_temp) fix missing pci_disable_device()
  (git-fixes).
- commit fdf27d9</changelog>
  <changelog author="ddiss@suse.de" date="1669982402">- io_uring/af_unix: defer registered files gc to io_uring release
  (bsc#1204228 CVE-2022-2602).
- commit fee5862</changelog>
  <changelog author="ddiss@suse.de" date="1669982403">- kabi: sk_buff.scm_io_uring (bsc#1204228 CVE-2022-2602).
- commit 1cb9473</changelog>
  <changelog author="lhenriques@suse.de" date="1669982404">- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1205989).
- ceph: lockdep annotations for try_nonblocking_invalidate
  (bsc#1205988).
- ceph: request Fw caps before updating the mtime in
  ceph_write_iter (bsc#1205987).
- ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
  (bsc#1205986).
- ceph: fix fscache invalidation (bsc#1205985).
- ceph: do not access the kiocb after aio requests (bsc#1205984).
- commit 3a3eff6</changelog>
  <changelog author="lduncan@suse.com" date="1669982405">- Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
- commit 2043e6b</changelog>
  <changelog author="jslaby@suse.cz" date="1670241600">- Update
  patches.suse/x86-bugs-Add-AMD-retbleed-boot-parameter.patch
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901 bsc#1203271
  bsc#1206032).
- Refresh patches.suse/x86-bugs-Add-retbleed-ibpb.patch.
- Refresh patches.suse/x86-bugs-Enable-STIBP-for-JMP2RET.patch.
  Fix mitigations=off to imply retbleed=off (bsc#1206032).
- commit f959a8e</changelog>
  <changelog author="jslaby@suse.cz" date="1670241601">- docs/kernel-parameters: Update descriptions for "mitigations="
  param with retbleed (bsc#1199657 CVE-2022-29900 CVE-2022-29901
  bsc#1203271 bsc#1206032).
- commit 012ee9f</changelog>
  <changelog author="osalvador@suse.de" date="1670241602">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ff0c181</changelog>
  <changelog author="jslaby@suse.cz" date="1670414400">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit df768bd</changelog>
  <changelog author="jslaby@suse.cz" date="1670414401">- Refresh
  patches.suse/x86-speculation-Disable-RRSBA-behavior.patch.
  Fix up after merge from cve/5.3. The patch can be closer to upstream in
  15sp3 as we have more than in the cve branch.
- commit 344ce75</changelog>
  <changelog author="oneukum@suse.com" date="1670414402">- Refresh
  patches.kabi/kABI-remove-new-member-of-usbip_device.patch.
- commit bf09767</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (CVE-2022-4378 bsc#1206207).
- proc: avoid integer type confusion in get_proc_long
  (CVE-2022-4378 bsc#1206207).
- commit 1e50bbf</changelog>
</package>
<package pkgid="86c871e6d41e976ec2b1a96f01ea5583dfc97b740ba05500d4dfe52c99b69170" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.106.1"/>
  <changelog author="jgross@suse.com" date="1669809600">- blacklist.conf: add 5c13a4a0291b3019
- commit f414b37</changelog>
  <changelog author="jgross@suse.com" date="1669809601">- xen/privcmd: Corrected error handling path (git-fixes).
- commit 9273ea4</changelog>
  <changelog author="jgross@suse.com" date="1669809602">- xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  (git-fixes).
- commit a2d69de</changelog>
  <changelog author="tiwai@suse.de" date="1669809603">- net: ethernet: renesas: ravb: Fix promiscuous mode after system
  resumed (git-fixes).
- wifi: mac8021: fix possible oob access in
  ieee80211_get_rate_duration (git-fixes).
- wifi: cfg80211: fix buffer overflow in elem comparison
  (git-fixes).
- net: ethernet: nixge: fix NULL dereference (git-fixes).
- net: phy: fix null-ptr-deref while probe() failed (git-fixes).
- can: cc770: cc770_isa_probe(): add missing free_cc770dev()
  (git-fixes).
- can: sja1000_isa: sja1000_isa_probe(): add missing
  free_sja1000dev() (git-fixes).
- commit c233552</changelog>
  <changelog author="tiwai@suse.de" date="1669896000">- Move upstreamed i915 patch into sorted section
- commit 4f7c541</changelog>
  <changelog author="tiwai@suse.de" date="1669896001">- Update patch reference for ATM fix (CVE-2022-3635 bsc#1204631)
- commit f11d21c</changelog>
  <changelog author="tiwai@suse.de" date="1669896002">- atm: idt77252: fix use-after-free bugs caused by tst_timer
  (CVE-2022-3635 bsc#1204631).
- commit 81a86f3</changelog>
  <changelog author="ematsumiya@suse.de" date="1669982400">- cifs: skip extra NULL byte in filenames (bsc#1204791).
- commit 482b418</changelog>
  <changelog author="tiwai@suse.de" date="1669982401">- hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
  (git-fixes).
- hwmon: (coretemp) Check for null before removing sysfs attrs
  (git-fixes).
- hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc()
  fails (git-fixes).
- hwmon: (i5500_temp) fix missing pci_disable_device()
  (git-fixes).
- commit fdf27d9</changelog>
  <changelog author="ddiss@suse.de" date="1669982402">- io_uring/af_unix: defer registered files gc to io_uring release
  (bsc#1204228 CVE-2022-2602).
- commit fee5862</changelog>
  <changelog author="ddiss@suse.de" date="1669982403">- kabi: sk_buff.scm_io_uring (bsc#1204228 CVE-2022-2602).
- commit 1cb9473</changelog>
  <changelog author="lhenriques@suse.de" date="1669982404">- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1205989).
- ceph: lockdep annotations for try_nonblocking_invalidate
  (bsc#1205988).
- ceph: request Fw caps before updating the mtime in
  ceph_write_iter (bsc#1205987).
- ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
  (bsc#1205986).
- ceph: fix fscache invalidation (bsc#1205985).
- ceph: do not access the kiocb after aio requests (bsc#1205984).
- commit 3a3eff6</changelog>
  <changelog author="lduncan@suse.com" date="1669982405">- Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
- commit 2043e6b</changelog>
  <changelog author="jslaby@suse.cz" date="1670241600">- Update
  patches.suse/x86-bugs-Add-AMD-retbleed-boot-parameter.patch
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901 bsc#1203271
  bsc#1206032).
- Refresh patches.suse/x86-bugs-Add-retbleed-ibpb.patch.
- Refresh patches.suse/x86-bugs-Enable-STIBP-for-JMP2RET.patch.
  Fix mitigations=off to imply retbleed=off (bsc#1206032).
- commit f959a8e</changelog>
  <changelog author="jslaby@suse.cz" date="1670241601">- docs/kernel-parameters: Update descriptions for "mitigations="
  param with retbleed (bsc#1199657 CVE-2022-29900 CVE-2022-29901
  bsc#1203271 bsc#1206032).
- commit 012ee9f</changelog>
  <changelog author="osalvador@suse.de" date="1670241602">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ff0c181</changelog>
  <changelog author="jslaby@suse.cz" date="1670414400">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit df768bd</changelog>
  <changelog author="jslaby@suse.cz" date="1670414401">- Refresh
  patches.suse/x86-speculation-Disable-RRSBA-behavior.patch.
  Fix up after merge from cve/5.3. The patch can be closer to upstream in
  15sp3 as we have more than in the cve branch.
- commit 344ce75</changelog>
  <changelog author="oneukum@suse.com" date="1670414402">- Refresh
  patches.kabi/kABI-remove-new-member-of-usbip_device.patch.
- commit bf09767</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (CVE-2022-4378 bsc#1206207).
- proc: avoid integer type confusion in get_proc_long
  (CVE-2022-4378 bsc#1206207).
- commit 1e50bbf</changelog>
</package>
<package pkgid="ac7beabc4be9bdca4dd9a19d25264fe166f591171ea9af899b91ef1b1675fd46" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.106.1"/>
  <changelog author="jgross@suse.com" date="1669809600">- blacklist.conf: add 5c13a4a0291b3019
- commit f414b37</changelog>
  <changelog author="jgross@suse.com" date="1669809601">- xen/privcmd: Corrected error handling path (git-fixes).
- commit 9273ea4</changelog>
  <changelog author="jgross@suse.com" date="1669809602">- xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  (git-fixes).
- commit a2d69de</changelog>
  <changelog author="tiwai@suse.de" date="1669809603">- net: ethernet: renesas: ravb: Fix promiscuous mode after system
  resumed (git-fixes).
- wifi: mac8021: fix possible oob access in
  ieee80211_get_rate_duration (git-fixes).
- wifi: cfg80211: fix buffer overflow in elem comparison
  (git-fixes).
- net: ethernet: nixge: fix NULL dereference (git-fixes).
- net: phy: fix null-ptr-deref while probe() failed (git-fixes).
- can: cc770: cc770_isa_probe(): add missing free_cc770dev()
  (git-fixes).
- can: sja1000_isa: sja1000_isa_probe(): add missing
  free_sja1000dev() (git-fixes).
- commit c233552</changelog>
  <changelog author="tiwai@suse.de" date="1669896000">- Move upstreamed i915 patch into sorted section
- commit 4f7c541</changelog>
  <changelog author="tiwai@suse.de" date="1669896001">- Update patch reference for ATM fix (CVE-2022-3635 bsc#1204631)
- commit f11d21c</changelog>
  <changelog author="tiwai@suse.de" date="1669896002">- atm: idt77252: fix use-after-free bugs caused by tst_timer
  (CVE-2022-3635 bsc#1204631).
- commit 81a86f3</changelog>
  <changelog author="ematsumiya@suse.de" date="1669982400">- cifs: skip extra NULL byte in filenames (bsc#1204791).
- commit 482b418</changelog>
  <changelog author="tiwai@suse.de" date="1669982401">- hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
  (git-fixes).
- hwmon: (coretemp) Check for null before removing sysfs attrs
  (git-fixes).
- hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc()
  fails (git-fixes).
- hwmon: (i5500_temp) fix missing pci_disable_device()
  (git-fixes).
- commit fdf27d9</changelog>
  <changelog author="ddiss@suse.de" date="1669982402">- io_uring/af_unix: defer registered files gc to io_uring release
  (bsc#1204228 CVE-2022-2602).
- commit fee5862</changelog>
  <changelog author="ddiss@suse.de" date="1669982403">- kabi: sk_buff.scm_io_uring (bsc#1204228 CVE-2022-2602).
- commit 1cb9473</changelog>
  <changelog author="lhenriques@suse.de" date="1669982404">- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1205989).
- ceph: lockdep annotations for try_nonblocking_invalidate
  (bsc#1205988).
- ceph: request Fw caps before updating the mtime in
  ceph_write_iter (bsc#1205987).
- ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
  (bsc#1205986).
- ceph: fix fscache invalidation (bsc#1205985).
- ceph: do not access the kiocb after aio requests (bsc#1205984).
- commit 3a3eff6</changelog>
  <changelog author="lduncan@suse.com" date="1669982405">- Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
- commit 2043e6b</changelog>
  <changelog author="jslaby@suse.cz" date="1670241600">- Update
  patches.suse/x86-bugs-Add-AMD-retbleed-boot-parameter.patch
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901 bsc#1203271
  bsc#1206032).
- Refresh patches.suse/x86-bugs-Add-retbleed-ibpb.patch.
- Refresh patches.suse/x86-bugs-Enable-STIBP-for-JMP2RET.patch.
  Fix mitigations=off to imply retbleed=off (bsc#1206032).
- commit f959a8e</changelog>
  <changelog author="jslaby@suse.cz" date="1670241601">- docs/kernel-parameters: Update descriptions for "mitigations="
  param with retbleed (bsc#1199657 CVE-2022-29900 CVE-2022-29901
  bsc#1203271 bsc#1206032).
- commit 012ee9f</changelog>
  <changelog author="osalvador@suse.de" date="1670241602">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ff0c181</changelog>
  <changelog author="jslaby@suse.cz" date="1670414400">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit df768bd</changelog>
  <changelog author="jslaby@suse.cz" date="1670414401">- Refresh
  patches.suse/x86-speculation-Disable-RRSBA-behavior.patch.
  Fix up after merge from cve/5.3. The patch can be closer to upstream in
  15sp3 as we have more than in the cve branch.
- commit 344ce75</changelog>
  <changelog author="oneukum@suse.com" date="1670414402">- Refresh
  patches.kabi/kABI-remove-new-member-of-usbip_device.patch.
- commit bf09767</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (CVE-2022-4378 bsc#1206207).
- proc: avoid integer type confusion in get_proc_long
  (CVE-2022-4378 bsc#1206207).
- commit 1e50bbf</changelog>
</package>
<package pkgid="726c5c3b50e05288a3f53f4094021a8e5547bcb659fb061947582fbd472f224e" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.109.1"/>
  <changelog author="iivanov@suse.de" date="1673352000">- README.BRANCH: Added myself as co-maintainer
  And drop Oscars name.
- commit 0607a55</changelog>
  <changelog author="fdmanana@suse.com" date="1673438400">- Refresh
  patches.suse/btrfs-avoid-unnecessary-lock-and-leaf-splits-when-up.patch.
  For bsc#1206904, see:
  https://bugzilla.suse.com/show_bug.cgi?id=1206904#c6
- commit dfcd116</changelog>
  <changelog author="msuchanek@suse.de" date="1673438401">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 8b8572d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524800">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 0726009</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524801">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 49dc51c</changelog>
  <changelog author="msuchanek@suse.de" date="1673611200">- powerpc/rtas: avoid scheduling in rtas_os_term() (bsc#1065729).
- powerpc/rtas: avoid device tree lookups in rtas_os_term()
  (bsc#1065729).
- commit da7ea39</changelog>
  <changelog author="lduncan@suse.com" date="1673784000">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit ebdddc5</changelog>
  <changelog author="mhocko@suse.com" date="1673870400">- mm/memcg: optimize memory.numa_stat like memory.stat
  (bsc#1206663).
- commit d7619da</changelog>
  <changelog author="alnovak@suse.cz" date="1673870401">- SLE15-SP3 went to LTSS, hand over to L3
- commit c5e6bf0</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870402">- Update
  patches.suse/net-sched-atm-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207125 CVE-2023-23455).
- commit e595908</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870403">- Update
  patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207036 CVE-2023-23454).
- commit 88c4e72</changelog>
  <changelog author="schwab@suse.de" date="1673870404">- rpm/mkspec-dtb: add riscv64 dtb-renesas subpackage
- commit 6020754</changelog>
  <changelog author="lhenriques@suse.de" date="1673956800">- ceph: avoid putting the realm twice when decoding snaps fails
  (bsc#1207198).
- ceph: do not update snapshot context when there is no new
  snapshot (bsc#1207218).
- commit 2f13b5a</changelog>
  <changelog author="lhenriques@suse.de" date="1673956801">- blacklist.conf: 461ab10ef7e6 ("ceph: switch to vfs_inode_has_locks() to fix file lock bug")
- commit b165b65</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1674043200">- net: sched: disallow noqueue for qdisc classes (bsc#1207237
  CVE-2022-47929).
- commit e015217</changelog>
  <changelog author="firo.yang@suse.com" date="1674129600">- sctp: sysctl: make extra pointers netns aware (bsc#1204760).
- commit 580597a</changelog>
  <changelog author="tiwai@suse.de" date="1674129601">- ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent
  UAF (CVE-2023-0266 bsc#1207134).
- commit 9014493</changelog>
  <changelog author="pmladek@suse.com" date="1674216000">- HID: betop: check shape of output reports (git-fixes,
  bsc#1207186).
- commit f6860d6</changelog>
  <changelog author="pmladek@suse.com" date="1674216001">- HID: check empty report_list in bigben_probe() (git-fixes,
  bsc#1206784).
- commit c479b33</changelog>
  <changelog author="pmladek@suse.com" date="1674216002">- HID: check empty report_list in hid_validate_values()
  (git-fixes, bsc#1206784).
- commit 028641d</changelog>
</package>
<package pkgid="6c1cf31525a03a276b8216aa70fce84188480f9f06bf4344b11d89483d2bf8be" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.109.1"/>
  <changelog author="iivanov@suse.de" date="1673352000">- README.BRANCH: Added myself as co-maintainer
  And drop Oscars name.
- commit 0607a55</changelog>
  <changelog author="fdmanana@suse.com" date="1673438400">- Refresh
  patches.suse/btrfs-avoid-unnecessary-lock-and-leaf-splits-when-up.patch.
  For bsc#1206904, see:
  https://bugzilla.suse.com/show_bug.cgi?id=1206904#c6
- commit dfcd116</changelog>
  <changelog author="msuchanek@suse.de" date="1673438401">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 8b8572d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524800">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 0726009</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524801">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 49dc51c</changelog>
  <changelog author="msuchanek@suse.de" date="1673611200">- powerpc/rtas: avoid scheduling in rtas_os_term() (bsc#1065729).
- powerpc/rtas: avoid device tree lookups in rtas_os_term()
  (bsc#1065729).
- commit da7ea39</changelog>
  <changelog author="lduncan@suse.com" date="1673784000">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit ebdddc5</changelog>
  <changelog author="mhocko@suse.com" date="1673870400">- mm/memcg: optimize memory.numa_stat like memory.stat
  (bsc#1206663).
- commit d7619da</changelog>
  <changelog author="alnovak@suse.cz" date="1673870401">- SLE15-SP3 went to LTSS, hand over to L3
- commit c5e6bf0</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870402">- Update
  patches.suse/net-sched-atm-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207125 CVE-2023-23455).
- commit e595908</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870403">- Update
  patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207036 CVE-2023-23454).
- commit 88c4e72</changelog>
  <changelog author="schwab@suse.de" date="1673870404">- rpm/mkspec-dtb: add riscv64 dtb-renesas subpackage
- commit 6020754</changelog>
  <changelog author="lhenriques@suse.de" date="1673956800">- ceph: avoid putting the realm twice when decoding snaps fails
  (bsc#1207198).
- ceph: do not update snapshot context when there is no new
  snapshot (bsc#1207218).
- commit 2f13b5a</changelog>
  <changelog author="lhenriques@suse.de" date="1673956801">- blacklist.conf: 461ab10ef7e6 ("ceph: switch to vfs_inode_has_locks() to fix file lock bug")
- commit b165b65</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1674043200">- net: sched: disallow noqueue for qdisc classes (bsc#1207237
  CVE-2022-47929).
- commit e015217</changelog>
  <changelog author="firo.yang@suse.com" date="1674129600">- sctp: sysctl: make extra pointers netns aware (bsc#1204760).
- commit 580597a</changelog>
  <changelog author="tiwai@suse.de" date="1674129601">- ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent
  UAF (CVE-2023-0266 bsc#1207134).
- commit 9014493</changelog>
  <changelog author="pmladek@suse.com" date="1674216000">- HID: betop: check shape of output reports (git-fixes,
  bsc#1207186).
- commit f6860d6</changelog>
  <changelog author="pmladek@suse.com" date="1674216001">- HID: check empty report_list in bigben_probe() (git-fixes,
  bsc#1206784).
- commit c479b33</changelog>
  <changelog author="pmladek@suse.com" date="1674216002">- HID: check empty report_list in hid_validate_values()
  (git-fixes, bsc#1206784).
- commit 028641d</changelog>
</package>
<package pkgid="5e2e1502d48dc3e580bb5c9a46941a69b31cae4db6f0dfb5f1d1bfe7067543dd" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.109.1"/>
  <changelog author="iivanov@suse.de" date="1673352000">- README.BRANCH: Added myself as co-maintainer
  And drop Oscars name.
- commit 0607a55</changelog>
  <changelog author="fdmanana@suse.com" date="1673438400">- Refresh
  patches.suse/btrfs-avoid-unnecessary-lock-and-leaf-splits-when-up.patch.
  For bsc#1206904, see:
  https://bugzilla.suse.com/show_bug.cgi?id=1206904#c6
- commit dfcd116</changelog>
  <changelog author="msuchanek@suse.de" date="1673438401">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 8b8572d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524800">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 0726009</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524801">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 49dc51c</changelog>
  <changelog author="msuchanek@suse.de" date="1673611200">- powerpc/rtas: avoid scheduling in rtas_os_term() (bsc#1065729).
- powerpc/rtas: avoid device tree lookups in rtas_os_term()
  (bsc#1065729).
- commit da7ea39</changelog>
  <changelog author="lduncan@suse.com" date="1673784000">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit ebdddc5</changelog>
  <changelog author="mhocko@suse.com" date="1673870400">- mm/memcg: optimize memory.numa_stat like memory.stat
  (bsc#1206663).
- commit d7619da</changelog>
  <changelog author="alnovak@suse.cz" date="1673870401">- SLE15-SP3 went to LTSS, hand over to L3
- commit c5e6bf0</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870402">- Update
  patches.suse/net-sched-atm-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207125 CVE-2023-23455).
- commit e595908</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870403">- Update
  patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207036 CVE-2023-23454).
- commit 88c4e72</changelog>
  <changelog author="schwab@suse.de" date="1673870404">- rpm/mkspec-dtb: add riscv64 dtb-renesas subpackage
- commit 6020754</changelog>
  <changelog author="lhenriques@suse.de" date="1673956800">- ceph: avoid putting the realm twice when decoding snaps fails
  (bsc#1207198).
- ceph: do not update snapshot context when there is no new
  snapshot (bsc#1207218).
- commit 2f13b5a</changelog>
  <changelog author="lhenriques@suse.de" date="1673956801">- blacklist.conf: 461ab10ef7e6 ("ceph: switch to vfs_inode_has_locks() to fix file lock bug")
- commit b165b65</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1674043200">- net: sched: disallow noqueue for qdisc classes (bsc#1207237
  CVE-2022-47929).
- commit e015217</changelog>
  <changelog author="firo.yang@suse.com" date="1674129600">- sctp: sysctl: make extra pointers netns aware (bsc#1204760).
- commit 580597a</changelog>
  <changelog author="tiwai@suse.de" date="1674129601">- ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent
  UAF (CVE-2023-0266 bsc#1207134).
- commit 9014493</changelog>
  <changelog author="pmladek@suse.com" date="1674216000">- HID: betop: check shape of output reports (git-fixes,
  bsc#1207186).
- commit f6860d6</changelog>
  <changelog author="pmladek@suse.com" date="1674216001">- HID: check empty report_list in bigben_probe() (git-fixes,
  bsc#1206784).
- commit c479b33</changelog>
  <changelog author="pmladek@suse.com" date="1674216002">- HID: check empty report_list in hid_validate_values()
  (git-fixes, bsc#1206784).
- commit 028641d</changelog>
</package>
<package pkgid="19bf0ff17407d074e2257b954725193014cf90ec2f0ebdb51b06c799185393b8" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.112.1"/>
  <changelog author="lduncan@suse.com" date="1674648000">- scsi: ufs: Improve interrupt handling for shared interrupts
  (git-fixes).
- scsi: ufs: Fix interrupt error message for shared interrupts
  (git-fixes).
- scsi: ufs: Fix possible infinite loop in ufshcd_hold
  (git-fixes).
- scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
  (git-fixes).
- scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
  (git-fixes).
- scsi: scsi_transport_spi: Fix function pointer check
  (git-fixes).
- scsi: sr: Fix sr_probe() missing deallocate of device minor
  (git-fixes).
- scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
  (git-fixes).
- scsi: hisi_sas: Do not reset phy timer to wait for stray phy up
  (git-fixes).
- scsi: cxlflash: Fix error return code in cxlflash_probe()
  (git-fixes).
- scsi: core: free sgtables in case command setup fails
  (git-fixes).
- scsi: pm: Balance pm_only counter of request queue during
  system resume (git-fixes).
- scsi: iscsi: Report unbind session event when the target has
  been removed (git-fixes).
- scsi: iscsi: Don't destroy session if there are outstanding
  connections (git-fixes).
- scsi: ufs: Fix a race condition in the tracing code (git-fixes).
- scsi: ufs: Make ufshcd_add_command_trace() easier to read
  (git-fixes).
- scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
  (git-fixes).
- scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
  (git-fixes).
- scsi: iscsi: Don't send data to unbound connection (git-fixes).
- scsi: NCR5380: Add disconnect_mask module parameter (git-fixes).
- scsi: scsi_debug: num_tgts must be &gt;= 0 (git-fixes).
- scsi: ufs: Fix error handing during hibern8 enter (git-fixes).
- scsi: ufs: Fix irq return code (git-fixes).
- scsi: ufs: Fix up auto hibern8 enablement (git-fixes).
- scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of
  SG_NONE (git-fixes).
- scsi: ufs: fix potential bug which ends in system hang
  (git-fixes).
- scsi: hisi_sas: Check sas_port before using it (git-fixes).
- scsi: fnic: fix use after free (git-fixes).
- scsi: ufs: delete redundant function ufshcd_def_desc_sizes()
  (git-fixes).
- scsi: hisi_sas: Delete the debugfs folder of hisi_sas when
  the probe fails (git-fixes).
- commit e77b62a</changelog>
  <changelog author="tabraham@suse.com" date="1674648001">- KVM: VMX: fix crash cleanup when KVM wasn't used (bsc#1207508).
- Refresh
  patches.suse/KVM-x86-speculation-Disable-Fill-buffer-clear-within-guests.patch.
- commit 8d5e108</changelog>
  <changelog author="lduncan@suse.com" date="1674734400">- scsi: ufs: Clean up completed request without interrupt
  notification (git-fixes).
- Refresh
  patches.suse/scsi-ufs-Properly-release-resources-if-a-task-is-aborted-successfully.
- commit 0e26434</changelog>
  <changelog author="mkubecek@suse.cz" date="1674734401">- sctp: fail if no bound addresses can be used for a given scope
  (bsc#1206677).
- commit dcee4fd</changelog>
  <changelog author="lduncan@suse.com" date="1674734402">- scsi: ufs: Make sure clk scaling happens only when HBA is
  runtime ACTIVE (git-fixes).
- scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by
  ufshcd_hold() (git-fixes).
- scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
  (git-fixes).
- scsi: hpsa: Fix memory leak in hpsa_init_one() (git-fixes).
- scsi: core: Don't start concurrent async scan on same host
  (git-fixes).
- scsi: mvumi: Fix error return in mvumi_io_attach() (git-fixes).
- scsi: qedf: Return SUCCESS if stale rport is encountered
  (git-fixes).
- scsi: qedi: Protect active command list to avoid list corruption
  (git-fixes).
- scsi: qedi: Fix list_del corruption while removing active I/O
  (git-fixes).
- scsi: ufs: ufs-qcom: Fix race conditions caused by
  ufs_qcom_testbus_config() (git-fixes).
- commit 0335e79</changelog>
  <changelog author="lduncan@suse.com" date="1674820800">- scsi: pmcraid: Fix missing resource cleanup in error case
  (git-fixes).
- scsi: ipr: Fix missing/incorrect resource cleanup in error case
  (git-fixes).
- scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (git-fixes).
- scsi: myrb: Fix up null pointer access on myrb_cleanup()
  (git-fixes).
- scsi: megaraid: Fix error check return value of
  register_chrdev() (git-fixes).
- scsi: qedi: Fix failed disconnect handling (git-fixes).
- scsi: megaraid_sas: Target with invalid LUN ID is deleted
  during scan (git-fixes).
- scsi: mvsas: Add PCI ID of RocketRaid 2640 (git-fixes).
- scsi: libfc: Fix use after free in fc_exch_abts_resp()
  (git-fixes).
- scsi: aha152x: Fix aha152x_setup() __setup handler return value
  (git-fixes).
- scsi: pm8001: Fix pm8001_mpi_task_abort_resp() (git-fixes).
- scsi: bfa: Replace snprintf() with sysfs_emit() (git-fixes).
- scsi: mvsas: Replace snprintf() with sysfs_emit() (git-fixes).
- scsi: myrs: Fix crash in error case (git-fixes).
- scsi: qedf: Fix refcount issue when LOGO is received during TMF
  (git-fixes).
- scsi: sr: Don't use GFP_DMA (git-fixes).
- scsi: vmw_pvscsi: Set residual data length conditionally
  (git-fixes).
- scsi: libiscsi: Fix UAF in
  iscsi_conn_get_param()/iscsi_conn_teardown() (git-fixes).
- scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
  (git-fixes).
- scsi: core: sysfs: Fix hang when device state is set via sysfs
  (git-fixes).
- scsi: iscsi: Unblock session then wake up error handler
  (git-fixes).
- scsi: advansys: Fix kernel pointer leak (git-fixes).
- scsi: core: Fix shost-&gt;cmd_per_lun calculation in
  scsi_add_host_with_dma() (git-fixes).
- scsi: virtio_scsi: Fix spelling mistake "Unsupport" -&gt;
  "Unsupported" (git-fixes).
- scsi: ses: Fix unsigned comparison with less than zero
  (git-fixes).
- scsi: ufs: Fix illegal offset in UPIU event trace (git-fixes).
- scsi: ses: Retry failed Send/Receive Diagnostic commands
  (git-fixes).
- scsi: sd: Free scsi_disk device via put_device() (git-fixes).
- scsi: core: Fix hang of freezing queue between blocking and
  running device (git-fixes).
- scsi: core: Fix capacity set to zero after offlinining device
  (git-fixes).
- scsi: sr: Return correct event when media event code is 3
  (git-fixes).
- scsi: core: Avoid printing an error if target_alloc() returns
  - ENXIO (git-fixes).
- scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
  (git-fixes).
- scsi: megaraid_mm: Fix end of loop tests for
  list_for_each_entry() (git-fixes).
- scsi: qedf: Add check to synchronize abort and flush
  (git-fixes).
- scsi: libsas: Add LUN number check in .slave_alloc callback
  (git-fixes).
- scsi: aic7xxx: Fix unintentional sign extension issue on left
  shift of u8 (git-fixes).
- scsi: scsi_dh_alua: Fix signedness bug in alua_rtpg()
  (git-fixes).
- scsi: scsi_dh_alua: Check for negative result value (git-fixes).
- scsi: qedi: Fix null ref during abort handling (git-fixes).
- scsi: iscsi: Fix shost-&gt;max_id use (git-fixes).
- scsi: iscsi: Add iscsi_cls_conn refcount helpers (git-fixes).
- scsi: megaraid_sas: Handle missing interrupts while re-enabling
  IRQs (git-fixes).
- scsi: megaraid_sas: Early detection of VD deletion through
  RaidMap update (git-fixes).
- scsi: megaraid_sas: Fix resource leak in case of probe failure
  (git-fixes).
- scsi: core: Cap scsi_host cmd_per_lun at can_queue (git-fixes).
- scsi: hisi_sas: Propagate errors in interrupt_init_v1_hw()
  (git-fixes).
- scsi: sr: Return appropriate error code when disk is ejected
  (git-fixes).
- scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated
  irq (git-fixes).
- scsi: vmw_pvscsi: Set correct residual data length (git-fixes).
- scsi: bnx2fc: Return failure if io_req is already in ABTS
  processing (git-fixes).
- scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
  (git-fixes).
- scsi: libfc: Fix a format specifier (git-fixes).
- scsi: mpt3sas: Block PCI config access from userspace during
  reset (git-fixes).
- scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
  (git-fixes).
- scsi: st: Fix a use after free in st_open() (git-fixes).
- scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
  (git-fixes).
- scsi: fnic: Fix memleak in vnic_dev_init_devcmd2 (git-fixes).
- scsi: ufs: Fix tm request when non-fatal error happens
  (git-fixes).
- scsi: sd: Suppress spurious errors when WRITE SAME is being
  disabled (git-fixes).
- scsi: scsi_transport_spi: Set RQF_PM for domain validation
  commands (git-fixes).
- scsi: ufs-pci: Ensure UFS device is in PowerDown mode for
  suspend-to-disk -&gt;poweroff() (git-fixes).
- scsi: ufs: Fix wrong print message in dev_err() (git-fixes).
- scsi: mpt3sas: Increase IOCInit request timeout to 30s
  (git-fixes).
- commit cf6a959</changelog>
  <changelog author="lduncan@suse.com" date="1674820801">- blacklist.conf: removing SCSI git-fix mistakenly added
  This fix was labelled as already present in our
  code base, but it was not.
- commit bcd8cfe</changelog>
  <changelog author="colyli@suse.de" date="1674907200">- blacklist.conf: add git-fixes commits which won't be backported
- commit 4601d33</changelog>
  <changelog author="colyli@suse.de" date="1674907201">- rbd: work around -Wuninitialized warning (git-fixes).
- Refresh for the above change,
  patches.suse/rbd-export-some-functions-used-by-lio-rbd-backend.patch.
- commit e923159</changelog>
  <changelog author="colyli@suse.de" date="1674907202">- dm space maps: don't reset space map allocation cursor when
  committing (git-fixes).
- dm verity: fix require_signatures module_param permissions
  (git-fixes).
- dm integrity: fix flush with external metadata device
  (git-fixes).
- dm integrity: select CRYPTO_SKCIPHER (git-fixes).
- dm verity: skip verity work if I/O error when system is shutting
  down (git-fixes).
- dm table: Remove BUG_ON(in_interrupt()) (git-fixes).
- nbd: make the config put is called before the notifying the
  waiter (git-fixes).
- nbd: restore default timeout when setting it to zero
  (git-fixes).
- loop: unset GENHD_FL_NO_PART_SCAN on LOOP_CONFIGURE (git-fixes).
- blktrace: ensure our debugfs dir exists (git-fixes).
- commit 50ca764</changelog>
  <changelog author="colyli@suse.de" date="1674907203">- nbd: fix max value for 'first_minor' (git-fixes).
- Refresh for the above change,
  patches.suse/0012-nbd-fix-possible-overflow-for-first_minor-in-nbd_dev.patch.
- commit dd126a5</changelog>
  <changelog author="colyli@suse.de" date="1674907204">- nbd: Fix incorrect error handle when first_minor is illegal
  in nbd_dev_add (git-fixes).
- Refresh for the above change,
  patches.suse/0019-nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_.patch.
- commit 9c00c1c</changelog>
  <changelog author="colyli@suse.de" date="1674907205">- dm thin: Use last transaction's pmd-&gt;root when commit failed
  (git-fixes).
- dm thin: resume even if in FAIL mode (git-fixes).
- dm cache: set needs_check flag after aborting metadata
  (git-fixes).
- dm cache: Fix ABBA deadlock between shrink_slab and
  dm_cache_metadata_abort (git-fixes).
- dm thin: Fix ABBA deadlock between shrink_slab and
  dm_pool_abort_metadata (git-fixes).
- dm integrity: Fix UAF in dm_integrity_dtr() (git-fixes).
- dm cache: Fix UAF in destroy() (git-fixes).
- dm clone: Fix UAF in clone_dtr() (git-fixes).
- dm thin: Fix UAF in run_timer_softirq() (git-fixes).
- blktrace: Fix output non-blktrace event when blk_classic option
  enabled (git-fixes).
- dm integrity: flush the journal on suspend (git-fixes).
- dm ioctl: fix misbehavior if list_versions races with module
  loading (git-fixes).
- md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d (git-fixes).
- bcache: fix set_at_max_writeback_rate() for multiple attached
  devices (git-fixes).
- nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  (git-fixes).
- md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
- drivers:md:fix a potential use-after-free bug (git-fixes).
- null_blk: fix ida error handling in null_add_dev() (git-fixes).
- md: Notify sysfs sync_completed in md_reap_sync_thread()
  (git-fixes).
- nbd: fix io hung while disconnecting device (git-fixes).
- nbd: fix race between nbd_alloc_config() and module removal
  (git-fixes).
- nbd: call genl_unregister_family() first in nbd_cleanup()
  (git-fixes).
- md: protect md_unregister_thread from reentrancy (git-fixes).
- nbd: Fix hung on disconnect request if socket is closed before
  (git-fixes).
- dm ioctl: prevent potential spectre v1 gadget (git-fixes).
- loop: use sysfs_emit() in the sysfs xxx show() (git-fixes).
- dm space map common: add bounds check to sm_ll_lookup_bitmap()
  (git-fixes).
- dm btree: add a defensive bounds check to insert_at()
  (git-fixes).
- commit 223b9c6</changelog>
  <changelog author="lduncan@suse.com" date="1674907206">- scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile (git-fixes).
- scsi: snic: Fix possible UAF in snic_tgt_create() (git-fixes).
- scsi: fcoe: Fix transport not deattached when fcoe_if_init()
  fails (git-fixes).
- scsi: ipr: Fix WARNING in ipr_init() (git-fixes).
- scsi: scsi_debug: Fix possible name leak in
  sdebug_add_host_helper() (git-fixes).
- scsi: fcoe: Fix possible name leak when device_register()
  fails (git-fixes).
- scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
  (git-fixes).
- scsi: hpsa: Fix error handling in hpsa_add_sas_host()
  (git-fixes).
- scsi: mpt3sas: Fix possible resource leaks in
  mpt3sas_transport_port_add() (git-fixes).
- scsi: hpsa: Fix possible memory leak in hpsa_init_one()
  (git-fixes).
- scsi: scsi_debug: Fix a warning in resp_write_scat()
  (git-fixes).
- scsi: core: Fix a race between scsi_done() and scsi_timeout()
  (git-fixes).
- scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
  (git-fixes).
- scsi: core: Restrict legal sdev_state transitions via sysfs
  (git-fixes).
- scsi: 3w-9xxx: Avoid disabling device if failing to enable it
  (git-fixes).
- scsi: qedf: Fix a UAF bug in __qedf_probe() (git-fixes).
- scsi: megaraid_sas: Fix double kfree() (git-fixes).
- scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
  (git-fixes).
- commit 25cb1e4</changelog>
  <changelog author="mhocko@suse.com" date="1675080000">- mm: /proc/pid/smaps_rollup: fix no vma's null-deref
  (bsc#1207769).
- commit be9727c</changelog>
  <changelog author="msuchanek@suse.de" date="1675166400">- config.conf: Drop armv7l, Leap 15.3 is EOL.
- Delete config/armv7hl/default.
- Delete config/armv7hl/lpae.
- commit 022c807</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1675771200">- libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
  (bsc#1204502 CVE-2022-3606).
- commit eef9e8d</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771201">- RDMA/core: Fix ib block iterator counter overflow (bsc#1207878).
- commit 64f6682</changelog>
  <changelog author="tabraham@suse.com" date="1675771202">- watchdog: diag288_wdt: fix __diag288() inline assembly
  (bsc#1207497).
- commit 2f246cf</changelog>
  <changelog author="tabraham@suse.com" date="1675771203">- watchdog: diag288_wdt: do not use stack buffers for hardware
  data (bsc#1207497).
- commit f31eb64</changelog>
</package>
<package pkgid="47dbf127f283d305c6a21ba721acafa961783c0be84ca57c3eccd570ca64e1ab" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.112.1"/>
  <changelog author="lduncan@suse.com" date="1674648000">- scsi: ufs: Improve interrupt handling for shared interrupts
  (git-fixes).
- scsi: ufs: Fix interrupt error message for shared interrupts
  (git-fixes).
- scsi: ufs: Fix possible infinite loop in ufshcd_hold
  (git-fixes).
- scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
  (git-fixes).
- scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
  (git-fixes).
- scsi: scsi_transport_spi: Fix function pointer check
  (git-fixes).
- scsi: sr: Fix sr_probe() missing deallocate of device minor
  (git-fixes).
- scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
  (git-fixes).
- scsi: hisi_sas: Do not reset phy timer to wait for stray phy up
  (git-fixes).
- scsi: cxlflash: Fix error return code in cxlflash_probe()
  (git-fixes).
- scsi: core: free sgtables in case command setup fails
  (git-fixes).
- scsi: pm: Balance pm_only counter of request queue during
  system resume (git-fixes).
- scsi: iscsi: Report unbind session event when the target has
  been removed (git-fixes).
- scsi: iscsi: Don't destroy session if there are outstanding
  connections (git-fixes).
- scsi: ufs: Fix a race condition in the tracing code (git-fixes).
- scsi: ufs: Make ufshcd_add_command_trace() easier to read
  (git-fixes).
- scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
  (git-fixes).
- scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
  (git-fixes).
- scsi: iscsi: Don't send data to unbound connection (git-fixes).
- scsi: NCR5380: Add disconnect_mask module parameter (git-fixes).
- scsi: scsi_debug: num_tgts must be &gt;= 0 (git-fixes).
- scsi: ufs: Fix error handing during hibern8 enter (git-fixes).
- scsi: ufs: Fix irq return code (git-fixes).
- scsi: ufs: Fix up auto hibern8 enablement (git-fixes).
- scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of
  SG_NONE (git-fixes).
- scsi: ufs: fix potential bug which ends in system hang
  (git-fixes).
- scsi: hisi_sas: Check sas_port before using it (git-fixes).
- scsi: fnic: fix use after free (git-fixes).
- scsi: ufs: delete redundant function ufshcd_def_desc_sizes()
  (git-fixes).
- scsi: hisi_sas: Delete the debugfs folder of hisi_sas when
  the probe fails (git-fixes).
- commit e77b62a</changelog>
  <changelog author="tabraham@suse.com" date="1674648001">- KVM: VMX: fix crash cleanup when KVM wasn't used (bsc#1207508).
- Refresh
  patches.suse/KVM-x86-speculation-Disable-Fill-buffer-clear-within-guests.patch.
- commit 8d5e108</changelog>
  <changelog author="lduncan@suse.com" date="1674734400">- scsi: ufs: Clean up completed request without interrupt
  notification (git-fixes).
- Refresh
  patches.suse/scsi-ufs-Properly-release-resources-if-a-task-is-aborted-successfully.
- commit 0e26434</changelog>
  <changelog author="mkubecek@suse.cz" date="1674734401">- sctp: fail if no bound addresses can be used for a given scope
  (bsc#1206677).
- commit dcee4fd</changelog>
  <changelog author="lduncan@suse.com" date="1674734402">- scsi: ufs: Make sure clk scaling happens only when HBA is
  runtime ACTIVE (git-fixes).
- scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by
  ufshcd_hold() (git-fixes).
- scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
  (git-fixes).
- scsi: hpsa: Fix memory leak in hpsa_init_one() (git-fixes).
- scsi: core: Don't start concurrent async scan on same host
  (git-fixes).
- scsi: mvumi: Fix error return in mvumi_io_attach() (git-fixes).
- scsi: qedf: Return SUCCESS if stale rport is encountered
  (git-fixes).
- scsi: qedi: Protect active command list to avoid list corruption
  (git-fixes).
- scsi: qedi: Fix list_del corruption while removing active I/O
  (git-fixes).
- scsi: ufs: ufs-qcom: Fix race conditions caused by
  ufs_qcom_testbus_config() (git-fixes).
- commit 0335e79</changelog>
  <changelog author="lduncan@suse.com" date="1674820800">- scsi: pmcraid: Fix missing resource cleanup in error case
  (git-fixes).
- scsi: ipr: Fix missing/incorrect resource cleanup in error case
  (git-fixes).
- scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (git-fixes).
- scsi: myrb: Fix up null pointer access on myrb_cleanup()
  (git-fixes).
- scsi: megaraid: Fix error check return value of
  register_chrdev() (git-fixes).
- scsi: qedi: Fix failed disconnect handling (git-fixes).
- scsi: megaraid_sas: Target with invalid LUN ID is deleted
  during scan (git-fixes).
- scsi: mvsas: Add PCI ID of RocketRaid 2640 (git-fixes).
- scsi: libfc: Fix use after free in fc_exch_abts_resp()
  (git-fixes).
- scsi: aha152x: Fix aha152x_setup() __setup handler return value
  (git-fixes).
- scsi: pm8001: Fix pm8001_mpi_task_abort_resp() (git-fixes).
- scsi: bfa: Replace snprintf() with sysfs_emit() (git-fixes).
- scsi: mvsas: Replace snprintf() with sysfs_emit() (git-fixes).
- scsi: myrs: Fix crash in error case (git-fixes).
- scsi: qedf: Fix refcount issue when LOGO is received during TMF
  (git-fixes).
- scsi: sr: Don't use GFP_DMA (git-fixes).
- scsi: vmw_pvscsi: Set residual data length conditionally
  (git-fixes).
- scsi: libiscsi: Fix UAF in
  iscsi_conn_get_param()/iscsi_conn_teardown() (git-fixes).
- scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
  (git-fixes).
- scsi: core: sysfs: Fix hang when device state is set via sysfs
  (git-fixes).
- scsi: iscsi: Unblock session then wake up error handler
  (git-fixes).
- scsi: advansys: Fix kernel pointer leak (git-fixes).
- scsi: core: Fix shost-&gt;cmd_per_lun calculation in
  scsi_add_host_with_dma() (git-fixes).
- scsi: virtio_scsi: Fix spelling mistake "Unsupport" -&gt;
  "Unsupported" (git-fixes).
- scsi: ses: Fix unsigned comparison with less than zero
  (git-fixes).
- scsi: ufs: Fix illegal offset in UPIU event trace (git-fixes).
- scsi: ses: Retry failed Send/Receive Diagnostic commands
  (git-fixes).
- scsi: sd: Free scsi_disk device via put_device() (git-fixes).
- scsi: core: Fix hang of freezing queue between blocking and
  running device (git-fixes).
- scsi: core: Fix capacity set to zero after offlinining device
  (git-fixes).
- scsi: sr: Return correct event when media event code is 3
  (git-fixes).
- scsi: core: Avoid printing an error if target_alloc() returns
  - ENXIO (git-fixes).
- scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
  (git-fixes).
- scsi: megaraid_mm: Fix end of loop tests for
  list_for_each_entry() (git-fixes).
- scsi: qedf: Add check to synchronize abort and flush
  (git-fixes).
- scsi: libsas: Add LUN number check in .slave_alloc callback
  (git-fixes).
- scsi: aic7xxx: Fix unintentional sign extension issue on left
  shift of u8 (git-fixes).
- scsi: scsi_dh_alua: Fix signedness bug in alua_rtpg()
  (git-fixes).
- scsi: scsi_dh_alua: Check for negative result value (git-fixes).
- scsi: qedi: Fix null ref during abort handling (git-fixes).
- scsi: iscsi: Fix shost-&gt;max_id use (git-fixes).
- scsi: iscsi: Add iscsi_cls_conn refcount helpers (git-fixes).
- scsi: megaraid_sas: Handle missing interrupts while re-enabling
  IRQs (git-fixes).
- scsi: megaraid_sas: Early detection of VD deletion through
  RaidMap update (git-fixes).
- scsi: megaraid_sas: Fix resource leak in case of probe failure
  (git-fixes).
- scsi: core: Cap scsi_host cmd_per_lun at can_queue (git-fixes).
- scsi: hisi_sas: Propagate errors in interrupt_init_v1_hw()
  (git-fixes).
- scsi: sr: Return appropriate error code when disk is ejected
  (git-fixes).
- scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated
  irq (git-fixes).
- scsi: vmw_pvscsi: Set correct residual data length (git-fixes).
- scsi: bnx2fc: Return failure if io_req is already in ABTS
  processing (git-fixes).
- scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
  (git-fixes).
- scsi: libfc: Fix a format specifier (git-fixes).
- scsi: mpt3sas: Block PCI config access from userspace during
  reset (git-fixes).
- scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
  (git-fixes).
- scsi: st: Fix a use after free in st_open() (git-fixes).
- scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
  (git-fixes).
- scsi: fnic: Fix memleak in vnic_dev_init_devcmd2 (git-fixes).
- scsi: ufs: Fix tm request when non-fatal error happens
  (git-fixes).
- scsi: sd: Suppress spurious errors when WRITE SAME is being
  disabled (git-fixes).
- scsi: scsi_transport_spi: Set RQF_PM for domain validation
  commands (git-fixes).
- scsi: ufs-pci: Ensure UFS device is in PowerDown mode for
  suspend-to-disk -&gt;poweroff() (git-fixes).
- scsi: ufs: Fix wrong print message in dev_err() (git-fixes).
- scsi: mpt3sas: Increase IOCInit request timeout to 30s
  (git-fixes).
- commit cf6a959</changelog>
  <changelog author="lduncan@suse.com" date="1674820801">- blacklist.conf: removing SCSI git-fix mistakenly added
  This fix was labelled as already present in our
  code base, but it was not.
- commit bcd8cfe</changelog>
  <changelog author="colyli@suse.de" date="1674907200">- blacklist.conf: add git-fixes commits which won't be backported
- commit 4601d33</changelog>
  <changelog author="colyli@suse.de" date="1674907201">- rbd: work around -Wuninitialized warning (git-fixes).
- Refresh for the above change,
  patches.suse/rbd-export-some-functions-used-by-lio-rbd-backend.patch.
- commit e923159</changelog>
  <changelog author="colyli@suse.de" date="1674907202">- dm space maps: don't reset space map allocation cursor when
  committing (git-fixes).
- dm verity: fix require_signatures module_param permissions
  (git-fixes).
- dm integrity: fix flush with external metadata device
  (git-fixes).
- dm integrity: select CRYPTO_SKCIPHER (git-fixes).
- dm verity: skip verity work if I/O error when system is shutting
  down (git-fixes).
- dm table: Remove BUG_ON(in_interrupt()) (git-fixes).
- nbd: make the config put is called before the notifying the
  waiter (git-fixes).
- nbd: restore default timeout when setting it to zero
  (git-fixes).
- loop: unset GENHD_FL_NO_PART_SCAN on LOOP_CONFIGURE (git-fixes).
- blktrace: ensure our debugfs dir exists (git-fixes).
- commit 50ca764</changelog>
  <changelog author="colyli@suse.de" date="1674907203">- nbd: fix max value for 'first_minor' (git-fixes).
- Refresh for the above change,
  patches.suse/0012-nbd-fix-possible-overflow-for-first_minor-in-nbd_dev.patch.
- commit dd126a5</changelog>
  <changelog author="colyli@suse.de" date="1674907204">- nbd: Fix incorrect error handle when first_minor is illegal
  in nbd_dev_add (git-fixes).
- Refresh for the above change,
  patches.suse/0019-nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_.patch.
- commit 9c00c1c</changelog>
  <changelog author="colyli@suse.de" date="1674907205">- dm thin: Use last transaction's pmd-&gt;root when commit failed
  (git-fixes).
- dm thin: resume even if in FAIL mode (git-fixes).
- dm cache: set needs_check flag after aborting metadata
  (git-fixes).
- dm cache: Fix ABBA deadlock between shrink_slab and
  dm_cache_metadata_abort (git-fixes).
- dm thin: Fix ABBA deadlock between shrink_slab and
  dm_pool_abort_metadata (git-fixes).
- dm integrity: Fix UAF in dm_integrity_dtr() (git-fixes).
- dm cache: Fix UAF in destroy() (git-fixes).
- dm clone: Fix UAF in clone_dtr() (git-fixes).
- dm thin: Fix UAF in run_timer_softirq() (git-fixes).
- blktrace: Fix output non-blktrace event when blk_classic option
  enabled (git-fixes).
- dm integrity: flush the journal on suspend (git-fixes).
- dm ioctl: fix misbehavior if list_versions races with module
  loading (git-fixes).
- md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d (git-fixes).
- bcache: fix set_at_max_writeback_rate() for multiple attached
  devices (git-fixes).
- nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  (git-fixes).
- md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
- drivers:md:fix a potential use-after-free bug (git-fixes).
- null_blk: fix ida error handling in null_add_dev() (git-fixes).
- md: Notify sysfs sync_completed in md_reap_sync_thread()
  (git-fixes).
- nbd: fix io hung while disconnecting device (git-fixes).
- nbd: fix race between nbd_alloc_config() and module removal
  (git-fixes).
- nbd: call genl_unregister_family() first in nbd_cleanup()
  (git-fixes).
- md: protect md_unregister_thread from reentrancy (git-fixes).
- nbd: Fix hung on disconnect request if socket is closed before
  (git-fixes).
- dm ioctl: prevent potential spectre v1 gadget (git-fixes).
- loop: use sysfs_emit() in the sysfs xxx show() (git-fixes).
- dm space map common: add bounds check to sm_ll_lookup_bitmap()
  (git-fixes).
- dm btree: add a defensive bounds check to insert_at()
  (git-fixes).
- commit 223b9c6</changelog>
  <changelog author="lduncan@suse.com" date="1674907206">- scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile (git-fixes).
- scsi: snic: Fix possible UAF in snic_tgt_create() (git-fixes).
- scsi: fcoe: Fix transport not deattached when fcoe_if_init()
  fails (git-fixes).
- scsi: ipr: Fix WARNING in ipr_init() (git-fixes).
- scsi: scsi_debug: Fix possible name leak in
  sdebug_add_host_helper() (git-fixes).
- scsi: fcoe: Fix possible name leak when device_register()
  fails (git-fixes).
- scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
  (git-fixes).
- scsi: hpsa: Fix error handling in hpsa_add_sas_host()
  (git-fixes).
- scsi: mpt3sas: Fix possible resource leaks in
  mpt3sas_transport_port_add() (git-fixes).
- scsi: hpsa: Fix possible memory leak in hpsa_init_one()
  (git-fixes).
- scsi: scsi_debug: Fix a warning in resp_write_scat()
  (git-fixes).
- scsi: core: Fix a race between scsi_done() and scsi_timeout()
  (git-fixes).
- scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
  (git-fixes).
- scsi: core: Restrict legal sdev_state transitions via sysfs
  (git-fixes).
- scsi: 3w-9xxx: Avoid disabling device if failing to enable it
  (git-fixes).
- scsi: qedf: Fix a UAF bug in __qedf_probe() (git-fixes).
- scsi: megaraid_sas: Fix double kfree() (git-fixes).
- scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
  (git-fixes).
- commit 25cb1e4</changelog>
  <changelog author="mhocko@suse.com" date="1675080000">- mm: /proc/pid/smaps_rollup: fix no vma's null-deref
  (bsc#1207769).
- commit be9727c</changelog>
  <changelog author="msuchanek@suse.de" date="1675166400">- config.conf: Drop armv7l, Leap 15.3 is EOL.
- Delete config/armv7hl/default.
- Delete config/armv7hl/lpae.
- commit 022c807</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1675771200">- libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
  (bsc#1204502 CVE-2022-3606).
- commit eef9e8d</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771201">- RDMA/core: Fix ib block iterator counter overflow (bsc#1207878).
- commit 64f6682</changelog>
  <changelog author="tabraham@suse.com" date="1675771202">- watchdog: diag288_wdt: fix __diag288() inline assembly
  (bsc#1207497).
- commit 2f246cf</changelog>
  <changelog author="tabraham@suse.com" date="1675771203">- watchdog: diag288_wdt: do not use stack buffers for hardware
  data (bsc#1207497).
- commit f31eb64</changelog>
</package>
<package pkgid="91e6bc95200e9b205303c93328db60ca66852bfa030586802b949b08ece806dc" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.112.1"/>
  <changelog author="lduncan@suse.com" date="1674648000">- scsi: ufs: Improve interrupt handling for shared interrupts
  (git-fixes).
- scsi: ufs: Fix interrupt error message for shared interrupts
  (git-fixes).
- scsi: ufs: Fix possible infinite loop in ufshcd_hold
  (git-fixes).
- scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
  (git-fixes).
- scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
  (git-fixes).
- scsi: scsi_transport_spi: Fix function pointer check
  (git-fixes).
- scsi: sr: Fix sr_probe() missing deallocate of device minor
  (git-fixes).
- scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
  (git-fixes).
- scsi: hisi_sas: Do not reset phy timer to wait for stray phy up
  (git-fixes).
- scsi: cxlflash: Fix error return code in cxlflash_probe()
  (git-fixes).
- scsi: core: free sgtables in case command setup fails
  (git-fixes).
- scsi: pm: Balance pm_only counter of request queue during
  system resume (git-fixes).
- scsi: iscsi: Report unbind session event when the target has
  been removed (git-fixes).
- scsi: iscsi: Don't destroy session if there are outstanding
  connections (git-fixes).
- scsi: ufs: Fix a race condition in the tracing code (git-fixes).
- scsi: ufs: Make ufshcd_add_command_trace() easier to read
  (git-fixes).
- scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
  (git-fixes).
- scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
  (git-fixes).
- scsi: iscsi: Don't send data to unbound connection (git-fixes).
- scsi: NCR5380: Add disconnect_mask module parameter (git-fixes).
- scsi: scsi_debug: num_tgts must be &gt;= 0 (git-fixes).
- scsi: ufs: Fix error handing during hibern8 enter (git-fixes).
- scsi: ufs: Fix irq return code (git-fixes).
- scsi: ufs: Fix up auto hibern8 enablement (git-fixes).
- scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of
  SG_NONE (git-fixes).
- scsi: ufs: fix potential bug which ends in system hang
  (git-fixes).
- scsi: hisi_sas: Check sas_port before using it (git-fixes).
- scsi: fnic: fix use after free (git-fixes).
- scsi: ufs: delete redundant function ufshcd_def_desc_sizes()
  (git-fixes).
- scsi: hisi_sas: Delete the debugfs folder of hisi_sas when
  the probe fails (git-fixes).
- commit e77b62a</changelog>
  <changelog author="tabraham@suse.com" date="1674648001">- KVM: VMX: fix crash cleanup when KVM wasn't used (bsc#1207508).
- Refresh
  patches.suse/KVM-x86-speculation-Disable-Fill-buffer-clear-within-guests.patch.
- commit 8d5e108</changelog>
  <changelog author="lduncan@suse.com" date="1674734400">- scsi: ufs: Clean up completed request without interrupt
  notification (git-fixes).
- Refresh
  patches.suse/scsi-ufs-Properly-release-resources-if-a-task-is-aborted-successfully.
- commit 0e26434</changelog>
  <changelog author="mkubecek@suse.cz" date="1674734401">- sctp: fail if no bound addresses can be used for a given scope
  (bsc#1206677).
- commit dcee4fd</changelog>
  <changelog author="lduncan@suse.com" date="1674734402">- scsi: ufs: Make sure clk scaling happens only when HBA is
  runtime ACTIVE (git-fixes).
- scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by
  ufshcd_hold() (git-fixes).
- scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
  (git-fixes).
- scsi: hpsa: Fix memory leak in hpsa_init_one() (git-fixes).
- scsi: core: Don't start concurrent async scan on same host
  (git-fixes).
- scsi: mvumi: Fix error return in mvumi_io_attach() (git-fixes).
- scsi: qedf: Return SUCCESS if stale rport is encountered
  (git-fixes).
- scsi: qedi: Protect active command list to avoid list corruption
  (git-fixes).
- scsi: qedi: Fix list_del corruption while removing active I/O
  (git-fixes).
- scsi: ufs: ufs-qcom: Fix race conditions caused by
  ufs_qcom_testbus_config() (git-fixes).
- commit 0335e79</changelog>
  <changelog author="lduncan@suse.com" date="1674820800">- scsi: pmcraid: Fix missing resource cleanup in error case
  (git-fixes).
- scsi: ipr: Fix missing/incorrect resource cleanup in error case
  (git-fixes).
- scsi: vmw_pvscsi: Expand vcpuHint to 16 bits (git-fixes).
- scsi: myrb: Fix up null pointer access on myrb_cleanup()
  (git-fixes).
- scsi: megaraid: Fix error check return value of
  register_chrdev() (git-fixes).
- scsi: qedi: Fix failed disconnect handling (git-fixes).
- scsi: megaraid_sas: Target with invalid LUN ID is deleted
  during scan (git-fixes).
- scsi: mvsas: Add PCI ID of RocketRaid 2640 (git-fixes).
- scsi: libfc: Fix use after free in fc_exch_abts_resp()
  (git-fixes).
- scsi: aha152x: Fix aha152x_setup() __setup handler return value
  (git-fixes).
- scsi: pm8001: Fix pm8001_mpi_task_abort_resp() (git-fixes).
- scsi: bfa: Replace snprintf() with sysfs_emit() (git-fixes).
- scsi: mvsas: Replace snprintf() with sysfs_emit() (git-fixes).
- scsi: myrs: Fix crash in error case (git-fixes).
- scsi: qedf: Fix refcount issue when LOGO is received during TMF
  (git-fixes).
- scsi: sr: Don't use GFP_DMA (git-fixes).
- scsi: vmw_pvscsi: Set residual data length conditionally
  (git-fixes).
- scsi: libiscsi: Fix UAF in
  iscsi_conn_get_param()/iscsi_conn_teardown() (git-fixes).
- scsi: core: sysfs: Fix setting device state to SDEV_RUNNING
  (git-fixes).
- scsi: core: sysfs: Fix hang when device state is set via sysfs
  (git-fixes).
- scsi: iscsi: Unblock session then wake up error handler
  (git-fixes).
- scsi: advansys: Fix kernel pointer leak (git-fixes).
- scsi: core: Fix shost-&gt;cmd_per_lun calculation in
  scsi_add_host_with_dma() (git-fixes).
- scsi: virtio_scsi: Fix spelling mistake "Unsupport" -&gt;
  "Unsupported" (git-fixes).
- scsi: ses: Fix unsigned comparison with less than zero
  (git-fixes).
- scsi: ufs: Fix illegal offset in UPIU event trace (git-fixes).
- scsi: ses: Retry failed Send/Receive Diagnostic commands
  (git-fixes).
- scsi: sd: Free scsi_disk device via put_device() (git-fixes).
- scsi: core: Fix hang of freezing queue between blocking and
  running device (git-fixes).
- scsi: core: Fix capacity set to zero after offlinining device
  (git-fixes).
- scsi: sr: Return correct event when media event code is 3
  (git-fixes).
- scsi: core: Avoid printing an error if target_alloc() returns
  - ENXIO (git-fixes).
- scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
  (git-fixes).
- scsi: megaraid_mm: Fix end of loop tests for
  list_for_each_entry() (git-fixes).
- scsi: qedf: Add check to synchronize abort and flush
  (git-fixes).
- scsi: libsas: Add LUN number check in .slave_alloc callback
  (git-fixes).
- scsi: aic7xxx: Fix unintentional sign extension issue on left
  shift of u8 (git-fixes).
- scsi: scsi_dh_alua: Fix signedness bug in alua_rtpg()
  (git-fixes).
- scsi: scsi_dh_alua: Check for negative result value (git-fixes).
- scsi: qedi: Fix null ref during abort handling (git-fixes).
- scsi: iscsi: Fix shost-&gt;max_id use (git-fixes).
- scsi: iscsi: Add iscsi_cls_conn refcount helpers (git-fixes).
- scsi: megaraid_sas: Handle missing interrupts while re-enabling
  IRQs (git-fixes).
- scsi: megaraid_sas: Early detection of VD deletion through
  RaidMap update (git-fixes).
- scsi: megaraid_sas: Fix resource leak in case of probe failure
  (git-fixes).
- scsi: core: Cap scsi_host cmd_per_lun at can_queue (git-fixes).
- scsi: hisi_sas: Propagate errors in interrupt_init_v1_hw()
  (git-fixes).
- scsi: sr: Return appropriate error code when disk is ejected
  (git-fixes).
- scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated
  irq (git-fixes).
- scsi: vmw_pvscsi: Set correct residual data length (git-fixes).
- scsi: bnx2fc: Return failure if io_req is already in ABTS
  processing (git-fixes).
- scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
  (git-fixes).
- scsi: libfc: Fix a format specifier (git-fixes).
- scsi: mpt3sas: Block PCI config access from userspace during
  reset (git-fixes).
- scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg()
  (git-fixes).
- scsi: st: Fix a use after free in st_open() (git-fixes).
- scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
  (git-fixes).
- scsi: fnic: Fix memleak in vnic_dev_init_devcmd2 (git-fixes).
- scsi: ufs: Fix tm request when non-fatal error happens
  (git-fixes).
- scsi: sd: Suppress spurious errors when WRITE SAME is being
  disabled (git-fixes).
- scsi: scsi_transport_spi: Set RQF_PM for domain validation
  commands (git-fixes).
- scsi: ufs-pci: Ensure UFS device is in PowerDown mode for
  suspend-to-disk -&gt;poweroff() (git-fixes).
- scsi: ufs: Fix wrong print message in dev_err() (git-fixes).
- scsi: mpt3sas: Increase IOCInit request timeout to 30s
  (git-fixes).
- commit cf6a959</changelog>
  <changelog author="lduncan@suse.com" date="1674820801">- blacklist.conf: removing SCSI git-fix mistakenly added
  This fix was labelled as already present in our
  code base, but it was not.
- commit bcd8cfe</changelog>
  <changelog author="colyli@suse.de" date="1674907200">- blacklist.conf: add git-fixes commits which won't be backported
- commit 4601d33</changelog>
  <changelog author="colyli@suse.de" date="1674907201">- rbd: work around -Wuninitialized warning (git-fixes).
- Refresh for the above change,
  patches.suse/rbd-export-some-functions-used-by-lio-rbd-backend.patch.
- commit e923159</changelog>
  <changelog author="colyli@suse.de" date="1674907202">- dm space maps: don't reset space map allocation cursor when
  committing (git-fixes).
- dm verity: fix require_signatures module_param permissions
  (git-fixes).
- dm integrity: fix flush with external metadata device
  (git-fixes).
- dm integrity: select CRYPTO_SKCIPHER (git-fixes).
- dm verity: skip verity work if I/O error when system is shutting
  down (git-fixes).
- dm table: Remove BUG_ON(in_interrupt()) (git-fixes).
- nbd: make the config put is called before the notifying the
  waiter (git-fixes).
- nbd: restore default timeout when setting it to zero
  (git-fixes).
- loop: unset GENHD_FL_NO_PART_SCAN on LOOP_CONFIGURE (git-fixes).
- blktrace: ensure our debugfs dir exists (git-fixes).
- commit 50ca764</changelog>
  <changelog author="colyli@suse.de" date="1674907203">- nbd: fix max value for 'first_minor' (git-fixes).
- Refresh for the above change,
  patches.suse/0012-nbd-fix-possible-overflow-for-first_minor-in-nbd_dev.patch.
- commit dd126a5</changelog>
  <changelog author="colyli@suse.de" date="1674907204">- nbd: Fix incorrect error handle when first_minor is illegal
  in nbd_dev_add (git-fixes).
- Refresh for the above change,
  patches.suse/0019-nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_.patch.
- commit 9c00c1c</changelog>
  <changelog author="colyli@suse.de" date="1674907205">- dm thin: Use last transaction's pmd-&gt;root when commit failed
  (git-fixes).
- dm thin: resume even if in FAIL mode (git-fixes).
- dm cache: set needs_check flag after aborting metadata
  (git-fixes).
- dm cache: Fix ABBA deadlock between shrink_slab and
  dm_cache_metadata_abort (git-fixes).
- dm thin: Fix ABBA deadlock between shrink_slab and
  dm_pool_abort_metadata (git-fixes).
- dm integrity: Fix UAF in dm_integrity_dtr() (git-fixes).
- dm cache: Fix UAF in destroy() (git-fixes).
- dm clone: Fix UAF in clone_dtr() (git-fixes).
- dm thin: Fix UAF in run_timer_softirq() (git-fixes).
- blktrace: Fix output non-blktrace event when blk_classic option
  enabled (git-fixes).
- dm integrity: flush the journal on suspend (git-fixes).
- dm ioctl: fix misbehavior if list_versions races with module
  loading (git-fixes).
- md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d (git-fixes).
- bcache: fix set_at_max_writeback_rate() for multiple attached
  devices (git-fixes).
- nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
  (git-fixes).
- md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
- drivers:md:fix a potential use-after-free bug (git-fixes).
- null_blk: fix ida error handling in null_add_dev() (git-fixes).
- md: Notify sysfs sync_completed in md_reap_sync_thread()
  (git-fixes).
- nbd: fix io hung while disconnecting device (git-fixes).
- nbd: fix race between nbd_alloc_config() and module removal
  (git-fixes).
- nbd: call genl_unregister_family() first in nbd_cleanup()
  (git-fixes).
- md: protect md_unregister_thread from reentrancy (git-fixes).
- nbd: Fix hung on disconnect request if socket is closed before
  (git-fixes).
- dm ioctl: prevent potential spectre v1 gadget (git-fixes).
- loop: use sysfs_emit() in the sysfs xxx show() (git-fixes).
- dm space map common: add bounds check to sm_ll_lookup_bitmap()
  (git-fixes).
- dm btree: add a defensive bounds check to insert_at()
  (git-fixes).
- commit 223b9c6</changelog>
  <changelog author="lduncan@suse.com" date="1674907206">- scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile (git-fixes).
- scsi: snic: Fix possible UAF in snic_tgt_create() (git-fixes).
- scsi: fcoe: Fix transport not deattached when fcoe_if_init()
  fails (git-fixes).
- scsi: ipr: Fix WARNING in ipr_init() (git-fixes).
- scsi: scsi_debug: Fix possible name leak in
  sdebug_add_host_helper() (git-fixes).
- scsi: fcoe: Fix possible name leak when device_register()
  fails (git-fixes).
- scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
  (git-fixes).
- scsi: hpsa: Fix error handling in hpsa_add_sas_host()
  (git-fixes).
- scsi: mpt3sas: Fix possible resource leaks in
  mpt3sas_transport_port_add() (git-fixes).
- scsi: hpsa: Fix possible memory leak in hpsa_init_one()
  (git-fixes).
- scsi: scsi_debug: Fix a warning in resp_write_scat()
  (git-fixes).
- scsi: core: Fix a race between scsi_done() and scsi_timeout()
  (git-fixes).
- scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
  (git-fixes).
- scsi: core: Restrict legal sdev_state transitions via sysfs
  (git-fixes).
- scsi: 3w-9xxx: Avoid disabling device if failing to enable it
  (git-fixes).
- scsi: qedf: Fix a UAF bug in __qedf_probe() (git-fixes).
- scsi: megaraid_sas: Fix double kfree() (git-fixes).
- scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
  (git-fixes).
- commit 25cb1e4</changelog>
  <changelog author="mhocko@suse.com" date="1675080000">- mm: /proc/pid/smaps_rollup: fix no vma's null-deref
  (bsc#1207769).
- commit be9727c</changelog>
  <changelog author="msuchanek@suse.de" date="1675166400">- config.conf: Drop armv7l, Leap 15.3 is EOL.
- Delete config/armv7hl/default.
- Delete config/armv7hl/lpae.
- commit 022c807</changelog>
  <changelog author="shung-hsi.yu@suse.com" date="1675771200">- libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
  (bsc#1204502 CVE-2022-3606).
- commit eef9e8d</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1675771201">- RDMA/core: Fix ib block iterator counter overflow (bsc#1207878).
- commit 64f6682</changelog>
  <changelog author="tabraham@suse.com" date="1675771202">- watchdog: diag288_wdt: fix __diag288() inline assembly
  (bsc#1207497).
- commit 2f246cf</changelog>
  <changelog author="tabraham@suse.com" date="1675771203">- watchdog: diag288_wdt: do not use stack buffers for hardware
  data (bsc#1207497).
- commit f31eb64</changelog>
</package>
<package pkgid="833e0c6bd293aea11c09fc851a03fde0a61987ac30c7515d7eec77a218cd716f" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- kvm: fix wrong exception emulation in check_rdtsc (git-fixes).
- commit 5797afc</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: nVMX: Query current VMCS when determining if MSR bitmaps
  are in use (git-fixes).
- commit d008aa3</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862403">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862404">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
</package>
<package pkgid="e8fc9d381de60fc7f0ec22a9341e535b4a6f61800c62eadeab359ad94e0eecc0" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- kvm: fix wrong exception emulation in check_rdtsc (git-fixes).
- commit 5797afc</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: nVMX: Query current VMCS when determining if MSR bitmaps
  are in use (git-fixes).
- commit d008aa3</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862403">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862404">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
</package>
<package pkgid="297490d3d1976d677dff7cc03d4d793cd78e0945c1eeb08239d19be3b21eb639" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- kvm: fix wrong exception emulation in check_rdtsc (git-fixes).
- commit 5797afc</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: nVMX: Query current VMCS when determining if MSR bitmaps
  are in use (git-fixes).
- commit d008aa3</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862403">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862404">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
</package>
<package pkgid="1189a05930473437bf6026bc0d06ebf8511e0fc8c716f5e410ec458e12a3a61a" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Add retbleed=ibpb (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 0636a43</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022406">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022411">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022413">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022415">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="d877793ed83dc1dfb69867984cf3816b69c3ee0767be49e2e5f68263886c4eb7" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Add retbleed=ibpb (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 0636a43</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022406">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022411">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022413">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022415">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="c2055d0d7767a073780c76efdf1b1f81e43ab82b4bff7cc238b49a0a4db8e56f" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Add retbleed=ibpb (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 0636a43</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022406">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022411">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022413">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022415">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="b849130733416bf4ce2654a7acf7fc4d4b20bfd935ea77b8488a2fc05bc372fd" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022404">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022405">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022409">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
  <changelog author="bp@suse.de" date="1658318400">- x86/entry: Remove skip_r11rcx (bsc#1201644).
- Refresh
  patches.suse/x86-entry-Add-kernel-IBRS-implementation.patch.
- commit b81e242</changelog>
  <changelog author="bp@suse.de" date="1658318401">- Refresh
  patches.suse/x86-bugs-Do-not-enable-IBPB-on-entry-when-IBPB-is-not-supp.patch.
- commit 9493568</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1658404800">-  Fix 1201644, 1201664, 1201672, 1201673, 1201676
  All are reports of the same problem - the IBRS_* regs push/popping was
  wrong but it needs
  1b331eeea7b8 ("x86/entry: Remove skip_r11rcx")
  too.
- commit cc90276</changelog>
</package>
<package pkgid="e7d8f8c88cedf0f6b1e2c397c304c244102963cae52b887d4c28dddd269b79f5" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022404">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022405">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022409">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
  <changelog author="bp@suse.de" date="1658318400">- x86/entry: Remove skip_r11rcx (bsc#1201644).
- Refresh
  patches.suse/x86-entry-Add-kernel-IBRS-implementation.patch.
- commit b81e242</changelog>
  <changelog author="bp@suse.de" date="1658318401">- Refresh
  patches.suse/x86-bugs-Do-not-enable-IBPB-on-entry-when-IBPB-is-not-supp.patch.
- commit 9493568</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1658404800">-  Fix 1201644, 1201664, 1201672, 1201673, 1201676
  All are reports of the same problem - the IBRS_* regs push/popping was
  wrong but it needs
  1b331eeea7b8 ("x86/entry: Remove skip_r11rcx")
  too.
- commit cc90276</changelog>
</package>
<package pkgid="7aa239f4d1633748448076f3bf9877e4b103ffb2e0b89862a31c8646821255cb" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022404">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022405">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022409">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022412">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
  <changelog author="bp@suse.de" date="1658318400">- x86/entry: Remove skip_r11rcx (bsc#1201644).
- Refresh
  patches.suse/x86-entry-Add-kernel-IBRS-implementation.patch.
- commit b81e242</changelog>
  <changelog author="bp@suse.de" date="1658318401">- Refresh
  patches.suse/x86-bugs-Do-not-enable-IBPB-on-entry-when-IBPB-is-not-supp.patch.
- commit 9493568</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1658404800">-  Fix 1201644, 1201664, 1201672, 1201673, 1201676
  All are reports of the same problem - the IBRS_* regs push/popping was
  wrong but it needs
  1b331eeea7b8 ("x86/entry: Remove skip_r11rcx")
  too.
- commit cc90276</changelog>
</package>
<package pkgid="90b85893fa51bb61d40ae7de7cfc610ade2409799c15bb543e5b3d5673e25035" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.90.1"/>
  <changelog author="mgorman@suse.de" date="1659528000">- blacklist.conf: GCC-12 not used
- commit b35581e</changelog>
  <changelog author="mgorman@suse.de" date="1659528001">- blacklist.conf: Cosmetic patch
- commit 137482b</changelog>
  <changelog author="mgorman@suse.de" date="1659528002">- blacklist.conf: UML not used
- commit d38c3c3</changelog>
  <changelog author="mgorman@suse.de" date="1659528003">- blacklist.conf: xtensa not used
- commit c7e553d</changelog>
  <changelog author="mgorman@suse.de" date="1659528004">- sched/fair: Revise comment about lb decision matrix (git fixes
  (sched/fair)).
- tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
  (git fixes (kernel/time)).
- random: remove useless header comment (git fixes).
- profiling: fix shift-out-of-bounds bugs (git fixes).
- sched/membarrier: fix missing local execution of
  ipi_sync_rq_state() (git fixes (sched/membarrier)).
- mm: fix page reference leak in soft_offline_page() (git fixes
  (mm/memory-failure)).
- commit b0029fe</changelog>
  <changelog author="oneukum@suse.com" date="1659528005">- media: smipcie: fix interrupt handling and IR timeout
  (git-fixes).
- commit 72251a4</changelog>
  <changelog author="iivanov@suse.de" date="1659528006">- Revert "Refresh patches.suse/random-fix-crash-on-multiple-early-calls..." (bsc#1201645)
  This reverts commit f01d1a85f6c5334e324db629b3d43a8be5461b46.
- commit ef555c8</changelog>
  <changelog author="fweisbecker@suse.de" date="1659528007">- blacklist.conf: add "sched: Reenable interrupts in do_sched_yield()"
  This patch caused unexplained regressions and it's not fixing any
  important issue.
- commit 7b4ecae</changelog>
  <changelog author="mkubecek@suse.cz" date="1659528008">- ipv4: avoid using shared IP generator for connected sockets
  (CVE-2020-36516 bsc#1196616).
- ipv4: tcp: send zero IPID in SYNACK messages (CVE-2020-36516
  bsc#1196616).
- commit 6c53c05</changelog>
  <changelog author="tiwai@suse.de" date="1659614400">- drm/bridge: tc358767: Make sure Refclk clock are enabled
  (git-fixes).
- Bluetooth: hci_intel: Add check for platform_driver_register
  (git-fixes).
- can: error: specify the values of data[5..7] of CAN error frames
  (git-fixes).
- can: usb_8dev: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: kvaser_usb_leaf: do not report txerr and rxerr during
  bus-off (git-fixes).
- can: kvaser_usb_hydra: do not report txerr and rxerr during
  bus-off (git-fixes).
- can: sun4i_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: hi311x: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: sja1000: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: rcar_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: pch_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- ath10k: do not enforce interrupt trigger type (git-fixes).
- can: Break loopback loop on loopback documentation (git-fixes).
- ACPI: video: Shortening quirk list by identifying Clevo by
  board_name only (git-fixes).
- ACPI: APEI: Better fix to avoid spamming the console with old
  error logs (git-fixes).
- bus: hisi_lpc: fix missing platform_device_put() in
  hisi_lpc_acpi_probe() (git-fixes).
- ACPI: CPPC: Do not prevent CPPC from working in the future
  (git-fixes).
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
  (git-fixes).
- ath10k: Fix error handling in ath10k_setup_msa_resources
  (git-fixes).
- commit 6ee2d65</changelog>
  <changelog author="tiwai@suse.de" date="1659614401">- drm/amd/display: Enable building new display engine with KCOV
  enabled (git-fixes).
- drm/exynos/exynos7_drm_decon: free resources when
  clk_set_parent() failed (git-fixes).
- drm/msm/mdp5: Fix global state lock backoff (git-fixes).
- drm/msm/hdmi: enable core-vcc/core-vdda-supply for 8996 platform
  (git-fixes).
- drm/mediatek: dpi: Only enable dpi after the bridge is enabled
  (git-fixes).
- drm/mediatek: dpi: Remove output format of YUV (git-fixes).
- drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff
  function (git-fixes).
- drm: bridge: sii8620: fix possible off-by-one (git-fixes).
- drm/rockchip: Fix an error handling path rockchip_dp_probe()
  (git-fixes).
- drm/rockchip: vop: Don't crash for invalid duplicate_state()
  (git-fixes).
- drm/radeon: fix incorrrect SPDX-License-Identifiers (git-fixes).
- drm/radeon: fix potential buffer overflow in
  ni_set_mc_special_registers() (git-fixes).
- drm/vc4: hdmi: Correct HDMI timing registers for interlaced
  modes (git-fixes).
- drm/vc4: hdmi: Fix timings for interlaced modes (git-fixes).
- drm/vc4: dsi: Add correct stop condition to
  vc4_dsi_encoder_disable iteration (git-fixes).
- drm/vc4: dsi: Correct pixel order for DSI0 (git-fixes).
- drm/vc4: dsi: Correct DSI divider calculations (git-fixes).
- drm/vc4: plane: Fix margin calculations for the right/bottom
  edges (git-fixes).
- drm/vc4: plane: Remove subpixel positioning check (git-fixes).
- drm/doc: Fix comment typo (git-fixes).
- drm/mcde: Fix refcount leak in mcde_dsi_bind (git-fixes).
- drm: bridge: adv7511: Add check for mipi_dsi_driver_register
  (git-fixes).
- drm: adv7511: override i2c address of cec before accessing it
  (git-fixes).
- drm/nouveau: fix another off-by-one in nvbios_addr (git-fixes).
- drm/mipi-dbi: align max_chunk to 2 in spi_transfer (git-fixes).
- drm/st7735r: Fix module autoloading for Okaya RH128128T
  (git-fixes).
- i2c: mux-gpmux: Add of_node_put() when breaking out of loop
  (git-fixes).
- i2c: cadence: Support PEC for SMBus block read (git-fixes).
- i2c: Fix a potential use after free (git-fixes).
- commit cce0615</changelog>
  <changelog author="tiwai@suse.de" date="1659614402">- virtio-gpu: fix a missing check to avoid NULL dereference
  (git-fixes).
- media: hdpvr: fix error value returns in hdpvr_read (git-fixes).
- media: tw686x: Register the irq at the end of probe (git-fixes).
- wifi: wil6210: debugfs: fix uninitialized variable use in
  `wil_write_file_wmi()` (git-fixes).
- wifi: libertas: Fix possible refcount leak in if_usb_probe()
  (git-fixes).
- wifi: iwlwifi: mvm: fix double list_add at
  iwl_mvm_mac_wake_tx_queue (git-fixes).
- wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
  (git-fixes).
- wifi: p54: add missing parentheses in p54_flush() (git-fixes).
- wifi: p54: Fix an error handling path in p54spi_probe()
  (git-fixes).
- mediatek: mt76: mac80211: Fix missing of_node_put() in
  mt76_led_init() (git-fixes).
- mt76: mt76x02u: fix possible memory leak in
  __mt76x02u_mcu_send_msg (git-fixes).
- can: pch_can: pch_can_error(): initialize errc before using it
  (git-fixes).
- wifi: iwlegacy: 4965: fix potential off-by-one overflow in
  il4965_rs_fill_link_cmd() (git-fixes).
- wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
  (git-fixes).
- thermal/tools/tmon: Include pthread and time headers in tmon.h
  (git-fixes).
- regulator: of: Fix refcount leak bug in
  of_get_regulation_constraints() (git-fixes).
- soc: fsl: guts: machine variable might be unset (git-fixes).
- meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
  (git-fixes).
- virtio-net: fix the race between refill work and close
  (git-fixes).
- mt7601u: add USB device ID for some versions of XiaoDu WiFi
  Dongle (git-fixes).
- commit 347666b</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659614403">- blacklist.conf: update blacklist
- commit 847721e</changelog>
  <changelog author="tiwai@suse.de" date="1659700800">- openvswitch: fix OOB access in reserve_sfa_size() (CVE-2022-2639
  bsc#1202154).
- commit bfc6551</changelog>
  <changelog author="tiwai@suse.de" date="1659700801">- clk: qcom: camcc-sdm845: Fix topology around titan_top power
  domain (git-fixes).
- clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
  (git-fixes).
- clk: qcom: ipq8074: fix NSS port frequency tables (git-fixes).
- clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
  (git-fixes).
- clk: qcom: ipq8074: fix NSS core PLL-s (git-fixes).
- clk: qcom: clk-krait: unlock spin after mux completion
  (git-fixes).
- clk: renesas: r9a06g032: Fix UART clkgrp bitsel (git-fixes).
- gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
  (git-fixes).
- HID: cp2112: prevent a buffer overflow in cp2112_xfer()
  (git-fixes).
- driver core: fix potential deadlock in __driver_attach
  (git-fixes).
- iio: amplifiers: ad8366: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-tlc4541: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8688: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8344: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads7950: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads124s08: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc161s626: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc128s052: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc12138: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-adc084s021: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc0832: Fix alignment for DMA safety (git-fixes).
- iio: adc: mcp320x: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1118: Fix alignment for DMA safety (git-fixes).
- iio: adc: max11100: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1027: Fix alignment for DMA safety (git-fixes).
- iio: adc: ltc2497: Fix alignment for DMA safety (git-fixes).
- iio: adc: hi8435: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7887: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7768-1: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7766: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7476: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7298: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7266: Fix alignment for DMA safety (git-fixes).
- iio: accel: sca3000: Fix alignment for DMA safety (git-fixes).
- iio: accel: bma220: Fix alignment for DMA safety (git-fixes).
- iio: core: Fix IIO_ALIGN and rename as it was not sufficiently
  large (git-fixes).
- fpga: altera-pr-ip: fix unsigned comparison with less than zero
  (git-fixes).
- commit 9bda156</changelog>
  <changelog author="tiwai@suse.de" date="1659700802">- iio: potentiometer: mcp4131: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: mcp41010: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: max5481: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: ad5272: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: fxas210002c: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: adxrs450: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16130: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16080: Fix alignment for DMA safety (git-fixes).
- iio: frequency: adf4371: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: adf4350: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: ad9523: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: ti-dac7612: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac7311: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac5571: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac082s085: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: mcp4922: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad8801: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad7303: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5791: Fix alignment for DMA saftey (git-fixes).
- iio: dac: ad5764: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5761: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5755: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5504: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5449: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5421: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5360: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5064: Fix alignment for DMA safety (git-fixes).
- commit 7981ef6</changelog>
  <changelog author="tiwai@suse.de" date="1659700803">- mmc: cavium-thunderx: Add of_node_put() when breaking out of
  loop (git-fixes).
- mmc: cavium-octeon: Add of_node_put() when breaking out of loop
  (git-fixes).
- mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
  (git-fixes).
- memstick/ms_block: Fix a memory leak (git-fixes).
- memstick/ms_block: Fix some incorrect memory allocation
  (git-fixes).
- mmc: sdhci-of-esdhc: Fix refcount leak in
  esdhc_signal_voltage_switch (git-fixes).
- PCI: tegra194: Fix link up retry sequence (git-fixes).
- PCI: tegra194: Fix Root Port interrupt handling (git-fixes).
- PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
  (git-fixes).
- PCI: qcom: Power on PHY before IPQ8074 DBI register accesses
  (git-fixes).
- PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
  (git-fixes).
- PCI: dwc: Always enable CDM check if "snps,enable-cdm-check"
  exists (git-fixes).
- PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
  (git-fixes).
- PCI: dwc: Disable outbound windows only for controllers using
  iATU (git-fixes).
- PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
  (git-fixes).
- PCI: dwc: Stop link on host_init errors and de-initialization
  (git-fixes).
- PCI/portdrv: Don't disable AER reporting in
  get_port_device_capability() (git-fixes).
- platform/olpc: Fix uninitialized data in debugfs write
  (git-fixes).
- USB: Follow-up to SPDX identifiers addition - remove now
  useless comments (git-fixes).
- staging: rtl8192u: Fix sleep in atomic context bug in
  dm_fsync_timer_callback (git-fixes).
- usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command
  completion (git-fixes).
- USB: serial: fix tty-port initialized comments (git-fixes).
- usb: gadget: udc: amd5536 depends on HAS_DMA (git-fixes).
- usb: host: xhci: use snprintf() in xhci_decode_trb()
  (git-fixes).
- usb: xhci: tegra: Fix error check (git-fixes).
- usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
  (git-fixes).
- usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
  (git-fixes).
- iio: light: isl29028: Fix the warning in isl29028_remove()
  (git-fixes).
- soundwire: bus_type: fix remove and shutdown support
  (git-fixes).
- iio: resolver: ad2s90: Fix alignment for DMA safety (git-fixes).
- iio: resolver: ad2s1200: Fix alignment for DMA safety
  (git-fixes).
- iio: proximity: as3935: Fix alignment for DMA safety
  (git-fixes).
- intel_th: msu: Fix vmalloced buffers (git-fixes).
- intel_th: msu-sink: Potential dereference of null pointer
  (git-fixes).
- intel_th: Fix a resource leak in an error handling path
  (git-fixes).
- misc: rtsx: Fix an error handling path in rtsx_pci_probe()
  (git-fixes).
- commit 2bc728a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659787200">- blacklist.conf: update blacklist
- commit cc1d04f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659960000">- blacklist.conf: update blacklist
- commit 63fa2f9</changelog>
  <changelog author="iivanov@suse.de" date="1659960001">- KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
- commit ec6a677</changelog>
</package>
<package pkgid="9b8dd779efc099d5e7149a8d021ca7bb7dde2320dcff2d1d561e189daff3c8d6" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.90.1"/>
  <changelog author="mgorman@suse.de" date="1659528000">- blacklist.conf: GCC-12 not used
- commit b35581e</changelog>
  <changelog author="mgorman@suse.de" date="1659528001">- blacklist.conf: Cosmetic patch
- commit 137482b</changelog>
  <changelog author="mgorman@suse.de" date="1659528002">- blacklist.conf: UML not used
- commit d38c3c3</changelog>
  <changelog author="mgorman@suse.de" date="1659528003">- blacklist.conf: xtensa not used
- commit c7e553d</changelog>
  <changelog author="mgorman@suse.de" date="1659528004">- sched/fair: Revise comment about lb decision matrix (git fixes
  (sched/fair)).
- tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
  (git fixes (kernel/time)).
- random: remove useless header comment (git fixes).
- profiling: fix shift-out-of-bounds bugs (git fixes).
- sched/membarrier: fix missing local execution of
  ipi_sync_rq_state() (git fixes (sched/membarrier)).
- mm: fix page reference leak in soft_offline_page() (git fixes
  (mm/memory-failure)).
- commit b0029fe</changelog>
  <changelog author="oneukum@suse.com" date="1659528005">- media: smipcie: fix interrupt handling and IR timeout
  (git-fixes).
- commit 72251a4</changelog>
  <changelog author="iivanov@suse.de" date="1659528006">- Revert "Refresh patches.suse/random-fix-crash-on-multiple-early-calls..." (bsc#1201645)
  This reverts commit f01d1a85f6c5334e324db629b3d43a8be5461b46.
- commit ef555c8</changelog>
  <changelog author="fweisbecker@suse.de" date="1659528007">- blacklist.conf: add "sched: Reenable interrupts in do_sched_yield()"
  This patch caused unexplained regressions and it's not fixing any
  important issue.
- commit 7b4ecae</changelog>
  <changelog author="mkubecek@suse.cz" date="1659528008">- ipv4: avoid using shared IP generator for connected sockets
  (CVE-2020-36516 bsc#1196616).
- ipv4: tcp: send zero IPID in SYNACK messages (CVE-2020-36516
  bsc#1196616).
- commit 6c53c05</changelog>
  <changelog author="tiwai@suse.de" date="1659614400">- drm/bridge: tc358767: Make sure Refclk clock are enabled
  (git-fixes).
- Bluetooth: hci_intel: Add check for platform_driver_register
  (git-fixes).
- can: error: specify the values of data[5..7] of CAN error frames
  (git-fixes).
- can: usb_8dev: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: kvaser_usb_leaf: do not report txerr and rxerr during
  bus-off (git-fixes).
- can: kvaser_usb_hydra: do not report txerr and rxerr during
  bus-off (git-fixes).
- can: sun4i_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: hi311x: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: sja1000: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: rcar_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: pch_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- ath10k: do not enforce interrupt trigger type (git-fixes).
- can: Break loopback loop on loopback documentation (git-fixes).
- ACPI: video: Shortening quirk list by identifying Clevo by
  board_name only (git-fixes).
- ACPI: APEI: Better fix to avoid spamming the console with old
  error logs (git-fixes).
- bus: hisi_lpc: fix missing platform_device_put() in
  hisi_lpc_acpi_probe() (git-fixes).
- ACPI: CPPC: Do not prevent CPPC from working in the future
  (git-fixes).
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
  (git-fixes).
- ath10k: Fix error handling in ath10k_setup_msa_resources
  (git-fixes).
- commit 6ee2d65</changelog>
  <changelog author="tiwai@suse.de" date="1659614401">- drm/amd/display: Enable building new display engine with KCOV
  enabled (git-fixes).
- drm/exynos/exynos7_drm_decon: free resources when
  clk_set_parent() failed (git-fixes).
- drm/msm/mdp5: Fix global state lock backoff (git-fixes).
- drm/msm/hdmi: enable core-vcc/core-vdda-supply for 8996 platform
  (git-fixes).
- drm/mediatek: dpi: Only enable dpi after the bridge is enabled
  (git-fixes).
- drm/mediatek: dpi: Remove output format of YUV (git-fixes).
- drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff
  function (git-fixes).
- drm: bridge: sii8620: fix possible off-by-one (git-fixes).
- drm/rockchip: Fix an error handling path rockchip_dp_probe()
  (git-fixes).
- drm/rockchip: vop: Don't crash for invalid duplicate_state()
  (git-fixes).
- drm/radeon: fix incorrrect SPDX-License-Identifiers (git-fixes).
- drm/radeon: fix potential buffer overflow in
  ni_set_mc_special_registers() (git-fixes).
- drm/vc4: hdmi: Correct HDMI timing registers for interlaced
  modes (git-fixes).
- drm/vc4: hdmi: Fix timings for interlaced modes (git-fixes).
- drm/vc4: dsi: Add correct stop condition to
  vc4_dsi_encoder_disable iteration (git-fixes).
- drm/vc4: dsi: Correct pixel order for DSI0 (git-fixes).
- drm/vc4: dsi: Correct DSI divider calculations (git-fixes).
- drm/vc4: plane: Fix margin calculations for the right/bottom
  edges (git-fixes).
- drm/vc4: plane: Remove subpixel positioning check (git-fixes).
- drm/doc: Fix comment typo (git-fixes).
- drm/mcde: Fix refcount leak in mcde_dsi_bind (git-fixes).
- drm: bridge: adv7511: Add check for mipi_dsi_driver_register
  (git-fixes).
- drm: adv7511: override i2c address of cec before accessing it
  (git-fixes).
- drm/nouveau: fix another off-by-one in nvbios_addr (git-fixes).
- drm/mipi-dbi: align max_chunk to 2 in spi_transfer (git-fixes).
- drm/st7735r: Fix module autoloading for Okaya RH128128T
  (git-fixes).
- i2c: mux-gpmux: Add of_node_put() when breaking out of loop
  (git-fixes).
- i2c: cadence: Support PEC for SMBus block read (git-fixes).
- i2c: Fix a potential use after free (git-fixes).
- commit cce0615</changelog>
  <changelog author="tiwai@suse.de" date="1659614402">- virtio-gpu: fix a missing check to avoid NULL dereference
  (git-fixes).
- media: hdpvr: fix error value returns in hdpvr_read (git-fixes).
- media: tw686x: Register the irq at the end of probe (git-fixes).
- wifi: wil6210: debugfs: fix uninitialized variable use in
  `wil_write_file_wmi()` (git-fixes).
- wifi: libertas: Fix possible refcount leak in if_usb_probe()
  (git-fixes).
- wifi: iwlwifi: mvm: fix double list_add at
  iwl_mvm_mac_wake_tx_queue (git-fixes).
- wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
  (git-fixes).
- wifi: p54: add missing parentheses in p54_flush() (git-fixes).
- wifi: p54: Fix an error handling path in p54spi_probe()
  (git-fixes).
- mediatek: mt76: mac80211: Fix missing of_node_put() in
  mt76_led_init() (git-fixes).
- mt76: mt76x02u: fix possible memory leak in
  __mt76x02u_mcu_send_msg (git-fixes).
- can: pch_can: pch_can_error(): initialize errc before using it
  (git-fixes).
- wifi: iwlegacy: 4965: fix potential off-by-one overflow in
  il4965_rs_fill_link_cmd() (git-fixes).
- wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
  (git-fixes).
- thermal/tools/tmon: Include pthread and time headers in tmon.h
  (git-fixes).
- regulator: of: Fix refcount leak bug in
  of_get_regulation_constraints() (git-fixes).
- soc: fsl: guts: machine variable might be unset (git-fixes).
- meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
  (git-fixes).
- virtio-net: fix the race between refill work and close
  (git-fixes).
- mt7601u: add USB device ID for some versions of XiaoDu WiFi
  Dongle (git-fixes).
- commit 347666b</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659614403">- blacklist.conf: update blacklist
- commit 847721e</changelog>
  <changelog author="tiwai@suse.de" date="1659700800">- openvswitch: fix OOB access in reserve_sfa_size() (CVE-2022-2639
  bsc#1202154).
- commit bfc6551</changelog>
  <changelog author="tiwai@suse.de" date="1659700801">- clk: qcom: camcc-sdm845: Fix topology around titan_top power
  domain (git-fixes).
- clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
  (git-fixes).
- clk: qcom: ipq8074: fix NSS port frequency tables (git-fixes).
- clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
  (git-fixes).
- clk: qcom: ipq8074: fix NSS core PLL-s (git-fixes).
- clk: qcom: clk-krait: unlock spin after mux completion
  (git-fixes).
- clk: renesas: r9a06g032: Fix UART clkgrp bitsel (git-fixes).
- gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
  (git-fixes).
- HID: cp2112: prevent a buffer overflow in cp2112_xfer()
  (git-fixes).
- driver core: fix potential deadlock in __driver_attach
  (git-fixes).
- iio: amplifiers: ad8366: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-tlc4541: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8688: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8344: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads7950: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads124s08: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc161s626: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc128s052: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc12138: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-adc084s021: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc0832: Fix alignment for DMA safety (git-fixes).
- iio: adc: mcp320x: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1118: Fix alignment for DMA safety (git-fixes).
- iio: adc: max11100: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1027: Fix alignment for DMA safety (git-fixes).
- iio: adc: ltc2497: Fix alignment for DMA safety (git-fixes).
- iio: adc: hi8435: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7887: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7768-1: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7766: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7476: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7298: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7266: Fix alignment for DMA safety (git-fixes).
- iio: accel: sca3000: Fix alignment for DMA safety (git-fixes).
- iio: accel: bma220: Fix alignment for DMA safety (git-fixes).
- iio: core: Fix IIO_ALIGN and rename as it was not sufficiently
  large (git-fixes).
- fpga: altera-pr-ip: fix unsigned comparison with less than zero
  (git-fixes).
- commit 9bda156</changelog>
  <changelog author="tiwai@suse.de" date="1659700802">- iio: potentiometer: mcp4131: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: mcp41010: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: max5481: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: ad5272: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: fxas210002c: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: adxrs450: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16130: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16080: Fix alignment for DMA safety (git-fixes).
- iio: frequency: adf4371: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: adf4350: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: ad9523: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: ti-dac7612: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac7311: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac5571: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac082s085: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: mcp4922: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad8801: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad7303: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5791: Fix alignment for DMA saftey (git-fixes).
- iio: dac: ad5764: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5761: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5755: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5504: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5449: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5421: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5360: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5064: Fix alignment for DMA safety (git-fixes).
- commit 7981ef6</changelog>
  <changelog author="tiwai@suse.de" date="1659700803">- mmc: cavium-thunderx: Add of_node_put() when breaking out of
  loop (git-fixes).
- mmc: cavium-octeon: Add of_node_put() when breaking out of loop
  (git-fixes).
- mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
  (git-fixes).
- memstick/ms_block: Fix a memory leak (git-fixes).
- memstick/ms_block: Fix some incorrect memory allocation
  (git-fixes).
- mmc: sdhci-of-esdhc: Fix refcount leak in
  esdhc_signal_voltage_switch (git-fixes).
- PCI: tegra194: Fix link up retry sequence (git-fixes).
- PCI: tegra194: Fix Root Port interrupt handling (git-fixes).
- PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
  (git-fixes).
- PCI: qcom: Power on PHY before IPQ8074 DBI register accesses
  (git-fixes).
- PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
  (git-fixes).
- PCI: dwc: Always enable CDM check if "snps,enable-cdm-check"
  exists (git-fixes).
- PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
  (git-fixes).
- PCI: dwc: Disable outbound windows only for controllers using
  iATU (git-fixes).
- PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
  (git-fixes).
- PCI: dwc: Stop link on host_init errors and de-initialization
  (git-fixes).
- PCI/portdrv: Don't disable AER reporting in
  get_port_device_capability() (git-fixes).
- platform/olpc: Fix uninitialized data in debugfs write
  (git-fixes).
- USB: Follow-up to SPDX identifiers addition - remove now
  useless comments (git-fixes).
- staging: rtl8192u: Fix sleep in atomic context bug in
  dm_fsync_timer_callback (git-fixes).
- usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command
  completion (git-fixes).
- USB: serial: fix tty-port initialized comments (git-fixes).
- usb: gadget: udc: amd5536 depends on HAS_DMA (git-fixes).
- usb: host: xhci: use snprintf() in xhci_decode_trb()
  (git-fixes).
- usb: xhci: tegra: Fix error check (git-fixes).
- usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
  (git-fixes).
- usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
  (git-fixes).
- iio: light: isl29028: Fix the warning in isl29028_remove()
  (git-fixes).
- soundwire: bus_type: fix remove and shutdown support
  (git-fixes).
- iio: resolver: ad2s90: Fix alignment for DMA safety (git-fixes).
- iio: resolver: ad2s1200: Fix alignment for DMA safety
  (git-fixes).
- iio: proximity: as3935: Fix alignment for DMA safety
  (git-fixes).
- intel_th: msu: Fix vmalloced buffers (git-fixes).
- intel_th: msu-sink: Potential dereference of null pointer
  (git-fixes).
- intel_th: Fix a resource leak in an error handling path
  (git-fixes).
- misc: rtsx: Fix an error handling path in rtsx_pci_probe()
  (git-fixes).
- commit 2bc728a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659787200">- blacklist.conf: update blacklist
- commit cc1d04f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659960000">- blacklist.conf: update blacklist
- commit 63fa2f9</changelog>
  <changelog author="iivanov@suse.de" date="1659960001">- KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
- commit ec6a677</changelog>
</package>
<package pkgid="a5122553716ab1e031cfafefd67e314171bfd226eaf20e9435854663c436d75f" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.90.1"/>
  <changelog author="mgorman@suse.de" date="1659528000">- blacklist.conf: GCC-12 not used
- commit b35581e</changelog>
  <changelog author="mgorman@suse.de" date="1659528001">- blacklist.conf: Cosmetic patch
- commit 137482b</changelog>
  <changelog author="mgorman@suse.de" date="1659528002">- blacklist.conf: UML not used
- commit d38c3c3</changelog>
  <changelog author="mgorman@suse.de" date="1659528003">- blacklist.conf: xtensa not used
- commit c7e553d</changelog>
  <changelog author="mgorman@suse.de" date="1659528004">- sched/fair: Revise comment about lb decision matrix (git fixes
  (sched/fair)).
- tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
  (git fixes (kernel/time)).
- random: remove useless header comment (git fixes).
- profiling: fix shift-out-of-bounds bugs (git fixes).
- sched/membarrier: fix missing local execution of
  ipi_sync_rq_state() (git fixes (sched/membarrier)).
- mm: fix page reference leak in soft_offline_page() (git fixes
  (mm/memory-failure)).
- commit b0029fe</changelog>
  <changelog author="oneukum@suse.com" date="1659528005">- media: smipcie: fix interrupt handling and IR timeout
  (git-fixes).
- commit 72251a4</changelog>
  <changelog author="iivanov@suse.de" date="1659528006">- Revert "Refresh patches.suse/random-fix-crash-on-multiple-early-calls..." (bsc#1201645)
  This reverts commit f01d1a85f6c5334e324db629b3d43a8be5461b46.
- commit ef555c8</changelog>
  <changelog author="fweisbecker@suse.de" date="1659528007">- blacklist.conf: add "sched: Reenable interrupts in do_sched_yield()"
  This patch caused unexplained regressions and it's not fixing any
  important issue.
- commit 7b4ecae</changelog>
  <changelog author="mkubecek@suse.cz" date="1659528008">- ipv4: avoid using shared IP generator for connected sockets
  (CVE-2020-36516 bsc#1196616).
- ipv4: tcp: send zero IPID in SYNACK messages (CVE-2020-36516
  bsc#1196616).
- commit 6c53c05</changelog>
  <changelog author="tiwai@suse.de" date="1659614400">- drm/bridge: tc358767: Make sure Refclk clock are enabled
  (git-fixes).
- Bluetooth: hci_intel: Add check for platform_driver_register
  (git-fixes).
- can: error: specify the values of data[5..7] of CAN error frames
  (git-fixes).
- can: usb_8dev: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: kvaser_usb_leaf: do not report txerr and rxerr during
  bus-off (git-fixes).
- can: kvaser_usb_hydra: do not report txerr and rxerr during
  bus-off (git-fixes).
- can: sun4i_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: hi311x: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: sja1000: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: rcar_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- can: pch_can: do not report txerr and rxerr during bus-off
  (git-fixes).
- ath10k: do not enforce interrupt trigger type (git-fixes).
- can: Break loopback loop on loopback documentation (git-fixes).
- ACPI: video: Shortening quirk list by identifying Clevo by
  board_name only (git-fixes).
- ACPI: APEI: Better fix to avoid spamming the console with old
  error logs (git-fixes).
- bus: hisi_lpc: fix missing platform_device_put() in
  hisi_lpc_acpi_probe() (git-fixes).
- ACPI: CPPC: Do not prevent CPPC from working in the future
  (git-fixes).
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
  (git-fixes).
- ath10k: Fix error handling in ath10k_setup_msa_resources
  (git-fixes).
- commit 6ee2d65</changelog>
  <changelog author="tiwai@suse.de" date="1659614401">- drm/amd/display: Enable building new display engine with KCOV
  enabled (git-fixes).
- drm/exynos/exynos7_drm_decon: free resources when
  clk_set_parent() failed (git-fixes).
- drm/msm/mdp5: Fix global state lock backoff (git-fixes).
- drm/msm/hdmi: enable core-vcc/core-vdda-supply for 8996 platform
  (git-fixes).
- drm/mediatek: dpi: Only enable dpi after the bridge is enabled
  (git-fixes).
- drm/mediatek: dpi: Remove output format of YUV (git-fixes).
- drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff
  function (git-fixes).
- drm: bridge: sii8620: fix possible off-by-one (git-fixes).
- drm/rockchip: Fix an error handling path rockchip_dp_probe()
  (git-fixes).
- drm/rockchip: vop: Don't crash for invalid duplicate_state()
  (git-fixes).
- drm/radeon: fix incorrrect SPDX-License-Identifiers (git-fixes).
- drm/radeon: fix potential buffer overflow in
  ni_set_mc_special_registers() (git-fixes).
- drm/vc4: hdmi: Correct HDMI timing registers for interlaced
  modes (git-fixes).
- drm/vc4: hdmi: Fix timings for interlaced modes (git-fixes).
- drm/vc4: dsi: Add correct stop condition to
  vc4_dsi_encoder_disable iteration (git-fixes).
- drm/vc4: dsi: Correct pixel order for DSI0 (git-fixes).
- drm/vc4: dsi: Correct DSI divider calculations (git-fixes).
- drm/vc4: plane: Fix margin calculations for the right/bottom
  edges (git-fixes).
- drm/vc4: plane: Remove subpixel positioning check (git-fixes).
- drm/doc: Fix comment typo (git-fixes).
- drm/mcde: Fix refcount leak in mcde_dsi_bind (git-fixes).
- drm: bridge: adv7511: Add check for mipi_dsi_driver_register
  (git-fixes).
- drm: adv7511: override i2c address of cec before accessing it
  (git-fixes).
- drm/nouveau: fix another off-by-one in nvbios_addr (git-fixes).
- drm/mipi-dbi: align max_chunk to 2 in spi_transfer (git-fixes).
- drm/st7735r: Fix module autoloading for Okaya RH128128T
  (git-fixes).
- i2c: mux-gpmux: Add of_node_put() when breaking out of loop
  (git-fixes).
- i2c: cadence: Support PEC for SMBus block read (git-fixes).
- i2c: Fix a potential use after free (git-fixes).
- commit cce0615</changelog>
  <changelog author="tiwai@suse.de" date="1659614402">- virtio-gpu: fix a missing check to avoid NULL dereference
  (git-fixes).
- media: hdpvr: fix error value returns in hdpvr_read (git-fixes).
- media: tw686x: Register the irq at the end of probe (git-fixes).
- wifi: wil6210: debugfs: fix uninitialized variable use in
  `wil_write_file_wmi()` (git-fixes).
- wifi: libertas: Fix possible refcount leak in if_usb_probe()
  (git-fixes).
- wifi: iwlwifi: mvm: fix double list_add at
  iwl_mvm_mac_wake_tx_queue (git-fixes).
- wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
  (git-fixes).
- wifi: p54: add missing parentheses in p54_flush() (git-fixes).
- wifi: p54: Fix an error handling path in p54spi_probe()
  (git-fixes).
- mediatek: mt76: mac80211: Fix missing of_node_put() in
  mt76_led_init() (git-fixes).
- mt76: mt76x02u: fix possible memory leak in
  __mt76x02u_mcu_send_msg (git-fixes).
- can: pch_can: pch_can_error(): initialize errc before using it
  (git-fixes).
- wifi: iwlegacy: 4965: fix potential off-by-one overflow in
  il4965_rs_fill_link_cmd() (git-fixes).
- wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c()
  (git-fixes).
- thermal/tools/tmon: Include pthread and time headers in tmon.h
  (git-fixes).
- regulator: of: Fix refcount leak bug in
  of_get_regulation_constraints() (git-fixes).
- soc: fsl: guts: machine variable might be unset (git-fixes).
- meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init
  (git-fixes).
- virtio-net: fix the race between refill work and close
  (git-fixes).
- mt7601u: add USB device ID for some versions of XiaoDu WiFi
  Dongle (git-fixes).
- commit 347666b</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659614403">- blacklist.conf: update blacklist
- commit 847721e</changelog>
  <changelog author="tiwai@suse.de" date="1659700800">- openvswitch: fix OOB access in reserve_sfa_size() (CVE-2022-2639
  bsc#1202154).
- commit bfc6551</changelog>
  <changelog author="tiwai@suse.de" date="1659700801">- clk: qcom: camcc-sdm845: Fix topology around titan_top power
  domain (git-fixes).
- clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
  (git-fixes).
- clk: qcom: ipq8074: fix NSS port frequency tables (git-fixes).
- clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
  (git-fixes).
- clk: qcom: ipq8074: fix NSS core PLL-s (git-fixes).
- clk: qcom: clk-krait: unlock spin after mux completion
  (git-fixes).
- clk: renesas: r9a06g032: Fix UART clkgrp bitsel (git-fixes).
- gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
  (git-fixes).
- HID: cp2112: prevent a buffer overflow in cp2112_xfer()
  (git-fixes).
- driver core: fix potential deadlock in __driver_attach
  (git-fixes).
- iio: amplifiers: ad8366: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-tlc4541: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8688: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8344: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads7950: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads124s08: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc161s626: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc128s052: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc12138: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-adc084s021: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc0832: Fix alignment for DMA safety (git-fixes).
- iio: adc: mcp320x: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1118: Fix alignment for DMA safety (git-fixes).
- iio: adc: max11100: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1027: Fix alignment for DMA safety (git-fixes).
- iio: adc: ltc2497: Fix alignment for DMA safety (git-fixes).
- iio: adc: hi8435: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7887: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7768-1: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7766: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7476: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7298: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7266: Fix alignment for DMA safety (git-fixes).
- iio: accel: sca3000: Fix alignment for DMA safety (git-fixes).
- iio: accel: bma220: Fix alignment for DMA safety (git-fixes).
- iio: core: Fix IIO_ALIGN and rename as it was not sufficiently
  large (git-fixes).
- fpga: altera-pr-ip: fix unsigned comparison with less than zero
  (git-fixes).
- commit 9bda156</changelog>
  <changelog author="tiwai@suse.de" date="1659700802">- iio: potentiometer: mcp4131: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: mcp41010: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: max5481: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: ad5272: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: fxas210002c: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: adxrs450: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16130: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16080: Fix alignment for DMA safety (git-fixes).
- iio: frequency: adf4371: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: adf4350: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: ad9523: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: ti-dac7612: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac7311: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac5571: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac082s085: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: mcp4922: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad8801: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad7303: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5791: Fix alignment for DMA saftey (git-fixes).
- iio: dac: ad5764: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5761: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5755: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5504: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5449: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5421: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5360: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5064: Fix alignment for DMA safety (git-fixes).
- commit 7981ef6</changelog>
  <changelog author="tiwai@suse.de" date="1659700803">- mmc: cavium-thunderx: Add of_node_put() when breaking out of
  loop (git-fixes).
- mmc: cavium-octeon: Add of_node_put() when breaking out of loop
  (git-fixes).
- mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
  (git-fixes).
- memstick/ms_block: Fix a memory leak (git-fixes).
- memstick/ms_block: Fix some incorrect memory allocation
  (git-fixes).
- mmc: sdhci-of-esdhc: Fix refcount leak in
  esdhc_signal_voltage_switch (git-fixes).
- PCI: tegra194: Fix link up retry sequence (git-fixes).
- PCI: tegra194: Fix Root Port interrupt handling (git-fixes).
- PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
  (git-fixes).
- PCI: qcom: Power on PHY before IPQ8074 DBI register accesses
  (git-fixes).
- PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
  (git-fixes).
- PCI: dwc: Always enable CDM check if "snps,enable-cdm-check"
  exists (git-fixes).
- PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
  (git-fixes).
- PCI: dwc: Disable outbound windows only for controllers using
  iATU (git-fixes).
- PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
  (git-fixes).
- PCI: dwc: Stop link on host_init errors and de-initialization
  (git-fixes).
- PCI/portdrv: Don't disable AER reporting in
  get_port_device_capability() (git-fixes).
- platform/olpc: Fix uninitialized data in debugfs write
  (git-fixes).
- USB: Follow-up to SPDX identifiers addition - remove now
  useless comments (git-fixes).
- staging: rtl8192u: Fix sleep in atomic context bug in
  dm_fsync_timer_callback (git-fixes).
- usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command
  completion (git-fixes).
- USB: serial: fix tty-port initialized comments (git-fixes).
- usb: gadget: udc: amd5536 depends on HAS_DMA (git-fixes).
- usb: host: xhci: use snprintf() in xhci_decode_trb()
  (git-fixes).
- usb: xhci: tegra: Fix error check (git-fixes).
- usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
  (git-fixes).
- usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
  (git-fixes).
- iio: light: isl29028: Fix the warning in isl29028_remove()
  (git-fixes).
- soundwire: bus_type: fix remove and shutdown support
  (git-fixes).
- iio: resolver: ad2s90: Fix alignment for DMA safety (git-fixes).
- iio: resolver: ad2s1200: Fix alignment for DMA safety
  (git-fixes).
- iio: proximity: as3935: Fix alignment for DMA safety
  (git-fixes).
- intel_th: msu: Fix vmalloced buffers (git-fixes).
- intel_th: msu-sink: Potential dereference of null pointer
  (git-fixes).
- intel_th: Fix a resource leak in an error handling path
  (git-fixes).
- misc: rtsx: Fix an error handling path in rtsx_pci_probe()
  (git-fixes).
- commit 2bc728a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659787200">- blacklist.conf: update blacklist
- commit cc1d04f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659960000">- blacklist.conf: update blacklist
- commit 63fa2f9</changelog>
  <changelog author="iivanov@suse.de" date="1659960001">- KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
- commit ec6a677</changelog>
</package>
<package pkgid="80b7359fd643c63743d639b5b97b8697418424793387e1941354bf66e39d86bc" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.93.1"/>
  <changelog author="jgross@suse.com" date="1662120000">- KVM: VMX: Refuse to load kvm_intel if EPT and NX are disabled
  (git-fixes).
- commit b27e2cd</changelog>
  <changelog author="jgross@suse.com" date="1662120001">- KVM: x86: accept userspace interrupt only if no event is
  injected (git-fixes).
- commit b61f5d7</changelog>
  <changelog author="jgross@suse.com" date="1662120002">- KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending
  case (git-fixes).
- commit 1a5a475</changelog>
  <changelog author="jgross@suse.com" date="1662120003">- blacklist.conf: add dbac14a5a05f, as it would break kabi
- commit 55dfee4</changelog>
  <changelog author="jgross@suse.com" date="1662120004">- KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for
  !nested_run_pending case (git-fixes).
- commit 17df333</changelog>
  <changelog author="dwagner@suse.de" date="1662120005">- scsi: lpfc: Copyright updates for 14.2.0.6 patches
  (bsc#1203063).
- scsi: lpfc: Update lpfc version to 14.2.0.6 (bsc#1203063).
- scsi: lpfc: Remove SANDiags related code (bsc#1203063).
- scsi: lpfc: Add warning notification period to CMF_SYNC_WQE
  (bsc#1203063).
- scsi: lpfc: Rework MIB Rx Monitor debug info logic
  (bsc#1203063).
- scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit
  path for GFT_ID (bsc#1203063).
- scsi: lpfc: Fix unsolicited FLOGI receive handling during
  PT2PT discovery (bsc#1203063).
- scsi: lpfc: Check the return value of alloc_workqueue()
  (bsc#1203063).
- commit e207225</changelog>
  <changelog author="vbabka@suse.cz" date="1662292800">- mm/rmap: Fix anon_vma-&gt;degree ambiguity leading to double-reuse
  (git-fixes, bsc#1203098).
  kABI: Fix kABI after "mm/rmap: Fix anon_vma-&gt;degree ambiguity
  leading to double-reuse" (git-fixes, bsc#1203098).
- commit cfac9ee</changelog>
  <changelog author="osalvador@suse.de" date="1662379200">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit f477eb5</changelog>
  <changelog author="tiwai@suse.de" date="1662379201">- asm-generic: sections: refactor memory_intersects (git-fixes).
- ACPI: processor: Remove freq Qos request for all CPUs
  (git-fixes).
- ata: libata-eh: Add missing command name (git-fixes).
- ALSA: info: Fix llseek return value when using callback
  (git-fixes).
- ASoC: tas2770: Allow mono streams (git-fixes).
- ASoC: SOF: debug: Fix potential buffer overflow by snprintf()
  (git-fixes).
- ASoC: audio-graph-card: Add of_node_put() in fail path
  (git-fixes).
- ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
  (git-fixes).
- ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
  (git-fixes).
- ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to
  S8_TLV (git-fixes).
- ASoC: codecs: da7210: add check for i2c_add_driver (git-fixes).
- ASoC: mt6797-mt6351: Fix refcount leak in
  mt6797_mt6351_dev_probe (git-fixes).
- clk: qcom: ipq8074: dont disable gcc_sleep_clk_src (git-fixes).
- ACPI: LPSS: Fix missing check in register_device_clock()
  (git-fixes).
- ACPI: PM: save NVS memory for Lenovo G40-45 (git-fixes).
- ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from
  DMI quirks (git-fixes).
- ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for
  HP machine (git-fixes).
- clk: rockchip: add sclk_mac_lbtest to rk3188_critical_clocks
  (git-fixes).
- commit a8924db</changelog>
  <changelog author="tiwai@suse.de" date="1662379202">- drm/amdgpu: remove useless condition in
  amdgpu_job_stop_all_jobs_on_sched() (git-fixes).
- drm/sun4i: dsi: Prevent underflow when computing packet sizes
  (git-fixes).
- drm/meson: Fix refcount bugs in
  meson_vpu_has_available_connectors() (git-fixes).
- drm/meson: Fix overflow implicit truncation warnings
  (git-fixes).
- dmaengine: sprd: Cleanup in .remove() after
  pm_runtime_get_sync() failed (git-fixes).
- HID: wacom: Only report rotation for art pen (git-fixes).
- gadgetfs: ep_io - wait until IRQ finishes (git-fixes).
- drm/amdgpu: Check BO's requested pinning domains against its
  preferred_domains (git-fixes).
- fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
  (git-fixes).
- commit 9b0074c</changelog>
  <changelog author="tiwai@suse.de" date="1662379203">- i2c: imx: Make sure to unregister adapter on remove()
  (git-fixes).
- mmc: pxamci: Fix an error handling path in pxamci_probe()
  (git-fixes).
- lib/list_debug.c: Detect uninitialized lists (git-fixes).
- mfd: max77620: Fix refcount leak in max77620_initialise_fps
  (git-fixes).
- mfd: t7l66xb: Drop platform disable callback (git-fixes).
- HID: alps: Declare U1_UNICORN_LEGACY support (git-fixes).
- HID: wacom: Don't register pad_input for touch switch
  (git-fixes).
- intel_th: pci: Add Raptor Lake-S CPU support (git-fixes).
- intel_th: pci: Add Raptor Lake-S PCH support (git-fixes).
- intel_th: pci: Add Meteor Lake-P support (git-fixes).
- commit f90560c</changelog>
  <changelog author="tiwai@suse.de" date="1662379204">- mmc: pxamci: Fix another error handling path in pxamci_probe()
  (git-fixes).
- mtd: rawnand: meson: Fix a potential double free issue
  (git-fixes).
- mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s
  error path (git-fixes).
- mtd: partitions: Fix refcount leak in parse_redboot_of
  (git-fixes).
- mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in
  sm_release (git-fixes).
- mtd: maps: Fix refcount leak in ap_flash_init (git-fixes).
- mtd: maps: Fix refcount leak in of_flash_probe_versatile
  (git-fixes).
- PCI/ACPI: Guard ARM64-specific mcfg_quirks (git-fixes).
- PCI: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).
- net: rose: fix netdev reference changes (git-fixes).
- commit b9934d3</changelog>
  <changelog author="tiwai@suse.de" date="1662379205">- ratelimit: Fix data-races in ___ratelimit() (git-fixes).
- serial: mvebu-uart: uart2 error bits clearing (git-fixes).
- tty: vt: initialize unicode screen buffer (git-fixes).
- tty: serial: Fix refcount leak bug in ucc_uart.c (git-fixes).
- video: fbdev: i740fb: Check the argument of i740_calc_vclk()
  (git-fixes).
- usb: renesas: Fix refcount leak bug (git-fixes).
- usb: host: ohci-ppc-of: Fix refcount leak bug (git-fixes).
- usb: gadget: uvc: call uvc uvcg_warn on completed status
  instead of uvcg_info (git-fixes).
- vboxguest: Do not use devm for irq (git-fixes).
- wifi: mac80211_hwsim: use 32-bit skb cookie (git-fixes).
- wifi: mac80211_hwsim: add back erroneously removed cast
  (git-fixes).
- wifi: mac80211_hwsim: fix race condition in pending packet
  (git-fixes).
- spi: synquacer: Add missing clk_disable_unprepare() (git-fixes).
- spi: spi-rspi: Fix PIO fallback on RZ platforms (git-fixes).
- commit 86912f8</changelog>
  <changelog author="tiwai@suse.de" date="1662379206">- gpio: pca953x: Add mutex_lock for regcache sync in PM
  (git-fixes).
- Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
  (git-fixes).
- Input: rk805-pwrkey - fix module autoloading (git-fixes).
- tty: serial: lpuart: disable flow control while waiting for
  the transmit engine to complete (git-fixes).
- serial: fsl_lpuart: RS485 RTS polariy is inverse (git-fixes).
- staging: rtl8712: fix use after free bugs (git-fixes).
- clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
  (git-fixes).
- clk: core: Fix runtime PM sequence in clk_core_unprepare()
  (git-fixes).
- clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
  (git-fixes).
- hwmon: (gpio-fan) Fix array out of bounds access (git-fixes).
- drm/msm/dsi: Fix number of regulators for SDM660 (git-fixes).
- drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
  (git-fixes).
- drm/msm/dsi: fix the inconsistent indenting (git-fixes).
- drm/i915/reg: Fix spelling mistake "Unsupport" -&gt; "Unsupported"
  (git-fixes).
- driver core: Don't probe devices after bus_type.match() probe
  deferral (git-fixes).
- misc: fastrpc: fix memory corruption on open (git-fixes).
- misc: fastrpc: fix memory corruption on probe (git-fixes).
- iio: adc: mcp3911: use correct formula for AD conversion
  (git-fixes).
- iio: adc: mcp3911: make use of the sign bit (git-fixes).
- usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
  (git-fixes).
- usb: dwc2: fix wrong order of phy_power_on and phy_init
  (git-fixes).
- usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  (git-fixes).
- thunderbolt: Use the actual buffer in tb_async_error()
  (git-fixes).
- usb: typec: altmodes/displayport: correct pin assignment for
  UFP receptacles (git-fixes).
- platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask (git-fixes).
- ieee802154/adf7242: defer destroy_workqueue call (git-fixes).
- Bluetooth: L2CAP: Fix build errors in some archs (git-fixes).
- wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
  (git-fixes).
- wifi: mac80211: Don't finalize CSA in IBSS mode if state is
  disconnected (git-fixes).
- HID: steam: Prevent NULL pointer dereference in
  steam_{recv,send}_report (git-fixes).
- commit ed7b741</changelog>
  <changelog author="tiwai@suse.de" date="1662379207">- Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
  (git-fixes).
- Revert "usb: gadget: udc-xilinx: replace memcpy with
  memcpy_toio" (git-fixes).
- commit 855ba08</changelog>
  <changelog author="mkubecek@suse.cz" date="1662379208">- netfilter: nf_conntrack_irc: Tighten matching on DCC message
  (CVE-2022-2663 bsc#1202097).
- netfilter: nf_conntrack_irc: Fix forged IP logic (CVE-2022-2663
  bsc#1202097).
- commit a949534</changelog>
  <changelog author="lhenriques@suse.de" date="1662379209">- fuse: Remove the control interface for virtio-fs (bsc#1203137).
- fuse: ioctl: translate ENOSYS (bsc#1203136).
- fuse: limit nsec (bsc#1203135).
- commit e82b600</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1662379210">- netfilter: nf_tables: disallow binding to already bound chain
  (bsc#1203117 CVE-2022-39190).
- commit 933f567</changelog>
  <changelog author="vbabka@suse.cz" date="1662379211">- mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
  (CVE-2022-39188, bsc#1203107).
- commit 84aac57</changelog>
  <changelog author="osalvador@suse.de" date="1662465600">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ed68f11</changelog>
</package>
<package pkgid="f502f7ba9848df342f11a4eaa405d3a42f11c3c0d60334a167f76e738754d4b7" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.93.1"/>
  <changelog author="jgross@suse.com" date="1662120000">- KVM: VMX: Refuse to load kvm_intel if EPT and NX are disabled
  (git-fixes).
- commit b27e2cd</changelog>
  <changelog author="jgross@suse.com" date="1662120001">- KVM: x86: accept userspace interrupt only if no event is
  injected (git-fixes).
- commit b61f5d7</changelog>
  <changelog author="jgross@suse.com" date="1662120002">- KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending
  case (git-fixes).
- commit 1a5a475</changelog>
  <changelog author="jgross@suse.com" date="1662120003">- blacklist.conf: add dbac14a5a05f, as it would break kabi
- commit 55dfee4</changelog>
  <changelog author="jgross@suse.com" date="1662120004">- KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for
  !nested_run_pending case (git-fixes).
- commit 17df333</changelog>
  <changelog author="dwagner@suse.de" date="1662120005">- scsi: lpfc: Copyright updates for 14.2.0.6 patches
  (bsc#1203063).
- scsi: lpfc: Update lpfc version to 14.2.0.6 (bsc#1203063).
- scsi: lpfc: Remove SANDiags related code (bsc#1203063).
- scsi: lpfc: Add warning notification period to CMF_SYNC_WQE
  (bsc#1203063).
- scsi: lpfc: Rework MIB Rx Monitor debug info logic
  (bsc#1203063).
- scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit
  path for GFT_ID (bsc#1203063).
- scsi: lpfc: Fix unsolicited FLOGI receive handling during
  PT2PT discovery (bsc#1203063).
- scsi: lpfc: Check the return value of alloc_workqueue()
  (bsc#1203063).
- commit e207225</changelog>
  <changelog author="vbabka@suse.cz" date="1662292800">- mm/rmap: Fix anon_vma-&gt;degree ambiguity leading to double-reuse
  (git-fixes, bsc#1203098).
  kABI: Fix kABI after "mm/rmap: Fix anon_vma-&gt;degree ambiguity
  leading to double-reuse" (git-fixes, bsc#1203098).
- commit cfac9ee</changelog>
  <changelog author="osalvador@suse.de" date="1662379200">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit f477eb5</changelog>
  <changelog author="tiwai@suse.de" date="1662379201">- asm-generic: sections: refactor memory_intersects (git-fixes).
- ACPI: processor: Remove freq Qos request for all CPUs
  (git-fixes).
- ata: libata-eh: Add missing command name (git-fixes).
- ALSA: info: Fix llseek return value when using callback
  (git-fixes).
- ASoC: tas2770: Allow mono streams (git-fixes).
- ASoC: SOF: debug: Fix potential buffer overflow by snprintf()
  (git-fixes).
- ASoC: audio-graph-card: Add of_node_put() in fail path
  (git-fixes).
- ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
  (git-fixes).
- ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
  (git-fixes).
- ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to
  S8_TLV (git-fixes).
- ASoC: codecs: da7210: add check for i2c_add_driver (git-fixes).
- ASoC: mt6797-mt6351: Fix refcount leak in
  mt6797_mt6351_dev_probe (git-fixes).
- clk: qcom: ipq8074: dont disable gcc_sleep_clk_src (git-fixes).
- ACPI: LPSS: Fix missing check in register_device_clock()
  (git-fixes).
- ACPI: PM: save NVS memory for Lenovo G40-45 (git-fixes).
- ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from
  DMI quirks (git-fixes).
- ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for
  HP machine (git-fixes).
- clk: rockchip: add sclk_mac_lbtest to rk3188_critical_clocks
  (git-fixes).
- commit a8924db</changelog>
  <changelog author="tiwai@suse.de" date="1662379202">- drm/amdgpu: remove useless condition in
  amdgpu_job_stop_all_jobs_on_sched() (git-fixes).
- drm/sun4i: dsi: Prevent underflow when computing packet sizes
  (git-fixes).
- drm/meson: Fix refcount bugs in
  meson_vpu_has_available_connectors() (git-fixes).
- drm/meson: Fix overflow implicit truncation warnings
  (git-fixes).
- dmaengine: sprd: Cleanup in .remove() after
  pm_runtime_get_sync() failed (git-fixes).
- HID: wacom: Only report rotation for art pen (git-fixes).
- gadgetfs: ep_io - wait until IRQ finishes (git-fixes).
- drm/amdgpu: Check BO's requested pinning domains against its
  preferred_domains (git-fixes).
- fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
  (git-fixes).
- commit 9b0074c</changelog>
  <changelog author="tiwai@suse.de" date="1662379203">- i2c: imx: Make sure to unregister adapter on remove()
  (git-fixes).
- mmc: pxamci: Fix an error handling path in pxamci_probe()
  (git-fixes).
- lib/list_debug.c: Detect uninitialized lists (git-fixes).
- mfd: max77620: Fix refcount leak in max77620_initialise_fps
  (git-fixes).
- mfd: t7l66xb: Drop platform disable callback (git-fixes).
- HID: alps: Declare U1_UNICORN_LEGACY support (git-fixes).
- HID: wacom: Don't register pad_input for touch switch
  (git-fixes).
- intel_th: pci: Add Raptor Lake-S CPU support (git-fixes).
- intel_th: pci: Add Raptor Lake-S PCH support (git-fixes).
- intel_th: pci: Add Meteor Lake-P support (git-fixes).
- commit f90560c</changelog>
  <changelog author="tiwai@suse.de" date="1662379204">- mmc: pxamci: Fix another error handling path in pxamci_probe()
  (git-fixes).
- mtd: rawnand: meson: Fix a potential double free issue
  (git-fixes).
- mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s
  error path (git-fixes).
- mtd: partitions: Fix refcount leak in parse_redboot_of
  (git-fixes).
- mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in
  sm_release (git-fixes).
- mtd: maps: Fix refcount leak in ap_flash_init (git-fixes).
- mtd: maps: Fix refcount leak in of_flash_probe_versatile
  (git-fixes).
- PCI/ACPI: Guard ARM64-specific mcfg_quirks (git-fixes).
- PCI: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).
- net: rose: fix netdev reference changes (git-fixes).
- commit b9934d3</changelog>
  <changelog author="tiwai@suse.de" date="1662379205">- ratelimit: Fix data-races in ___ratelimit() (git-fixes).
- serial: mvebu-uart: uart2 error bits clearing (git-fixes).
- tty: vt: initialize unicode screen buffer (git-fixes).
- tty: serial: Fix refcount leak bug in ucc_uart.c (git-fixes).
- video: fbdev: i740fb: Check the argument of i740_calc_vclk()
  (git-fixes).
- usb: renesas: Fix refcount leak bug (git-fixes).
- usb: host: ohci-ppc-of: Fix refcount leak bug (git-fixes).
- usb: gadget: uvc: call uvc uvcg_warn on completed status
  instead of uvcg_info (git-fixes).
- vboxguest: Do not use devm for irq (git-fixes).
- wifi: mac80211_hwsim: use 32-bit skb cookie (git-fixes).
- wifi: mac80211_hwsim: add back erroneously removed cast
  (git-fixes).
- wifi: mac80211_hwsim: fix race condition in pending packet
  (git-fixes).
- spi: synquacer: Add missing clk_disable_unprepare() (git-fixes).
- spi: spi-rspi: Fix PIO fallback on RZ platforms (git-fixes).
- commit 86912f8</changelog>
  <changelog author="tiwai@suse.de" date="1662379206">- gpio: pca953x: Add mutex_lock for regcache sync in PM
  (git-fixes).
- Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
  (git-fixes).
- Input: rk805-pwrkey - fix module autoloading (git-fixes).
- tty: serial: lpuart: disable flow control while waiting for
  the transmit engine to complete (git-fixes).
- serial: fsl_lpuart: RS485 RTS polariy is inverse (git-fixes).
- staging: rtl8712: fix use after free bugs (git-fixes).
- clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
  (git-fixes).
- clk: core: Fix runtime PM sequence in clk_core_unprepare()
  (git-fixes).
- clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
  (git-fixes).
- hwmon: (gpio-fan) Fix array out of bounds access (git-fixes).
- drm/msm/dsi: Fix number of regulators for SDM660 (git-fixes).
- drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
  (git-fixes).
- drm/msm/dsi: fix the inconsistent indenting (git-fixes).
- drm/i915/reg: Fix spelling mistake "Unsupport" -&gt; "Unsupported"
  (git-fixes).
- driver core: Don't probe devices after bus_type.match() probe
  deferral (git-fixes).
- misc: fastrpc: fix memory corruption on open (git-fixes).
- misc: fastrpc: fix memory corruption on probe (git-fixes).
- iio: adc: mcp3911: use correct formula for AD conversion
  (git-fixes).
- iio: adc: mcp3911: make use of the sign bit (git-fixes).
- usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
  (git-fixes).
- usb: dwc2: fix wrong order of phy_power_on and phy_init
  (git-fixes).
- usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  (git-fixes).
- thunderbolt: Use the actual buffer in tb_async_error()
  (git-fixes).
- usb: typec: altmodes/displayport: correct pin assignment for
  UFP receptacles (git-fixes).
- platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask (git-fixes).
- ieee802154/adf7242: defer destroy_workqueue call (git-fixes).
- Bluetooth: L2CAP: Fix build errors in some archs (git-fixes).
- wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
  (git-fixes).
- wifi: mac80211: Don't finalize CSA in IBSS mode if state is
  disconnected (git-fixes).
- HID: steam: Prevent NULL pointer dereference in
  steam_{recv,send}_report (git-fixes).
- commit ed7b741</changelog>
  <changelog author="tiwai@suse.de" date="1662379207">- Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
  (git-fixes).
- Revert "usb: gadget: udc-xilinx: replace memcpy with
  memcpy_toio" (git-fixes).
- commit 855ba08</changelog>
  <changelog author="mkubecek@suse.cz" date="1662379208">- netfilter: nf_conntrack_irc: Tighten matching on DCC message
  (CVE-2022-2663 bsc#1202097).
- netfilter: nf_conntrack_irc: Fix forged IP logic (CVE-2022-2663
  bsc#1202097).
- commit a949534</changelog>
  <changelog author="lhenriques@suse.de" date="1662379209">- fuse: Remove the control interface for virtio-fs (bsc#1203137).
- fuse: ioctl: translate ENOSYS (bsc#1203136).
- fuse: limit nsec (bsc#1203135).
- commit e82b600</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1662379210">- netfilter: nf_tables: disallow binding to already bound chain
  (bsc#1203117 CVE-2022-39190).
- commit 933f567</changelog>
  <changelog author="vbabka@suse.cz" date="1662379211">- mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
  (CVE-2022-39188, bsc#1203107).
- commit 84aac57</changelog>
  <changelog author="osalvador@suse.de" date="1662465600">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ed68f11</changelog>
</package>
<package pkgid="7a29dbb20f1550477a10c925a8dc0053b12ad51e8126a11da95438c61b1630d6" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.93.1"/>
  <changelog author="jgross@suse.com" date="1662120000">- KVM: VMX: Refuse to load kvm_intel if EPT and NX are disabled
  (git-fixes).
- commit b27e2cd</changelog>
  <changelog author="jgross@suse.com" date="1662120001">- KVM: x86: accept userspace interrupt only if no event is
  injected (git-fixes).
- commit b61f5d7</changelog>
  <changelog author="jgross@suse.com" date="1662120002">- KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending
  case (git-fixes).
- commit 1a5a475</changelog>
  <changelog author="jgross@suse.com" date="1662120003">- blacklist.conf: add dbac14a5a05f, as it would break kabi
- commit 55dfee4</changelog>
  <changelog author="jgross@suse.com" date="1662120004">- KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for
  !nested_run_pending case (git-fixes).
- commit 17df333</changelog>
  <changelog author="dwagner@suse.de" date="1662120005">- scsi: lpfc: Copyright updates for 14.2.0.6 patches
  (bsc#1203063).
- scsi: lpfc: Update lpfc version to 14.2.0.6 (bsc#1203063).
- scsi: lpfc: Remove SANDiags related code (bsc#1203063).
- scsi: lpfc: Add warning notification period to CMF_SYNC_WQE
  (bsc#1203063).
- scsi: lpfc: Rework MIB Rx Monitor debug info logic
  (bsc#1203063).
- scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit
  path for GFT_ID (bsc#1203063).
- scsi: lpfc: Fix unsolicited FLOGI receive handling during
  PT2PT discovery (bsc#1203063).
- scsi: lpfc: Check the return value of alloc_workqueue()
  (bsc#1203063).
- commit e207225</changelog>
  <changelog author="vbabka@suse.cz" date="1662292800">- mm/rmap: Fix anon_vma-&gt;degree ambiguity leading to double-reuse
  (git-fixes, bsc#1203098).
  kABI: Fix kABI after "mm/rmap: Fix anon_vma-&gt;degree ambiguity
  leading to double-reuse" (git-fixes, bsc#1203098).
- commit cfac9ee</changelog>
  <changelog author="osalvador@suse.de" date="1662379200">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit f477eb5</changelog>
  <changelog author="tiwai@suse.de" date="1662379201">- asm-generic: sections: refactor memory_intersects (git-fixes).
- ACPI: processor: Remove freq Qos request for all CPUs
  (git-fixes).
- ata: libata-eh: Add missing command name (git-fixes).
- ALSA: info: Fix llseek return value when using callback
  (git-fixes).
- ASoC: tas2770: Allow mono streams (git-fixes).
- ASoC: SOF: debug: Fix potential buffer overflow by snprintf()
  (git-fixes).
- ASoC: audio-graph-card: Add of_node_put() in fail path
  (git-fixes).
- ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp()
  (git-fixes).
- ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV
  (git-fixes).
- ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to
  S8_TLV (git-fixes).
- ASoC: codecs: da7210: add check for i2c_add_driver (git-fixes).
- ASoC: mt6797-mt6351: Fix refcount leak in
  mt6797_mt6351_dev_probe (git-fixes).
- clk: qcom: ipq8074: dont disable gcc_sleep_clk_src (git-fixes).
- ACPI: LPSS: Fix missing check in register_device_clock()
  (git-fixes).
- ACPI: PM: save NVS memory for Lenovo G40-45 (git-fixes).
- ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from
  DMI quirks (git-fixes).
- ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for
  HP machine (git-fixes).
- clk: rockchip: add sclk_mac_lbtest to rk3188_critical_clocks
  (git-fixes).
- commit a8924db</changelog>
  <changelog author="tiwai@suse.de" date="1662379202">- drm/amdgpu: remove useless condition in
  amdgpu_job_stop_all_jobs_on_sched() (git-fixes).
- drm/sun4i: dsi: Prevent underflow when computing packet sizes
  (git-fixes).
- drm/meson: Fix refcount bugs in
  meson_vpu_has_available_connectors() (git-fixes).
- drm/meson: Fix overflow implicit truncation warnings
  (git-fixes).
- dmaengine: sprd: Cleanup in .remove() after
  pm_runtime_get_sync() failed (git-fixes).
- HID: wacom: Only report rotation for art pen (git-fixes).
- gadgetfs: ep_io - wait until IRQ finishes (git-fixes).
- drm/amdgpu: Check BO's requested pinning domains against its
  preferred_domains (git-fixes).
- fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
  (git-fixes).
- commit 9b0074c</changelog>
  <changelog author="tiwai@suse.de" date="1662379203">- i2c: imx: Make sure to unregister adapter on remove()
  (git-fixes).
- mmc: pxamci: Fix an error handling path in pxamci_probe()
  (git-fixes).
- lib/list_debug.c: Detect uninitialized lists (git-fixes).
- mfd: max77620: Fix refcount leak in max77620_initialise_fps
  (git-fixes).
- mfd: t7l66xb: Drop platform disable callback (git-fixes).
- HID: alps: Declare U1_UNICORN_LEGACY support (git-fixes).
- HID: wacom: Don't register pad_input for touch switch
  (git-fixes).
- intel_th: pci: Add Raptor Lake-S CPU support (git-fixes).
- intel_th: pci: Add Raptor Lake-S PCH support (git-fixes).
- intel_th: pci: Add Meteor Lake-P support (git-fixes).
- commit f90560c</changelog>
  <changelog author="tiwai@suse.de" date="1662379204">- mmc: pxamci: Fix another error handling path in pxamci_probe()
  (git-fixes).
- mtd: rawnand: meson: Fix a potential double free issue
  (git-fixes).
- mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s
  error path (git-fixes).
- mtd: partitions: Fix refcount leak in parse_redboot_of
  (git-fixes).
- mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in
  sm_release (git-fixes).
- mtd: maps: Fix refcount leak in ap_flash_init (git-fixes).
- mtd: maps: Fix refcount leak in of_flash_probe_versatile
  (git-fixes).
- PCI/ACPI: Guard ARM64-specific mcfg_quirks (git-fixes).
- PCI: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).
- net: rose: fix netdev reference changes (git-fixes).
- commit b9934d3</changelog>
  <changelog author="tiwai@suse.de" date="1662379205">- ratelimit: Fix data-races in ___ratelimit() (git-fixes).
- serial: mvebu-uart: uart2 error bits clearing (git-fixes).
- tty: vt: initialize unicode screen buffer (git-fixes).
- tty: serial: Fix refcount leak bug in ucc_uart.c (git-fixes).
- video: fbdev: i740fb: Check the argument of i740_calc_vclk()
  (git-fixes).
- usb: renesas: Fix refcount leak bug (git-fixes).
- usb: host: ohci-ppc-of: Fix refcount leak bug (git-fixes).
- usb: gadget: uvc: call uvc uvcg_warn on completed status
  instead of uvcg_info (git-fixes).
- vboxguest: Do not use devm for irq (git-fixes).
- wifi: mac80211_hwsim: use 32-bit skb cookie (git-fixes).
- wifi: mac80211_hwsim: add back erroneously removed cast
  (git-fixes).
- wifi: mac80211_hwsim: fix race condition in pending packet
  (git-fixes).
- spi: synquacer: Add missing clk_disable_unprepare() (git-fixes).
- spi: spi-rspi: Fix PIO fallback on RZ platforms (git-fixes).
- commit 86912f8</changelog>
  <changelog author="tiwai@suse.de" date="1662379206">- gpio: pca953x: Add mutex_lock for regcache sync in PM
  (git-fixes).
- Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
  (git-fixes).
- Input: rk805-pwrkey - fix module autoloading (git-fixes).
- tty: serial: lpuart: disable flow control while waiting for
  the transmit engine to complete (git-fixes).
- serial: fsl_lpuart: RS485 RTS polariy is inverse (git-fixes).
- staging: rtl8712: fix use after free bugs (git-fixes).
- clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
  (git-fixes).
- clk: core: Fix runtime PM sequence in clk_core_unprepare()
  (git-fixes).
- clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
  (git-fixes).
- hwmon: (gpio-fan) Fix array out of bounds access (git-fixes).
- drm/msm/dsi: Fix number of regulators for SDM660 (git-fixes).
- drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
  (git-fixes).
- drm/msm/dsi: fix the inconsistent indenting (git-fixes).
- drm/i915/reg: Fix spelling mistake "Unsupport" -&gt; "Unsupported"
  (git-fixes).
- driver core: Don't probe devices after bus_type.match() probe
  deferral (git-fixes).
- misc: fastrpc: fix memory corruption on open (git-fixes).
- misc: fastrpc: fix memory corruption on probe (git-fixes).
- iio: adc: mcp3911: use correct formula for AD conversion
  (git-fixes).
- iio: adc: mcp3911: make use of the sign bit (git-fixes).
- usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
  (git-fixes).
- usb: dwc2: fix wrong order of phy_power_on and phy_init
  (git-fixes).
- usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  (git-fixes).
- thunderbolt: Use the actual buffer in tb_async_error()
  (git-fixes).
- usb: typec: altmodes/displayport: correct pin assignment for
  UFP receptacles (git-fixes).
- platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask (git-fixes).
- ieee802154/adf7242: defer destroy_workqueue call (git-fixes).
- Bluetooth: L2CAP: Fix build errors in some archs (git-fixes).
- wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
  (git-fixes).
- wifi: mac80211: Don't finalize CSA in IBSS mode if state is
  disconnected (git-fixes).
- HID: steam: Prevent NULL pointer dereference in
  steam_{recv,send}_report (git-fixes).
- commit ed7b741</changelog>
  <changelog author="tiwai@suse.de" date="1662379207">- Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
  (git-fixes).
- Revert "usb: gadget: udc-xilinx: replace memcpy with
  memcpy_toio" (git-fixes).
- commit 855ba08</changelog>
  <changelog author="mkubecek@suse.cz" date="1662379208">- netfilter: nf_conntrack_irc: Tighten matching on DCC message
  (CVE-2022-2663 bsc#1202097).
- netfilter: nf_conntrack_irc: Fix forged IP logic (CVE-2022-2663
  bsc#1202097).
- commit a949534</changelog>
  <changelog author="lhenriques@suse.de" date="1662379209">- fuse: Remove the control interface for virtio-fs (bsc#1203137).
- fuse: ioctl: translate ENOSYS (bsc#1203136).
- fuse: limit nsec (bsc#1203135).
- commit e82b600</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1662379210">- netfilter: nf_tables: disallow binding to already bound chain
  (bsc#1203117 CVE-2022-39190).
- commit 933f567</changelog>
  <changelog author="vbabka@suse.cz" date="1662379211">- mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
  (CVE-2022-39188, bsc#1203107).
- commit 84aac57</changelog>
  <changelog author="osalvador@suse.de" date="1662465600">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ed68f11</changelog>
</package>
<package pkgid="abdd3ad7480ff8b71e444b3fa84c1fa08b28b79374bc204aa395592bd2731a1a" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.98.1"/>
  <changelog author="oneukum@suse.com" date="1664884800">- USB: core: Fix RST error in hub.c (git-fixes).
- commit 0a4bc80</changelog>
  <changelog author="oneukum@suse.com" date="1664884801">- blacklist.conf: cleanup that breaks kABI
- commit 9b1761f</changelog>
  <changelog author="oneukum@suse.com" date="1664884802">- Input: melfas_mip4 - fix return value check in mip4_probe()
  (git-fixes).
- commit 6863cfd</changelog>
  <changelog author="oneukum@suse.com" date="1664884803">- Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address
  (git-fixes).
- commit d6b115e</changelog>
  <changelog author="tiwai@suse.de" date="1664884804">- fbdev: smscufx: Fix use-after-free in ufx_ops_open()
  (CVE-2022-41849 bsc#1203992).
- commit 1b1c9cc</changelog>
  <changelog author="tiwai@suse.de" date="1664884805">- char: pcmcia: synclink_cs: Fix use-after-free in mgslpc_ops
  (CVE-2022-41848 bsc#1203987).
- commit c6f643b</changelog>
  <changelog author="dwagner@suse.de" date="1664884806">- Add CVE reference on lightnvm removal patch
  modified:
  - patches.drivers/lightnvm-remove-lightnvm-implemenation.patch
- commit 6251214</changelog>
  <changelog author="dwagner@suse.de" date="1665057600">- nvme: ensure subsystem reset is single threaded (bsc#1203290
  CVE-2022-3169).
- nvme: restrict management ioctls to admin (bsc#1203290
  CVE-2022-3169).
- commit fb89dd3</changelog>
  <changelog author="lduncan@suse.com" date="1665316800">- scsi: stex: Properly zero out the passthrough command structure
  (bsc#1203514 CVE-2022-40768).
- commit b5c1e4b</changelog>
  <changelog author="osalvador@suse.de" date="1665403200">- Refresh metadata
  Refresh:
  patches.suse/nvme-ensure-subsystem-reset-is-single-threaded.patch
  patches.suse/nvme-restrict-management-ioctls-to-admin.patch
- commit 32aee9f</changelog>
  <changelog author="tiwai@suse.de" date="1665403201">- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- cfg80211: hold bss_lock while updating nontrans_list
  (CVE-2022-42719 bsc#1204051).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- mac80211: don't re-parse elems in ieee80211_assoc_success()
  (CVE-2022-42719 bsc#1204051).
- commit cf17eed</changelog>
  <changelog author="tiwai@suse.de" date="1665403202">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit 1d0e42c</changelog>
  <changelog author="tiwai@suse.de" date="1665403203">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 7b3171e</changelog>
  <changelog author="tiwai@suse.de" date="1665403204">- wifi: mac80211: fix MBSSID parsing use-after-free
  (CVE-2022-42719 bsc#1204051).
- commit 6462e9c</changelog>
  <changelog author="tiwai@suse.de" date="1665403205">- wifi: cfg80211: avoid nontransmitted BSS list corruption
  (CVE-2022-42721 bsc#1204060).
- commit 5fe81ec</changelog>
  <changelog author="tiwai@suse.de" date="1665403206">- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit a183a67</changelog>
  <changelog author="tiwai@suse.de" date="1665403207">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- commit a818808</changelog>
  <changelog author="tiwai@suse.de" date="1665403208">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 26c2d4f</changelog>
  <changelog author="tiwai@suse.de" date="1665403209">- wifi: mac80211: fix crash in beacon protection for P2P-device
  (CVE-2022-42722 bsc#1204125).
- commit a6f4ca8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1665662400">- Update metadata references
- commit 26d4ba7</changelog>
</package>
<package pkgid="a87fd883b8214e7684ca8955119c55943e9a73a3898c79f77c678c2790a88bac" name="kernel-default" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.98.1"/>
  <changelog author="oneukum@suse.com" date="1664884800">- USB: core: Fix RST error in hub.c (git-fixes).
- commit 0a4bc80</changelog>
  <changelog author="oneukum@suse.com" date="1664884801">- blacklist.conf: cleanup that breaks kABI
- commit 9b1761f</changelog>
  <changelog author="oneukum@suse.com" date="1664884802">- Input: melfas_mip4 - fix return value check in mip4_probe()
  (git-fixes).
- commit 6863cfd</changelog>
  <changelog author="oneukum@suse.com" date="1664884803">- Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address
  (git-fixes).
- commit d6b115e</changelog>
  <changelog author="tiwai@suse.de" date="1664884804">- fbdev: smscufx: Fix use-after-free in ufx_ops_open()
  (CVE-2022-41849 bsc#1203992).
- commit 1b1c9cc</changelog>
  <changelog author="tiwai@suse.de" date="1664884805">- char: pcmcia: synclink_cs: Fix use-after-free in mgslpc_ops
  (CVE-2022-41848 bsc#1203987).
- commit c6f643b</changelog>
  <changelog author="dwagner@suse.de" date="1664884806">- Add CVE reference on lightnvm removal patch
  modified:
  - patches.drivers/lightnvm-remove-lightnvm-implemenation.patch
- commit 6251214</changelog>
  <changelog author="dwagner@suse.de" date="1665057600">- nvme: ensure subsystem reset is single threaded (bsc#1203290
  CVE-2022-3169).
- nvme: restrict management ioctls to admin (bsc#1203290
  CVE-2022-3169).
- commit fb89dd3</changelog>
  <changelog author="lduncan@suse.com" date="1665316800">- scsi: stex: Properly zero out the passthrough command structure
  (bsc#1203514 CVE-2022-40768).
- commit b5c1e4b</changelog>
  <changelog author="osalvador@suse.de" date="1665403200">- Refresh metadata
  Refresh:
  patches.suse/nvme-ensure-subsystem-reset-is-single-threaded.patch
  patches.suse/nvme-restrict-management-ioctls-to-admin.patch
- commit 32aee9f</changelog>
  <changelog author="tiwai@suse.de" date="1665403201">- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- cfg80211: hold bss_lock while updating nontrans_list
  (CVE-2022-42719 bsc#1204051).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- mac80211: don't re-parse elems in ieee80211_assoc_success()
  (CVE-2022-42719 bsc#1204051).
- commit cf17eed</changelog>
  <changelog author="tiwai@suse.de" date="1665403202">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit 1d0e42c</changelog>
  <changelog author="tiwai@suse.de" date="1665403203">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 7b3171e</changelog>
  <changelog author="tiwai@suse.de" date="1665403204">- wifi: mac80211: fix MBSSID parsing use-after-free
  (CVE-2022-42719 bsc#1204051).
- commit 6462e9c</changelog>
  <changelog author="tiwai@suse.de" date="1665403205">- wifi: cfg80211: avoid nontransmitted BSS list corruption
  (CVE-2022-42721 bsc#1204060).
- commit 5fe81ec</changelog>
  <changelog author="tiwai@suse.de" date="1665403206">- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit a183a67</changelog>
  <changelog author="tiwai@suse.de" date="1665403207">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- commit a818808</changelog>
  <changelog author="tiwai@suse.de" date="1665403208">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 26c2d4f</changelog>
  <changelog author="tiwai@suse.de" date="1665403209">- wifi: mac80211: fix crash in beacon protection for P2P-device
  (CVE-2022-42722 bsc#1204125).
- commit a6f4ca8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1665662400">- Update metadata references
- commit 26d4ba7</changelog>
</package>
<package pkgid="90d53b547c966cab85a6988350a74c4f3ae763e137a15631ce288cc65d346d21" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.98.1"/>
  <changelog author="oneukum@suse.com" date="1664884800">- USB: core: Fix RST error in hub.c (git-fixes).
- commit 0a4bc80</changelog>
  <changelog author="oneukum@suse.com" date="1664884801">- blacklist.conf: cleanup that breaks kABI
- commit 9b1761f</changelog>
  <changelog author="oneukum@suse.com" date="1664884802">- Input: melfas_mip4 - fix return value check in mip4_probe()
  (git-fixes).
- commit 6863cfd</changelog>
  <changelog author="oneukum@suse.com" date="1664884803">- Input: snvs_pwrkey - fix SNVS_HPVIDR1 register address
  (git-fixes).
- commit d6b115e</changelog>
  <changelog author="tiwai@suse.de" date="1664884804">- fbdev: smscufx: Fix use-after-free in ufx_ops_open()
  (CVE-2022-41849 bsc#1203992).
- commit 1b1c9cc</changelog>
  <changelog author="tiwai@suse.de" date="1664884805">- char: pcmcia: synclink_cs: Fix use-after-free in mgslpc_ops
  (CVE-2022-41848 bsc#1203987).
- commit c6f643b</changelog>
  <changelog author="dwagner@suse.de" date="1664884806">- Add CVE reference on lightnvm removal patch
  modified:
  - patches.drivers/lightnvm-remove-lightnvm-implemenation.patch
- commit 6251214</changelog>
  <changelog author="dwagner@suse.de" date="1665057600">- nvme: ensure subsystem reset is single threaded (bsc#1203290
  CVE-2022-3169).
- nvme: restrict management ioctls to admin (bsc#1203290
  CVE-2022-3169).
- commit fb89dd3</changelog>
  <changelog author="lduncan@suse.com" date="1665316800">- scsi: stex: Properly zero out the passthrough command structure
  (bsc#1203514 CVE-2022-40768).
- commit b5c1e4b</changelog>
  <changelog author="osalvador@suse.de" date="1665403200">- Refresh metadata
  Refresh:
  patches.suse/nvme-ensure-subsystem-reset-is-single-threaded.patch
  patches.suse/nvme-restrict-management-ioctls-to-admin.patch
- commit 32aee9f</changelog>
  <changelog author="tiwai@suse.de" date="1665403201">- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- cfg80211: hold bss_lock while updating nontrans_list
  (CVE-2022-42719 bsc#1204051).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- mac80211: don't re-parse elems in ieee80211_assoc_success()
  (CVE-2022-42719 bsc#1204051).
- commit cf17eed</changelog>
  <changelog author="tiwai@suse.de" date="1665403202">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit 1d0e42c</changelog>
  <changelog author="tiwai@suse.de" date="1665403203">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 7b3171e</changelog>
  <changelog author="tiwai@suse.de" date="1665403204">- wifi: mac80211: fix MBSSID parsing use-after-free
  (CVE-2022-42719 bsc#1204051).
- commit 6462e9c</changelog>
  <changelog author="tiwai@suse.de" date="1665403205">- wifi: cfg80211: avoid nontransmitted BSS list corruption
  (CVE-2022-42721 bsc#1204060).
- commit 5fe81ec</changelog>
  <changelog author="tiwai@suse.de" date="1665403206">- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit a183a67</changelog>
  <changelog author="tiwai@suse.de" date="1665403207">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- commit a818808</changelog>
  <changelog author="tiwai@suse.de" date="1665403208">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 26c2d4f</changelog>
  <changelog author="tiwai@suse.de" date="1665403209">- wifi: mac80211: fix crash in beacon protection for P2P-device
  (CVE-2022-42722 bsc#1204125).
- commit a6f4ca8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1665662400">- Update metadata references
- commit 26d4ba7</changelog>
</package>
<package pkgid="a0cd7ad5ac9c0d6d4b3174894a00f8cc58cb11d66f8ebcf89e4a3e94a08f66c4" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.101.1.150300.18.58.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="949996c42c9bb56045afab1f92134595405c4afe35b44cd3c248dd947c5f2a08" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.101.1.150300.18.58.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="a3b6502c4b883c8e16cdb0a7b2f2ea639ed9b69e9e4665e1fe452f4618adfa85" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.101.1.150300.18.58.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="a9c20dc4f0e04b146a73ec312e59070b6853d1ec04891872ff289c7ef4332543" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.106.1.150300.18.60.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="200a0e1b59a31522f6f1ee0a686122366a94d0473831fd40f8e3e4a072368bbf" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.106.1.150300.18.60.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="10db097c76dee6e1be1061cf428edceb56f619caf09a31ef76391e05dd289e53" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.106.1.150300.18.60.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="3fc312228f46473e1d7df4d17a931fe6d4cdc62207f93d0000e672bcaea671cb" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.109.1.150300.18.62.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="4068ed1eeff38bdae7cac64c30b4807ffa44e2ffeb87cb4d5dd8fd4ad0b37e9a" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.109.1.150300.18.62.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="a16ee388039dfa49a09c7861d7fa548c18d1c399ed836823900fc23bba1dea64" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.109.1.150300.18.62.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="d220098385948eca53dec1e9ed0efa2ebf1af3881eb1d4f7c5a4d9560483221f" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.112.1.150300.18.64.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="90277c57d0e3d9e32c0908716b1205ed08da204ec3430b636e99b0f01494e201" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.112.1.150300.18.64.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="12a1cc20987f62b952b6d35de1fb813e7f4c25748dccf3960551d0857484283a" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.112.1.150300.18.64.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="d9e7335115de1a03b0ed528713f24f1e46937731ef6baca08e95598460b9dd20" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1.150300.18.45.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="db70ea78cbc1ed0b61847636d2b10413a589d884776ccff0c3b2307a548885e8" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1.150300.18.45.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="fa19f7d643cc539cc7ff7b3c166bc539e31adb4d5d5ac53a51501569f035dce2" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.76.1.150300.18.45.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="34ba08043c254bb68af2d9aa6c9169bf393e8641855b3ced53fe3248564c29b6" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1.150300.18.47.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="80ccb11912a07d7add839f5c3b2eb3d6f312e4e6c93e7648474fe8143a463dd7" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1.150300.18.47.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="35d7e785ac2cb88b89f4f229251c47434f0c710e3421c038d961b52ce40a8918" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.81.1.150300.18.47.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="8c88817f03db0373a3d1a63e4aa55259224ec26015428fa798d34ce762557692" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1.150300.18.50.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="a103f4ad7798f3a74c81500b0182ae36bb1d6aa14cb458a32d1492da4c0802fa" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1.150300.18.50.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="6fcbd8fa522f0ff1de0ff807187ebed7242c1e76837fa5f798eb232ad6fd3f96" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.87.1.150300.18.50.2"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="5edcf47c177c8eb5a99d3ad56308c17f60d85fa735f14abd2010bb65b1ede639" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.90.1.150300.18.52.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="3c0f7b5f30b2ff223e42298c537fa593cd851bb629f137ed14cc85084c549dad" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.90.1.150300.18.52.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="1dd0827c0a9bfb06f23bd028e5169e2c2635f3bd9cb4247bab287b44373bd506" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.90.1.150300.18.52.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="bd1f7b0c516c9bbdbb6d5ad06ab6b136fc6acae4c1c04ecc6f27b86eccb4cb69" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.93.1.150300.18.54.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="6cca93a9006019162c22f25885ec0f2c44a7b91c052769e735d349de24ab4afa" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.93.1.150300.18.54.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="b5a1f1c0ed9304f02c231017f7c895c39211f27c09cf01b4829ddec60481e01d" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.93.1.150300.18.54.1"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="fb944e6b0887312e421edccdbb729258aa839c0ab5efcfdbb32a1f67bd14bd10" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="150300.59.98.1.150300.18.56.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="fa59f5d70bd204cd35ac0fb86f76809d20c9904c3f920afd44dcc0c113ada372" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.59.98.1.150300.18.56.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="7a6b38fdbf1ff17ac763f8d16a0e1b304853e4eef7bbfe75f10ef4a15ca844cf" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.59.98.1.150300.18.56.3"/>
  <changelog author="fvogt@suse.com" date="1565870400">- Fix wildcard for ip6t_.*</changelog>
  <changelog author="gmoro@suse.com" date="1571054400">- Add Ceph modules (bsc#1149605)</changelog>
  <changelog author="msuchanek@suse.com" date="1572004800">- Add efivarfs required by mokutil (bsc#1154858).</changelog>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
</package>
<package pkgid="f8f5dc58a5c1f33bc8756b3f6f4a0a04af59382292eda9e180b26e7a9a9f3df0" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.106.1"/>
  <changelog author="oneukum@suse.com" date="1664971200">- media: coda: Fix reported H264 profile (git-fixes).
- commit af3ba3e</changelog>
  <changelog author="oneukum@suse.com" date="1664971201">- media: coda: Add more H264 levels for CODA960 (git-fixes).
- commit 6094fd3</changelog>
  <changelog author="oneukum@suse.com" date="1664971202">- media: aspeed-video: ignore interrupts that aren't enabled
  (git-fixes).
- commit 36a70fa</changelog>
  <changelog author="dwagner@suse.de" date="1665057600">- nvme: ensure subsystem reset is single threaded (bsc#1203290
  CVE-2022-3169).
- nvme: restrict management ioctls to admin (bsc#1203290
  CVE-2022-3169).
- commit fb89dd3</changelog>
  <changelog author="mgorman@suse.de" date="1665144000">- ACPI: processor idle: Practically limit "Dummy wait" workaround
  to old Intel systems (bnc#1203802).
- commit 5c74e0f</changelog>
  <changelog author="lduncan@suse.com" date="1665316800">- scsi: stex: Properly zero out the passthrough command structure
  (bsc#1203514 CVE-2022-40768).
- commit b5c1e4b</changelog>
  <changelog author="neilb@suse.de" date="1665403200">- blacklist.conf: ignore unwanted md patches
- commit ff9f04a</changelog>
  <changelog author="neilb@suse.de" date="1665403201">- blacklist.conf: ignore unwanted nfs patches
- commit 5bb5269</changelog>
  <changelog author="osalvador@suse.de" date="1665403202">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 3394628</changelog>
  <changelog author="osalvador@suse.de" date="1665403203">- Refresh metadata
  Refresh:
  patches.suse/nvme-ensure-subsystem-reset-is-single-threaded.patch
  patches.suse/nvme-restrict-management-ioctls-to-admin.patch
- commit 32aee9f</changelog>
  <changelog author="tiwai@suse.de" date="1665403204">- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- cfg80211: hold bss_lock while updating nontrans_list
  (CVE-2022-42719 bsc#1204051).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- mac80211: don't re-parse elems in ieee80211_assoc_success()
  (CVE-2022-42719 bsc#1204051).
- commit cf17eed</changelog>
  <changelog author="tiwai@suse.de" date="1665403205">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit 1d0e42c</changelog>
  <changelog author="tiwai@suse.de" date="1665403206">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 7b3171e</changelog>
  <changelog author="tiwai@suse.de" date="1665403207">- wifi: mac80211: fix MBSSID parsing use-after-free
  (CVE-2022-42719 bsc#1204051).
- commit 6462e9c</changelog>
  <changelog author="tiwai@suse.de" date="1665403208">- wifi: cfg80211: avoid nontransmitted BSS list corruption
  (CVE-2022-42721 bsc#1204060).
- commit 5fe81ec</changelog>
  <changelog author="tiwai@suse.de" date="1665403209">- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit a183a67</changelog>
  <changelog author="tiwai@suse.de" date="1665403210">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- commit a818808</changelog>
  <changelog author="tiwai@suse.de" date="1665403211">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 26c2d4f</changelog>
  <changelog author="tiwai@suse.de" date="1665403212">- wifi: mac80211: fix crash in beacon protection for P2P-device
  (CVE-2022-42722 bsc#1204125).
- commit a6f4ca8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1665662400">- Update metadata references
- commit 26d4ba7</changelog>
</package>
<package pkgid="f12d4793c4ccc94d22b35c60ffeb8bc2d8a97e031e4ee68d62fecb92bd8a8701" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.106.1"/>
  <changelog author="oneukum@suse.com" date="1664971200">- media: coda: Fix reported H264 profile (git-fixes).
- commit af3ba3e</changelog>
  <changelog author="oneukum@suse.com" date="1664971201">- media: coda: Add more H264 levels for CODA960 (git-fixes).
- commit 6094fd3</changelog>
  <changelog author="oneukum@suse.com" date="1664971202">- media: aspeed-video: ignore interrupts that aren't enabled
  (git-fixes).
- commit 36a70fa</changelog>
  <changelog author="dwagner@suse.de" date="1665057600">- nvme: ensure subsystem reset is single threaded (bsc#1203290
  CVE-2022-3169).
- nvme: restrict management ioctls to admin (bsc#1203290
  CVE-2022-3169).
- commit fb89dd3</changelog>
  <changelog author="mgorman@suse.de" date="1665144000">- ACPI: processor idle: Practically limit "Dummy wait" workaround
  to old Intel systems (bnc#1203802).
- commit 5c74e0f</changelog>
  <changelog author="lduncan@suse.com" date="1665316800">- scsi: stex: Properly zero out the passthrough command structure
  (bsc#1203514 CVE-2022-40768).
- commit b5c1e4b</changelog>
  <changelog author="neilb@suse.de" date="1665403200">- blacklist.conf: ignore unwanted md patches
- commit ff9f04a</changelog>
  <changelog author="neilb@suse.de" date="1665403201">- blacklist.conf: ignore unwanted nfs patches
- commit 5bb5269</changelog>
  <changelog author="osalvador@suse.de" date="1665403202">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 3394628</changelog>
  <changelog author="osalvador@suse.de" date="1665403203">- Refresh metadata
  Refresh:
  patches.suse/nvme-ensure-subsystem-reset-is-single-threaded.patch
  patches.suse/nvme-restrict-management-ioctls-to-admin.patch
- commit 32aee9f</changelog>
  <changelog author="tiwai@suse.de" date="1665403204">- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- wifi: cfg80211: fix BSS refcounting bugs (CVE-2022-42720
  bsc#1204059).
- cfg80211: hold bss_lock while updating nontrans_list
  (CVE-2022-42719 bsc#1204051).
- mac80211: mlme: find auth challenge directly (CVE-2022-42719
  bsc#1204051).
- mac80211: move CRC into struct ieee802_11_elems (CVE-2022-42719
  bsc#1204051).
- mac80211: don't re-parse elems in ieee80211_assoc_success()
  (CVE-2022-42719 bsc#1204051).
- commit cf17eed</changelog>
  <changelog author="tiwai@suse.de" date="1665403205">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit 1d0e42c</changelog>
  <changelog author="tiwai@suse.de" date="1665403206">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 7b3171e</changelog>
  <changelog author="tiwai@suse.de" date="1665403207">- wifi: mac80211: fix MBSSID parsing use-after-free
  (CVE-2022-42719 bsc#1204051).
- commit 6462e9c</changelog>
  <changelog author="tiwai@suse.de" date="1665403208">- wifi: cfg80211: avoid nontransmitted BSS list corruption
  (CVE-2022-42721 bsc#1204060).
- commit 5fe81ec</changelog>
  <changelog author="tiwai@suse.de" date="1665403209">- mac80211: always allocate struct ieee802_11_elems
  (CVE-2022-42719 bsc#1204051).
- commit a183a67</changelog>
  <changelog author="tiwai@suse.de" date="1665403210">- mac80211: fix memory leaks with element parsing (CVE-2022-42719
  bsc#1204051).
- commit a818808</changelog>
  <changelog author="tiwai@suse.de" date="1665403211">- wifi: mac80211: refactor elements parsing with parameter struct
  (CVE-2022-42719 bsc#1204051).
- commit 26c2d4f</changelog>
  <changelog author="tiwai@suse.de" date="1665403212">- wifi: mac80211: fix crash in beacon protection for P2P-device
  (CVE-2022-42722 bsc#1204125).
- commit a6f4ca8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1665662400">- Update metadata references
- commit 26d4ba7</changelog>
</package>
<package pkgid="708876b89e0429b1ad09d6a7df2c9e3519a0523e9c5e819707baaf71f6ba14c5" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.109.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217600">- RDMA/siw: Fix a condition race issue in MPA request processing (git-fixes)
- commit 709fd3a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217601">- RDMA/hns: Remove unnecessary check for the sgid_attr when modifying QP (git-fixes)
- commit e806a5b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217602">- RDMA/rxe: Generate a completion for unsupported/invalid opcode (git-fixes)
- commit 92bff10</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217603">- RDMA/hfi1: Fix potential integer multiplication overflow errors (git-fixes)
- commit 9d4253b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217604">- RDMA/qedr: Fix reporting QP timeout attribute (git-fixes)
- commit 26de3e3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217605">- RDMA/cm: Fix memory leak in ib_cm_insert_listen (git-fixes)
- commit 3ec31d2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217606">- RDMA: remove useless condition in siw_create_cq() (git-fixes)
- commit 4c36066</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217607">- RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (git-fixes)
- commit e28b8f5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217608">- RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event (git-fixes)
- commit c8db39b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217609">- RDMA/rxe: Fix rnr retry behavior (git-fixes)
- commit db88b1b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217610">- RDMA/mlx5: Add missing check for return value in get namespace flow (git-fixes)
- commit 19e84c3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217611">- RDMA/rxe: Fix error unwind in rxe_create_qp() (git-fixes)
- commit 4332868</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217612">- RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL (git-fixes)
- commit cc2cd02</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217613">- RDMA/cma: Fix arguments order in net device validation (git-fixes)
- commit 7890ffd</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217614">- RDMA/siw: Pass a pointer to virt_to_page() (git-fixes)
- commit 7daf160</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217615">- RDMA/rxe: Fix "kernel NULL pointer dereference" error (git-fixes)
- commit 9205fa0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217616">- RDMA/rxe: Fix the error caused by qp-&gt;sk (git-fixes)
- commit 6d0ef48</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217617">- RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. (git-fixes)
- commit d355c79</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217618">- IB/rdmavt: Add __init/__exit annotations to module init/exit funcs (git-fixes)
- commit f7baf6a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217619">- RDMA/usnic: fix set-but-not-unused variable 'flags' warning (git-fixes)
- commit 293bf91</changelog>
</package>
<package pkgid="59cea7c576d46ff410cb5e74fa7e36b48917de14fa0144426af530aa3b996ed1" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.109.1"/>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217600">- RDMA/siw: Fix a condition race issue in MPA request processing (git-fixes)
- commit 709fd3a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217601">- RDMA/hns: Remove unnecessary check for the sgid_attr when modifying QP (git-fixes)
- commit e806a5b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217602">- RDMA/rxe: Generate a completion for unsupported/invalid opcode (git-fixes)
- commit 92bff10</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217603">- RDMA/hfi1: Fix potential integer multiplication overflow errors (git-fixes)
- commit 9d4253b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217604">- RDMA/qedr: Fix reporting QP timeout attribute (git-fixes)
- commit 26de3e3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217605">- RDMA/cm: Fix memory leak in ib_cm_insert_listen (git-fixes)
- commit 3ec31d2</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217606">- RDMA: remove useless condition in siw_create_cq() (git-fixes)
- commit 4c36066</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217607">- RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() (git-fixes)
- commit e28b8f5</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217608">- RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event (git-fixes)
- commit c8db39b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217609">- RDMA/rxe: Fix rnr retry behavior (git-fixes)
- commit db88b1b</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217610">- RDMA/mlx5: Add missing check for return value in get namespace flow (git-fixes)
- commit 19e84c3</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217611">- RDMA/rxe: Fix error unwind in rxe_create_qp() (git-fixes)
- commit 4332868</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217612">- RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL (git-fixes)
- commit cc2cd02</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217613">- RDMA/cma: Fix arguments order in net device validation (git-fixes)
- commit 7890ffd</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217614">- RDMA/siw: Pass a pointer to virt_to_page() (git-fixes)
- commit 7daf160</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217615">- RDMA/rxe: Fix "kernel NULL pointer dereference" error (git-fixes)
- commit 9205fa0</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217616">- RDMA/rxe: Fix the error caused by qp-&gt;sk (git-fixes)
- commit 6d0ef48</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217617">- RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. (git-fixes)
- commit d355c79</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217618">- IB/rdmavt: Add __init/__exit annotations to module init/exit funcs (git-fixes)
- commit f7baf6a</changelog>
  <changelog author="nmoreychaisemartin@suse.com" date="1667217619">- RDMA/usnic: fix set-but-not-unused variable 'flags' warning (git-fixes)
- commit 293bf91</changelog>
</package>
<package pkgid="e037544cf2636b9af075686b709e4adb42b36dc868eb93504101a259bfe0a410" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.112.1"/>
  <changelog author="jgross@suse.com" date="1669809600">- blacklist.conf: add 5c13a4a0291b3019
- commit f414b37</changelog>
  <changelog author="jgross@suse.com" date="1669809601">- xen/privcmd: Corrected error handling path (git-fixes).
- commit 9273ea4</changelog>
  <changelog author="jgross@suse.com" date="1669809602">- xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  (git-fixes).
- commit a2d69de</changelog>
  <changelog author="tiwai@suse.de" date="1669809603">- net: ethernet: renesas: ravb: Fix promiscuous mode after system
  resumed (git-fixes).
- wifi: mac8021: fix possible oob access in
  ieee80211_get_rate_duration (git-fixes).
- wifi: cfg80211: fix buffer overflow in elem comparison
  (git-fixes).
- net: ethernet: nixge: fix NULL dereference (git-fixes).
- net: phy: fix null-ptr-deref while probe() failed (git-fixes).
- can: cc770: cc770_isa_probe(): add missing free_cc770dev()
  (git-fixes).
- can: sja1000_isa: sja1000_isa_probe(): add missing
  free_sja1000dev() (git-fixes).
- commit c233552</changelog>
  <changelog author="tiwai@suse.de" date="1669896000">- Move upstreamed i915 patch into sorted section
- commit 4f7c541</changelog>
  <changelog author="tiwai@suse.de" date="1669896001">- Update patch reference for ATM fix (CVE-2022-3635 bsc#1204631)
- commit f11d21c</changelog>
  <changelog author="tiwai@suse.de" date="1669896002">- atm: idt77252: fix use-after-free bugs caused by tst_timer
  (CVE-2022-3635 bsc#1204631).
- commit 81a86f3</changelog>
  <changelog author="ematsumiya@suse.de" date="1669982400">- cifs: skip extra NULL byte in filenames (bsc#1204791).
- commit 482b418</changelog>
  <changelog author="tiwai@suse.de" date="1669982401">- hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
  (git-fixes).
- hwmon: (coretemp) Check for null before removing sysfs attrs
  (git-fixes).
- hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc()
  fails (git-fixes).
- hwmon: (i5500_temp) fix missing pci_disable_device()
  (git-fixes).
- commit fdf27d9</changelog>
  <changelog author="ddiss@suse.de" date="1669982402">- io_uring/af_unix: defer registered files gc to io_uring release
  (bsc#1204228 CVE-2022-2602).
- commit fee5862</changelog>
  <changelog author="ddiss@suse.de" date="1669982403">- kabi: sk_buff.scm_io_uring (bsc#1204228 CVE-2022-2602).
- commit 1cb9473</changelog>
  <changelog author="lhenriques@suse.de" date="1669982404">- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1205989).
- ceph: lockdep annotations for try_nonblocking_invalidate
  (bsc#1205988).
- ceph: request Fw caps before updating the mtime in
  ceph_write_iter (bsc#1205987).
- ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
  (bsc#1205986).
- ceph: fix fscache invalidation (bsc#1205985).
- ceph: do not access the kiocb after aio requests (bsc#1205984).
- commit 3a3eff6</changelog>
  <changelog author="lduncan@suse.com" date="1669982405">- Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
- commit 2043e6b</changelog>
  <changelog author="jslaby@suse.cz" date="1670241600">- Update
  patches.suse/x86-bugs-Add-AMD-retbleed-boot-parameter.patch
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901 bsc#1203271
  bsc#1206032).
- Refresh patches.suse/x86-bugs-Add-retbleed-ibpb.patch.
- Refresh patches.suse/x86-bugs-Enable-STIBP-for-JMP2RET.patch.
  Fix mitigations=off to imply retbleed=off (bsc#1206032).
- commit f959a8e</changelog>
  <changelog author="jslaby@suse.cz" date="1670241601">- docs/kernel-parameters: Update descriptions for "mitigations="
  param with retbleed (bsc#1199657 CVE-2022-29900 CVE-2022-29901
  bsc#1203271 bsc#1206032).
- commit 012ee9f</changelog>
  <changelog author="osalvador@suse.de" date="1670241602">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ff0c181</changelog>
  <changelog author="jslaby@suse.cz" date="1670414400">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit df768bd</changelog>
  <changelog author="jslaby@suse.cz" date="1670414401">- Refresh
  patches.suse/x86-speculation-Disable-RRSBA-behavior.patch.
  Fix up after merge from cve/5.3. The patch can be closer to upstream in
  15sp3 as we have more than in the cve branch.
- commit 344ce75</changelog>
  <changelog author="oneukum@suse.com" date="1670414402">- Refresh
  patches.kabi/kABI-remove-new-member-of-usbip_device.patch.
- commit bf09767</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (CVE-2022-4378 bsc#1206207).
- proc: avoid integer type confusion in get_proc_long
  (CVE-2022-4378 bsc#1206207).
- commit 1e50bbf</changelog>
</package>
<package pkgid="2256747f6351311374b45854ce1157c7e431078916928b6598dc1683276af4d8" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.112.1"/>
  <changelog author="jgross@suse.com" date="1669809600">- blacklist.conf: add 5c13a4a0291b3019
- commit f414b37</changelog>
  <changelog author="jgross@suse.com" date="1669809601">- xen/privcmd: Corrected error handling path (git-fixes).
- commit 9273ea4</changelog>
  <changelog author="jgross@suse.com" date="1669809602">- xen/privcmd: fix error exit of privcmd_ioctl_dm_op()
  (git-fixes).
- commit a2d69de</changelog>
  <changelog author="tiwai@suse.de" date="1669809603">- net: ethernet: renesas: ravb: Fix promiscuous mode after system
  resumed (git-fixes).
- wifi: mac8021: fix possible oob access in
  ieee80211_get_rate_duration (git-fixes).
- wifi: cfg80211: fix buffer overflow in elem comparison
  (git-fixes).
- net: ethernet: nixge: fix NULL dereference (git-fixes).
- net: phy: fix null-ptr-deref while probe() failed (git-fixes).
- can: cc770: cc770_isa_probe(): add missing free_cc770dev()
  (git-fixes).
- can: sja1000_isa: sja1000_isa_probe(): add missing
  free_sja1000dev() (git-fixes).
- commit c233552</changelog>
  <changelog author="tiwai@suse.de" date="1669896000">- Move upstreamed i915 patch into sorted section
- commit 4f7c541</changelog>
  <changelog author="tiwai@suse.de" date="1669896001">- Update patch reference for ATM fix (CVE-2022-3635 bsc#1204631)
- commit f11d21c</changelog>
  <changelog author="tiwai@suse.de" date="1669896002">- atm: idt77252: fix use-after-free bugs caused by tst_timer
  (CVE-2022-3635 bsc#1204631).
- commit 81a86f3</changelog>
  <changelog author="ematsumiya@suse.de" date="1669982400">- cifs: skip extra NULL byte in filenames (bsc#1204791).
- commit 482b418</changelog>
  <changelog author="tiwai@suse.de" date="1669982401">- hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
  (git-fixes).
- hwmon: (coretemp) Check for null before removing sysfs attrs
  (git-fixes).
- hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc()
  fails (git-fixes).
- hwmon: (i5500_temp) fix missing pci_disable_device()
  (git-fixes).
- commit fdf27d9</changelog>
  <changelog author="ddiss@suse.de" date="1669982402">- io_uring/af_unix: defer registered files gc to io_uring release
  (bsc#1204228 CVE-2022-2602).
- commit fee5862</changelog>
  <changelog author="ddiss@suse.de" date="1669982403">- kabi: sk_buff.scm_io_uring (bsc#1204228 CVE-2022-2602).
- commit 1cb9473</changelog>
  <changelog author="lhenriques@suse.de" date="1669982404">- ceph: allow ceph.dir.rctime xattr to be updatable (bsc#1205989).
- ceph: lockdep annotations for try_nonblocking_invalidate
  (bsc#1205988).
- ceph: request Fw caps before updating the mtime in
  ceph_write_iter (bsc#1205987).
- ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty
  (bsc#1205986).
- ceph: fix fscache invalidation (bsc#1205985).
- ceph: do not access the kiocb after aio requests (bsc#1205984).
- commit 3a3eff6</changelog>
  <changelog author="lduncan@suse.com" date="1669982405">- Do not enable CONFIG_ATARI_PARTITION (jsc#PED-1573)
- commit 2043e6b</changelog>
  <changelog author="jslaby@suse.cz" date="1670241600">- Update
  patches.suse/x86-bugs-Add-AMD-retbleed-boot-parameter.patch
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901 bsc#1203271
  bsc#1206032).
- Refresh patches.suse/x86-bugs-Add-retbleed-ibpb.patch.
- Refresh patches.suse/x86-bugs-Enable-STIBP-for-JMP2RET.patch.
  Fix mitigations=off to imply retbleed=off (bsc#1206032).
- commit f959a8e</changelog>
  <changelog author="jslaby@suse.cz" date="1670241601">- docs/kernel-parameters: Update descriptions for "mitigations="
  param with retbleed (bsc#1199657 CVE-2022-29900 CVE-2022-29901
  bsc#1203271 bsc#1206032).
- commit 012ee9f</changelog>
  <changelog author="osalvador@suse.de" date="1670241602">- Rename colliding patches before the next cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit ff0c181</changelog>
  <changelog author="jslaby@suse.cz" date="1670414400">- x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon
  resume from S3 (bsc#1206037).
- commit df768bd</changelog>
  <changelog author="jslaby@suse.cz" date="1670414401">- Refresh
  patches.suse/x86-speculation-Disable-RRSBA-behavior.patch.
  Fix up after merge from cve/5.3. The patch can be closer to upstream in
  15sp3 as we have more than in the cve branch.
- commit 344ce75</changelog>
  <changelog author="oneukum@suse.com" date="1670414402">- Refresh
  patches.kabi/kABI-remove-new-member-of-usbip_device.patch.
- commit bf09767</changelog>
  <changelog author="tiwai@suse.de" date="1670587200">- proc: proc_skip_spaces() shouldn't think it is working on C
  strings (CVE-2022-4378 bsc#1206207).
- proc: avoid integer type confusion in get_proc_long
  (CVE-2022-4378 bsc#1206207).
- commit 1e50bbf</changelog>
</package>
<package pkgid="b039f51fb3e35f25a95cb9ccbd62d6d9dd2c1ff1ea2a410e6940a044c12e71b4" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.115.1"/>
  <changelog author="petr.pavlu@suse.com" date="1671019200">- tracing/dynevent: Delete all matched events (git-fixes).
- commit dcf29de</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019201">- tracing: Free buffers when a used dynamic event is removed
  (git-fixes).
- commit 3703499</changelog>
  <changelog author="oneukum@suse.com" date="1671019202">- dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
  (git-fixes).
- commit 4972874</changelog>
  <changelog author="oneukum@suse.com" date="1671105600">- blacklist.conf: cosmetic, does not fix a bug
- commit c7bc28a</changelog>
  <changelog author="pmladek@suse.com" date="1671105601">- Update
  patches.suse/power-supply-wm8350-power-Add-missing-free-in-free_c.patch
  (CVE-2022-3111 bsc#1206394 git-fixes).
- commit 2ff0fd7</changelog>
  <changelog author="pmladek@suse.com" date="1671105602">- Update
  patches.suse/msft-hv-2553-hv_netvsc-Add-check-for-kvmalloc_array.patch
  (CVE-2022-3107 bsc#1206395 git-fixes).
- commit d5698e3</changelog>
  <changelog author="pmladek@suse.com" date="1671105603">- Update
  patches.suse/sfc_ef100-potential-dereference-of-null-pointer.patch
  (jsc#SLE-16683 CVE-2022-3106 bsc#1206397).
- commit 3e8cb15</changelog>
  <changelog author="pmladek@suse.com" date="1671105604">- RDMA/uverbs: Check for null return of kmalloc_array
  (CVE-2022-3105 bsc#1206398 git-fixes).
- commit 73b6bff</changelog>
  <changelog author="pmladek@suse.com" date="1671105605">- Update
  patches.suse/drm-amdkfd-Check-for-null-pointer-after-calling-kmem.patch
  (CVE-2022-3108 bsc#1206389 git-fixes).
- commit 7c181a5</changelog>
  <changelog author="pmladek@suse.com" date="1671192000">- Update
  patches.suse/RDMA-uverbs-Check-for-null-return-of-kmalloc_array.patch
  (CVE-2022-3105 bsc#1206398 git-fixes).
- commit 66cd628</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1671192001">- Update metadata references
- commit 71ea896</changelog>
  <changelog author="oneukum@suse.com" date="1671451200">- efi: Add iMac Pro 2017 to uefi skip cert quirk (git-fixes).
- commit 1dc7c8f</changelog>
  <changelog author="oneukum@suse.com" date="1671537600">- rtc: pcf85063: Fix reading alarm (git-fixes).
- commit 3b1fc33</changelog>
  <changelog author="oneukum@suse.com" date="1671537601">- net: usb: qmi_wwan: add u-blox 0x1342 composition (git-fixes).
- commit 47e48bc</changelog>
  <changelog author="oneukum@suse.com" date="1671624000">- net: usb: cdc_ncm: don't spew notifications (git-fixes).
- Refresh
  patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch.
- commit 6bb9cb6</changelog>
  <changelog author="oneukum@suse.com" date="1671624001">- struct usbnet: move new members to end (git-fixes).
- commit f647bb2</changelog>
  <changelog author="vkarasulli@suse.de" date="1672228800">- USB: core: Prevent nested device-reset calls (bsc#1206664
  CVE-2022-4662).
- commit 2d03a85</changelog>
  <changelog author="vkarasulli@suse.de" date="1672228801">- Fix kABI breakage in usb.h: struct usb_device:
  hide new member (bsc#1206664 CVE-2022-4662).
- commit a53ec27</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265600">- net: ipv4: fix route with nexthop object delete warning
  (bsc#1204171 CVE-2022-3435).
- commit 51fb670</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265601">- ipv4: Handle attempt to delete multipath route when fib_info
  contains an nh reference (bsc#1204171 CVE-2022-3435).
- commit d2a1bb2</changelog>
</package>
<package pkgid="676b6b7f467cd8aba70aa1fe592be56ff29f1735a9ab9bcdebbbcaf82b26c40e" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.115.1"/>
  <changelog author="petr.pavlu@suse.com" date="1671019200">- tracing/dynevent: Delete all matched events (git-fixes).
- commit dcf29de</changelog>
  <changelog author="petr.pavlu@suse.com" date="1671019201">- tracing: Free buffers when a used dynamic event is removed
  (git-fixes).
- commit 3703499</changelog>
  <changelog author="oneukum@suse.com" date="1671019202">- dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
  (git-fixes).
- commit 4972874</changelog>
  <changelog author="oneukum@suse.com" date="1671105600">- blacklist.conf: cosmetic, does not fix a bug
- commit c7bc28a</changelog>
  <changelog author="pmladek@suse.com" date="1671105601">- Update
  patches.suse/power-supply-wm8350-power-Add-missing-free-in-free_c.patch
  (CVE-2022-3111 bsc#1206394 git-fixes).
- commit 2ff0fd7</changelog>
  <changelog author="pmladek@suse.com" date="1671105602">- Update
  patches.suse/msft-hv-2553-hv_netvsc-Add-check-for-kvmalloc_array.patch
  (CVE-2022-3107 bsc#1206395 git-fixes).
- commit d5698e3</changelog>
  <changelog author="pmladek@suse.com" date="1671105603">- Update
  patches.suse/sfc_ef100-potential-dereference-of-null-pointer.patch
  (jsc#SLE-16683 CVE-2022-3106 bsc#1206397).
- commit 3e8cb15</changelog>
  <changelog author="pmladek@suse.com" date="1671105604">- RDMA/uverbs: Check for null return of kmalloc_array
  (CVE-2022-3105 bsc#1206398 git-fixes).
- commit 73b6bff</changelog>
  <changelog author="pmladek@suse.com" date="1671105605">- Update
  patches.suse/drm-amdkfd-Check-for-null-pointer-after-calling-kmem.patch
  (CVE-2022-3108 bsc#1206389 git-fixes).
- commit 7c181a5</changelog>
  <changelog author="pmladek@suse.com" date="1671192000">- Update
  patches.suse/RDMA-uverbs-Check-for-null-return-of-kmalloc_array.patch
  (CVE-2022-3105 bsc#1206398 git-fixes).
- commit 66cd628</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1671192001">- Update metadata references
- commit 71ea896</changelog>
  <changelog author="oneukum@suse.com" date="1671451200">- efi: Add iMac Pro 2017 to uefi skip cert quirk (git-fixes).
- commit 1dc7c8f</changelog>
  <changelog author="oneukum@suse.com" date="1671537600">- rtc: pcf85063: Fix reading alarm (git-fixes).
- commit 3b1fc33</changelog>
  <changelog author="oneukum@suse.com" date="1671537601">- net: usb: qmi_wwan: add u-blox 0x1342 composition (git-fixes).
- commit 47e48bc</changelog>
  <changelog author="oneukum@suse.com" date="1671624000">- net: usb: cdc_ncm: don't spew notifications (git-fixes).
- Refresh
  patches.suse/0002-Add-a-void-suse_kabi_padding-placeholder-to-some-USB.patch.
- commit 6bb9cb6</changelog>
  <changelog author="oneukum@suse.com" date="1671624001">- struct usbnet: move new members to end (git-fixes).
- commit f647bb2</changelog>
  <changelog author="vkarasulli@suse.de" date="1672228800">- USB: core: Prevent nested device-reset calls (bsc#1206664
  CVE-2022-4662).
- commit 2d03a85</changelog>
  <changelog author="vkarasulli@suse.de" date="1672228801">- Fix kABI breakage in usb.h: struct usb_device:
  hide new member (bsc#1206664 CVE-2022-4662).
- commit a53ec27</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265600">- net: ipv4: fix route with nexthop object delete warning
  (bsc#1204171 CVE-2022-3435).
- commit 51fb670</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265601">- ipv4: Handle attempt to delete multipath route when fib_info
  contains an nh reference (bsc#1204171 CVE-2022-3435).
- commit d2a1bb2</changelog>
</package>
<package pkgid="3d048ded81956ad37af09488dd73090dea5355f8ab70a1fc8154ca6fd704f012" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.118.1"/>
  <changelog author="msuchanek@suse.de" date="1673006400">- powerpc: Ensure that swiotlb buffer is allocated from low memory
  (bsc#1156395).
- commit 6657d5f</changelog>
  <changelog author="msuchanek@suse.de" date="1673006401">- blacklist.conf: Add reverted commit
- commit 1048706</changelog>
  <changelog author="msuchanek@suse.de" date="1673006402">- powerpc/powernv: add missing of_node_put (bsc#1065729).
- powerpc/boot: Fixup device-tree on little endian (bsc#1065729).
- powerpc/pseries: Stop calling printk in rtas_stop_self()
  (bsc#1065729).
- powerpc: Force inlining of cpu_has_feature() to avoid build
  failure (bsc#1065729).
- powerpc: improve handling of unrecoverable system reset
  (bsc#1065729).
- powerpc: sysdev: add missing iounmap() on error in
  mpic_msgr_probe() (bsc#1065729).
- powerpc/powernv/smp: Fix spurious DBG() warning (bsc#1065729).
- powerpc/crashkernel: Take "mem=" option into account
  (bsc#1065729).
- powerpc/64s/pgtable: fix an undefined behaviour (bsc#1065729).
- powerpc/eeh: Only dump stack once if an MMIO loop is detected
  (bsc#1065729).
- powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
  (bsc#1065729).
- powerpc/powernv/iov: Ensure the pdn for VFs always contains
  a valid PE number (bsc#1065729).
- commit f1282a1</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265600">- tracing: Verify if trace array exists before destroying it
  (git-fixes).
- commit 484ce03</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265601">- module: Remove accidental change of module_enable_x()
  (git-fixes).
- commit c1799c7</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265602">- modules: lockdep: Suppress suspicious RCU usage warning
  (git-fixes).
- commit a75abac</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265603">- module: set MODULE_STATE_GOING state when a module fails to load
  (git-fixes).
- commit bbf8a43</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265604">- module: merge repetitive strings in module_sig_check()
  (git-fixes).
- commit e890371</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265605">- module: avoid *goto*s in module_sig_check() (git-fixes).
- commit 95dc2c1</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265606">- net: ipv4: fix route with nexthop object delete warning
  (bsc#1204171 CVE-2022-3435).
- commit 51fb670</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265607">- ipv4: Handle attempt to delete multipath route when fib_info
  contains an nh reference (bsc#1204171 CVE-2022-3435).
- commit d2a1bb2</changelog>
  <changelog author="iivanov@suse.de" date="1673352000">- README.BRANCH: Added myself as co-maintainer
  And drop Oscars name.
- commit 0607a55</changelog>
  <changelog author="fdmanana@suse.com" date="1673438400">- Refresh
  patches.suse/btrfs-avoid-unnecessary-lock-and-leaf-splits-when-up.patch.
  For bsc#1206904, see:
  https://bugzilla.suse.com/show_bug.cgi?id=1206904#c6
- commit dfcd116</changelog>
  <changelog author="msuchanek@suse.de" date="1673438401">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 8b8572d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524800">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 0726009</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524801">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 49dc51c</changelog>
  <changelog author="msuchanek@suse.de" date="1673611200">- powerpc/rtas: avoid scheduling in rtas_os_term() (bsc#1065729).
- powerpc/rtas: avoid device tree lookups in rtas_os_term()
  (bsc#1065729).
- commit da7ea39</changelog>
  <changelog author="lduncan@suse.com" date="1673784000">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit ebdddc5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870400">- Update
  patches.suse/net-sched-atm-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207125 CVE-2023-23455).
- commit e595908</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870401">- Update
  patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207036 CVE-2023-23454).
- commit 88c4e72</changelog>
</package>
<package pkgid="c78a7d5bbe0689b4aec693b7e7157325f342b9f5fc4d784bad6a83deefa404d0" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.118.1"/>
  <changelog author="msuchanek@suse.de" date="1673006400">- powerpc: Ensure that swiotlb buffer is allocated from low memory
  (bsc#1156395).
- commit 6657d5f</changelog>
  <changelog author="msuchanek@suse.de" date="1673006401">- blacklist.conf: Add reverted commit
- commit 1048706</changelog>
  <changelog author="msuchanek@suse.de" date="1673006402">- powerpc/powernv: add missing of_node_put (bsc#1065729).
- powerpc/boot: Fixup device-tree on little endian (bsc#1065729).
- powerpc/pseries: Stop calling printk in rtas_stop_self()
  (bsc#1065729).
- powerpc: Force inlining of cpu_has_feature() to avoid build
  failure (bsc#1065729).
- powerpc: improve handling of unrecoverable system reset
  (bsc#1065729).
- powerpc: sysdev: add missing iounmap() on error in
  mpic_msgr_probe() (bsc#1065729).
- powerpc/powernv/smp: Fix spurious DBG() warning (bsc#1065729).
- powerpc/crashkernel: Take "mem=" option into account
  (bsc#1065729).
- powerpc/64s/pgtable: fix an undefined behaviour (bsc#1065729).
- powerpc/eeh: Only dump stack once if an MMIO loop is detected
  (bsc#1065729).
- powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
  (bsc#1065729).
- powerpc/powernv/iov: Ensure the pdn for VFs always contains
  a valid PE number (bsc#1065729).
- commit f1282a1</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265600">- tracing: Verify if trace array exists before destroying it
  (git-fixes).
- commit 484ce03</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265601">- module: Remove accidental change of module_enable_x()
  (git-fixes).
- commit c1799c7</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265602">- modules: lockdep: Suppress suspicious RCU usage warning
  (git-fixes).
- commit a75abac</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265603">- module: set MODULE_STATE_GOING state when a module fails to load
  (git-fixes).
- commit bbf8a43</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265604">- module: merge repetitive strings in module_sig_check()
  (git-fixes).
- commit e890371</changelog>
  <changelog author="petr.pavlu@suse.com" date="1673265605">- module: avoid *goto*s in module_sig_check() (git-fixes).
- commit 95dc2c1</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265606">- net: ipv4: fix route with nexthop object delete warning
  (bsc#1204171 CVE-2022-3435).
- commit 51fb670</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673265607">- ipv4: Handle attempt to delete multipath route when fib_info
  contains an nh reference (bsc#1204171 CVE-2022-3435).
- commit d2a1bb2</changelog>
  <changelog author="iivanov@suse.de" date="1673352000">- README.BRANCH: Added myself as co-maintainer
  And drop Oscars name.
- commit 0607a55</changelog>
  <changelog author="fdmanana@suse.com" date="1673438400">- Refresh
  patches.suse/btrfs-avoid-unnecessary-lock-and-leaf-splits-when-up.patch.
  For bsc#1206904, see:
  https://bugzilla.suse.com/show_bug.cgi?id=1206904#c6
- commit dfcd116</changelog>
  <changelog author="msuchanek@suse.de" date="1673438401">- ibmveth: Always stop tx queues during close (bsc#1065729).
- commit 8b8572d</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524800">- net: sched: cbq: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 0726009</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673524801">- net: sched: atm: dont intepret cls results when asked to drop
  (bsc#1207036).
- commit 49dc51c</changelog>
  <changelog author="msuchanek@suse.de" date="1673611200">- powerpc/rtas: avoid scheduling in rtas_os_term() (bsc#1065729).
- powerpc/rtas: avoid device tree lookups in rtas_os_term()
  (bsc#1065729).
- commit da7ea39</changelog>
  <changelog author="lduncan@suse.com" date="1673784000">- drbd: destroy workqueue when drbd device was freed (git-fixes).
- drbd: use after free in drbd_create_device() (git-fixes).
- drbd: remove usage of list iterator variable after loop
  (git-fixes).
- commit ebdddc5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870400">- Update
  patches.suse/net-sched-atm-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207125 CVE-2023-23455).
- commit e595908</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1673870401">- Update
  patches.suse/net-sched-cbq-dont-intepret-cls-results-when-asked-t.patch
  (bsc#1207036 CVE-2023-23454).
- commit 88c4e72</changelog>
</package>
<package pkgid="3286d9d2b35f966caafee7e20357c762a120be7ace74dde56cdbb1503afcb3d3" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.93.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1655380800">- igmp: Add ip_mc_list lock in ip_check_mc_rcu (bsc#1200604
  CVE-2022-20141).
- commit 34bf464</changelog>
  <changelog author="mgorman@suse.de" date="1655726400">- Update -rt config files.
- commit b1cf921</changelog>
</package>
<package pkgid="1271b4871098f95028e518e243036dcaf5ec47fc214f513fd2bd2d3bb1630a0e" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.93.1"/>
  <changelog author="jgross@suse.com" date="1654862400">- KVM: x86: Fix emulation in writing cr8 (git-fixes).
- commit a28f4e5</changelog>
  <changelog author="jgross@suse.com" date="1654862401">- KVM: x86/emulator: Defer not-present segment check in
  __load_segment_descriptor() (git-fixes).
- commit 27bee90</changelog>
  <changelog author="jgross@suse.com" date="1654862402">- kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has
  architectural PMU (git-fixes).
- commit b46bf26</changelog>
  <changelog author="ohering@suse.de" date="1655121600">- PCI: hv: Fix NUMA node assignment when kernel boots with custom
  NUMA topology (bsc#1199365).
- commit 533234b</changelog>
  <changelog author="jack@suse.cz" date="1655121601">- blk-mq: fix tag_get wait task can't be awakened (bsc#1200263).
- commit 0a1fb57</changelog>
  <changelog author="jack@suse.cz" date="1655121602">- blk-mq: Fix wrong wakeup batch configuration which will cause
  hang (bsc#1200263).
- commit d25a54b</changelog>
  <changelog author="osalvador@suse.de" date="1655208000">- Rename colliding patches before the next origin/cve/linux-5.3 -&gt; SLE15-SP3 merge
- commit 070ca14</changelog>
  <changelog author="neilb@suse.de" date="1655208001">- NFS: Don't report ENOSPC write errors twice (git-fixes).
- nfsd: Fix null-ptr-deref in nfsd_fill_super() (git-fixes).
- md: fix an incorrect NULL check in md_reload_sb (git-fixes).
- md: fix an incorrect NULL check in does_sb_need_changing
  (git-fixes).
- raid5: introduce MD_BROKEN (git-fixes).
- commit a49fc21</changelog>
  <changelog author="ptesarik@suse.cz" date="1655208002">- s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST
  flag (git-fixes).
- s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
  (git-fixes).
- s390/lcs: fix variable dereferenced before check (git-fixes).
- s390/ctcm: fix potential memory leak (git-fixes).
- s390/ctcm: fix variable dereferenced before check (git-fixes).
- s390/dasd: Fix read inconsistency for ESE DASD devices
  (bsc#1200206 LTC#198455).
- s390/dasd: Fix read for ESE with blksize &lt; 4k (bsc#1200206
  LTC#198455).
- s390/dasd: prevent double format of tracks for ESE devices
  (bsc#1200207 LTC#198454).
- s390/dasd: fix data corruption for ESE devices (bsc#1200207
  LTC#198454).
- KVM: s390: vsie/gmap: reduce gmap_rmap overhead (git-fixes).
- s390/nmi: handle vector validity failures for KVM guests
  (git-fixes).
- s390/nmi: handle guarded storage validity failures for KVM
  guests (git-fixes).
- vfio/ccw: Remove unneeded GFP_DMA (git-fixes).
- KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm (git-fixes).
- KVM: s390: pv: avoid double free of sida page (git-fixes).
- KVM: s390: pv: add macros for UVC CC values (git-fixes).
- s390: fix strrchr() implementation (git-fixes).
- s390/pv: fix the forcing of the swiotlb (git-fixes).
- s390/qdio: cancel the ESTABLISH ccw after timeout (git-fixes).
- s390/qdio: fix roll-back after timeout on ESTABLISH ccw
  (git-fixes).
- s390/ftrace: fix ftrace_update_ftrace_func implementation
  (git-fixes).
- s390/cio: dont call css_wait_for_slow_path() inside a lock
  (git-fixes).
- s390/cio: Fix the "type" field in s390_cio_tpi tracepoint
  (git-fixes).
- s390/mcck: fix invalid KVM guest condition check (git-fixes).
- vfio-ccw: Check initialized flag in cp_init() (git-fixes).
- s390: fix detection of vector enhancements facility 1 vs. vector
  packed decimal facility (git-fixes).
- s390/vfio-ap: fix circular lockdep when setting/clearing crypto
  masks (git-fixes).
- virtio/s390: implement virtio-ccw revision 2 correctly
  (git-fixes).
- commit 61a09d5</changelog>
  <changelog author="osalvador@suse.de" date="1655208003">- Update config files
- commit 0d6e862</changelog>
  <changelog author="oneukum@suse.com" date="1655208004">- platform/x86: wmi: Replace read_takes_no_args with a flags field
  (git-fixes).
- commit 2771a0e</changelog>
  <changelog author="oneukum@suse.com" date="1655208005">- platform/x86: wmi: Fix driver-&gt;notify() vs -&gt;probe() race
  (git-fixes).
- commit e932131</changelog>
  <changelog author="osalvador@suse.de" date="1655208006">- Refresh 0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch
- commit 4835ae7</changelog>
  <changelog author="tiwai@suse.de" date="1655294400">- ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  (git-fixes).
- ALSA: hda/conexant - Fix loopback issue with CX20632
  (git-fixes).
- ALSA: usb-audio: Set up (implicit) sync for Saffire 6
  (git-fixes).
- ALSA: usb-audio: Skip generic sync EP parse for secondary EP
  (git-fixes).
- clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map()
  return value (git-fixes).
- clocksource/drivers/sp804: Avoid error on multiple instances
  (git-fixes).
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size
  data type (git-fixes).
- ASoC: max98357a: remove dependency on GPIOLIB (git-fixes).
- ASoC: rt5645: Fix errorenous cleanup order (git-fixes).
- ASoC: tscs454: Add endianness flag in snd_soc_component_driver
  (git-fixes).
- ASoC: dapm: Don't fold register value changes into notifications
  (git-fixes).
- ALSA: usb-audio: Workaround for clock setup on TEAC devices
  (git-fixes).
- ath9k: fix QCA9561 PA bias level (git-fixes).
- b43: Fix assigning negative value to unsigned variable
  (git-fixes).
- b43legacy: Fix assigning negative value to unsigned variable
  (git-fixes).
- ACPI: sysfs: Fix BERT error region memory mapping (git-fixes).
- ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default
  (git-fixes).
- cfg80211: set custom regdomain after wiphy registration
  (git-fixes).
- ACPI: sysfs: Make sparse happy about address space in use
  (git-fixes).
- commit d8922a7</changelog>
  <changelog author="tiwai@suse.de" date="1655294401">- drm/atomic: Force bridge self-refresh-exit on CRTC switch
  (git-fixes).
- drm/bridge: analogix_dp: Support PSR-exit to disable transition
  (git-fixes).
- Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  (git-fixes).
- iio: dummy: iio_simple_dummy: check the return value of
  kstrdup() (git-fixes).
- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour
  (git-fixes).
- drm/radeon: fix a possible null pointer dereference (git-fixes).
- i2c: cadence: Increase timeout per message if necessary
  (git-fixes).
- drm/amdgpu/ucode: Remove firmware load type check in
  amdgpu_ucode_free_bo (git-fixes).
- drm: msm: fix error check return value of irq_of_parse_and_map()
  (git-fixes).
- drm/plane: Move range check for format_count earlier
  (git-fixes).
- drm/komeda: return early if drm_universal_plane_init() fails
  (git-fixes).
- fbcon: Consistently protect deferred_takeover with
  console_lock() (git-fixes).
- drm/virtio: fix NULL pointer dereference in
  virtio_gpu_conn_get_modes (git-fixes).
- drm/i915: Fix -Wstringop-overflow warning in call to
  intel_read_wm_latency() (git-fixes).
- iwlwifi: mvm: fix assert 1F04 upon reconfig (git-fixes).
- mac80211: upgrade passive scan to active scan on DFS channels
  after beacon rx (git-fixes).
- ipw2x00: Fix potential NULL dereference in libipw_xmit()
  (git-fixes).
- HID: bigben: fix slab-out-of-bounds Write in bigben_probe
  (git-fixes).
- HID: multitouch: Add support for Google Whiskers Touchpad
  (git-fixes).
- hwmon: Make chip parameter for with_info API mandatory
  (git-fixes).
- irqchip: irq-xtensa-mx: fix initial IRQ affinity (git-fixes).
- irqchip/armada-370-xp: Do not touch Performance Counter Overflow
  on A375, A38x, A39x (git-fixes).
- irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value
  (git-fixes).
- irqchip/exiu: Fix acknowledgment of edge triggered interrupts
  (git-fixes).
- efi: Add missing prototype for efi_capsule_setup_info
  (git-fixes).
- drivers: i2c: thunderx: Allow driver to work with ACPI defined
  TWSI controllers (git-fixes).
- i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging
  (git-fixes).
- Input: goodix - fix spurious key release events (git-fixes).
- commit 71b82f0</changelog>
  <changelog author="tiwai@suse.de" date="1655294402">- efi: Do not import certificates from UEFI Secure Boot for T2
  Macs (git-fixes).
- Refresh
  patches.suse/0003-MODSIGN-load-blacklist-from-MOKx.patch.
- commit 316d54d</changelog>
  <changelog author="tiwai@suse.de" date="1655294403">- vringh: Fix loop descriptors check in the indirect cases
  (git-fixes).
- mmc: block: Fix CQE recovery reset success (git-fixes).
- modpost: fix undefined behavior of is_arm_mapping_symbol()
  (git-fixes).
- modpost: fix removing numeric suffixes (git-fixes).
- misc: rtsx: set NULL intfdata when probe fails (git-fixes).
- USB: new quirk for Dell Gen 2 devices (git-fixes).
- USB: serial: option: add Quectel BG95 modem (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- usb: dwc2: gadget: don't reset gadget's driver-&gt;bus (git-fixes).
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
  (git-fixes).
- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- USB: host: isp116x: check return value after calling
  platform_get_resource() (git-fixes).
- serial: msm_serial: disable interrupts in __msm_console_write()
  (git-fixes).
- drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  (git-fixes).
- tty: Fix a possible resource leak in icom_probe (git-fixes).
- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  (git-fixes).
- staging: rtl8712: fix uninit-value in r871xu_drv_init()
  (git-fixes).
- staging: rtl8712: fix uninit-value in usb_read8() and friends
  (git-fixes).
- drivers: staging: rtl8192e: Fix deadlock in
  rtllib_beacons_stop() (git-fixes).
- drivers: staging: rtl8192u: Fix deadlock in
  ieee80211_beacons_stop() (git-fixes).
- watchdog: wdat_wdt: Stop watchdog when rebooting the system
  (git-fixes).
- pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards (git-fixes).
- video: fbdev: pxa3xx-gcu: release the resources correctly in
  pxa3xx_gcu_probe/remove() (git-fixes).
- rtlwifi: Use pr_warn instead of WARN_ONCE (git-fixes).
- rtl818x: Prevent using not initialized queues (git-fixes).
- mwifiex: add mutex lock for call in
  mwifiex_dfs_chan_sw_work_queue (git-fixes).
- media: cx25821: Fix the warning when removing the module
  (git-fixes).
- media: pci: cx23885: Fix the error handling in cx23885_initdev()
  (git-fixes).
- media: venus: hfi: avoid null dereference in deinit (git-fixes).
- PM / devfreq: rk3399_dmc: Disable edev on remove() (git-fixes).
- spi: stm32-qspi: Fix wait_cmd timeout in APM mode (git-fixes).
- spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width}
  based on DMA direction (git-fixes).
- mmc: jz4740: Apply DMA engine limits to maximum segment size
  (git-fixes).
- pinctrl: sunxi: fix f1c100s uart2 function (git-fixes).
- platform/chrome: cros_ec_proto: Send command again when timeout
  occurs (git-fixes).
- commit f8749e6</changelog>
  <changelog author="tiwai@suse.de" date="1655294404">- ALSA: usb-audio: Optimize TEAC clock quirk (git-fixes).
- commit 4bfd1c5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1655380800">- igmp: Add ip_mc_list lock in ip_check_mc_rcu (bsc#1200604
  CVE-2022-20141).
- commit 34bf464</changelog>
  <changelog author="mgorman@suse.de" date="1655726400">- Update -rt config files.
- commit b1cf921</changelog>
</package>
<package pkgid="7247de67908c1cf2b6615d780d591acb884ba3a17af082b35e8ff655a6ad6288" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.96.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022412">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022413">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="mgorman@suse.de" date="1657195200">- Refresh to adhere to Patch-mainline tag policy
  patches.rt/printk-Don-t-try-to-print-from-IRQ-NMI-region.patch.
  patches.rt/printk-Drop-the-logbuf_lock-more-often.patch.
  patches.rt/printk-Make-rt-aware.patch.
  patches.rt/printk-Switch-to-the-sync-mode-when-an-emergency-mes.patch.
  patches.rt/printk-do-not-wakeup-printk-kthread-directly.patch.
  patches.rt/printk-fix-suspend-hang.patch.
  patches.rt/printk-make-async.patch.
  patches.rt/printk-make-synchronous-param-rw.patch.
  patches.rt/printk-make-wakeup-klogd-async-fixup.patch.
  patches.rt/printk-make-wakeup-klogd-async.patch.
  patches.rt/printk-xen-Force-printk-sync-mode-when-migrating-Xen.patch.
- commit cfedad7</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="59ddda09b81c3586c584a04972953002b6e645bc1fa8e509139616608d4bae12" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.96.1"/>
  <changelog author="bp@suse.de" date="1657022400">- x86/bugs: Do IBPB fallback check only once (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 914bf03</changelog>
  <changelog author="bp@suse.de" date="1657022401">- x86/cpu/amd: Add Spectral Chicken (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 3ed82bb</changelog>
  <changelog author="bp@suse.de" date="1657022402">- x86/speculation: Fix firmware entry SPEC_CTRL handling
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 410bedf</changelog>
  <changelog author="bp@suse.de" date="1657022403">- x86/speculation: Fix SPEC_CTRL write on SMT state change
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 43488f5</changelog>
  <changelog author="bp@suse.de" date="1657022404">- x86/speculation: Use cached host SPEC_CTRL value for guest
  entry/exit (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 140d756</changelog>
  <changelog author="bp@suse.de" date="1657022405">- x86/speculation: Remove x86_spec_ctrl_mask (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 4f79cdb</changelog>
  <changelog author="bp@suse.de" date="1657022406">- KVM: VMX: Flatten __vmx_vcpu_run() (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit 5c70c82</changelog>
  <changelog author="bp@suse.de" date="1657022407">- KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 528b21e</changelog>
  <changelog author="bp@suse.de" date="1657022408">- KVM: VMX: Convert launched argument to flags (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit e0dd694</changelog>
  <changelog author="bp@suse.de" date="1657022409">- KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit f625aa5</changelog>
  <changelog author="bp@suse.de" date="1657022410">- KVM: VMX: Fix IBRS handling after vmexit (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 79152af</changelog>
  <changelog author="bp@suse.de" date="1657022411">- x86/speculation: Fill RSB on vmexit for IBRS (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit fd58624</changelog>
  <changelog author="bp@suse.de" date="1657022412">- KVM: VMX: Prevent RSB underflow before vmenter (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit a2b7d09</changelog>
  <changelog author="bp@suse.de" date="1657022413">- x86/common: Stamp out the stepping madness (bsc#1199657
  CVE-2022-29900 CVE-2022-29901).
- commit 3962a01</changelog>
  <changelog author="bp@suse.de" date="1657022414">- x86/cpu/amd: Enumerate BTC_NO (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit b7a3331</changelog>
  <changelog author="mgorman@suse.de" date="1657195200">- Refresh to adhere to Patch-mainline tag policy
  patches.rt/printk-Don-t-try-to-print-from-IRQ-NMI-region.patch.
  patches.rt/printk-Drop-the-logbuf_lock-more-often.patch.
  patches.rt/printk-Make-rt-aware.patch.
  patches.rt/printk-Switch-to-the-sync-mode-when-an-emergency-mes.patch.
  patches.rt/printk-do-not-wakeup-printk-kthread-directly.patch.
  patches.rt/printk-fix-suspend-hang.patch.
  patches.rt/printk-make-async.patch.
  patches.rt/printk-make-synchronous-param-rw.patch.
  patches.rt/printk-make-wakeup-klogd-async-fixup.patch.
  patches.rt/printk-make-wakeup-klogd-async.patch.
  patches.rt/printk-xen-Force-printk-sync-mode-when-migrating-Xen.patch.
- commit cfedad7</changelog>
  <changelog author="aabdallah@suse.de" date="1657281600">- ibmvnic: Properly dispose of all skbs during a failover
  (bsc#1200925).
- commit 06221e8</changelog>
  <changelog author="bp@suse.de" date="1657281601">- x86/bugs: Add Cannon lake to RETBleed affected CPU list
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 6b54061</changelog>
  <changelog author="bp@suse.de" date="1657281602">- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
  (bsc#1199657 CVE-2022-29900 CVE-2022-29901).
- commit 41afdd9</changelog>
  <changelog author="bp@suse.de" date="1657281603">- x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900
  CVE-2022-29901).
- commit ef1c2ca</changelog>
</package>
<package pkgid="75ab3a351df675889d85410d6e32a5e689efa878e3bd2f5b29b87f4231bebf3b" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.3.18" rel="150300.99.1"/>
  <changelog author="tiwai@suse.de" date="1659700800">- openvswitch: fix OOB access in reserve_sfa_size() (CVE-2022-2639
  bsc#1202154).
- commit bfc6551</changelog>
  <changelog author="tiwai@suse.de" date="1659700801">- clk: qcom: camcc-sdm845: Fix topology around titan_top power
  domain (git-fixes).
- clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
  (git-fixes).
- clk: qcom: ipq8074: fix NSS port frequency tables (git-fixes).
- clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
  (git-fixes).
- clk: qcom: ipq8074: fix NSS core PLL-s (git-fixes).
- clk: qcom: clk-krait: unlock spin after mux completion
  (git-fixes).
- clk: renesas: r9a06g032: Fix UART clkgrp bitsel (git-fixes).
- gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
  (git-fixes).
- HID: cp2112: prevent a buffer overflow in cp2112_xfer()
  (git-fixes).
- driver core: fix potential deadlock in __driver_attach
  (git-fixes).
- iio: amplifiers: ad8366: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-tlc4541: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8688: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8344: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads7950: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads124s08: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc161s626: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc128s052: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc12138: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-adc084s021: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc0832: Fix alignment for DMA safety (git-fixes).
- iio: adc: mcp320x: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1118: Fix alignment for DMA safety (git-fixes).
- iio: adc: max11100: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1027: Fix alignment for DMA safety (git-fixes).
- iio: adc: ltc2497: Fix alignment for DMA safety (git-fixes).
- iio: adc: hi8435: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7887: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7768-1: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7766: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7476: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7298: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7266: Fix alignment for DMA safety (git-fixes).
- iio: accel: sca3000: Fix alignment for DMA safety (git-fixes).
- iio: accel: bma220: Fix alignment for DMA safety (git-fixes).
- iio: core: Fix IIO_ALIGN and rename as it was not sufficiently
  large (git-fixes).
- fpga: altera-pr-ip: fix unsigned comparison with less than zero
  (git-fixes).
- commit 9bda156</changelog>
  <changelog author="tiwai@suse.de" date="1659700802">- iio: potentiometer: mcp4131: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: mcp41010: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: max5481: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: ad5272: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: fxas210002c: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: adxrs450: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16130: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16080: Fix alignment for DMA safety (git-fixes).
- iio: frequency: adf4371: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: adf4350: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: ad9523: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: ti-dac7612: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac7311: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac5571: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac082s085: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: mcp4922: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad8801: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad7303: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5791: Fix alignment for DMA saftey (git-fixes).
- iio: dac: ad5764: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5761: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5755: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5504: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5449: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5421: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5360: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5064: Fix alignment for DMA safety (git-fixes).
- commit 7981ef6</changelog>
  <changelog author="tiwai@suse.de" date="1659700803">- mmc: cavium-thunderx: Add of_node_put() when breaking out of
  loop (git-fixes).
- mmc: cavium-octeon: Add of_node_put() when breaking out of loop
  (git-fixes).
- mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
  (git-fixes).
- memstick/ms_block: Fix a memory leak (git-fixes).
- memstick/ms_block: Fix some incorrect memory allocation
  (git-fixes).
- mmc: sdhci-of-esdhc: Fix refcount leak in
  esdhc_signal_voltage_switch (git-fixes).
- PCI: tegra194: Fix link up retry sequence (git-fixes).
- PCI: tegra194: Fix Root Port interrupt handling (git-fixes).
- PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
  (git-fixes).
- PCI: qcom: Power on PHY before IPQ8074 DBI register accesses
  (git-fixes).
- PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
  (git-fixes).
- PCI: dwc: Always enable CDM check if "snps,enable-cdm-check"
  exists (git-fixes).
- PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
  (git-fixes).
- PCI: dwc: Disable outbound windows only for controllers using
  iATU (git-fixes).
- PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
  (git-fixes).
- PCI: dwc: Stop link on host_init errors and de-initialization
  (git-fixes).
- PCI/portdrv: Don't disable AER reporting in
  get_port_device_capability() (git-fixes).
- platform/olpc: Fix uninitialized data in debugfs write
  (git-fixes).
- USB: Follow-up to SPDX identifiers addition - remove now
  useless comments (git-fixes).
- staging: rtl8192u: Fix sleep in atomic context bug in
  dm_fsync_timer_callback (git-fixes).
- usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command
  completion (git-fixes).
- USB: serial: fix tty-port initialized comments (git-fixes).
- usb: gadget: udc: amd5536 depends on HAS_DMA (git-fixes).
- usb: host: xhci: use snprintf() in xhci_decode_trb()
  (git-fixes).
- usb: xhci: tegra: Fix error check (git-fixes).
- usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
  (git-fixes).
- usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
  (git-fixes).
- iio: light: isl29028: Fix the warning in isl29028_remove()
  (git-fixes).
- soundwire: bus_type: fix remove and shutdown support
  (git-fixes).
- iio: resolver: ad2s90: Fix alignment for DMA safety (git-fixes).
- iio: resolver: ad2s1200: Fix alignment for DMA safety
  (git-fixes).
- iio: proximity: as3935: Fix alignment for DMA safety
  (git-fixes).
- intel_th: msu: Fix vmalloced buffers (git-fixes).
- intel_th: msu-sink: Potential dereference of null pointer
  (git-fixes).
- intel_th: Fix a resource leak in an error handling path
  (git-fixes).
- misc: rtsx: Fix an error handling path in rtsx_pci_probe()
  (git-fixes).
- commit 2bc728a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659787200">- blacklist.conf: update blacklist
- commit cc1d04f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659960000">- blacklist.conf: update blacklist
- commit 63fa2f9</changelog>
  <changelog author="iivanov@suse.de" date="1659960001">- KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
- commit ec6a677</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046400">- blacklist.conf: update blacklist
- commit 51d7b18</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046401">- net/sonic: Fix a resource leak in an error handling path in
  'jazz_sonic_probe()' (git-fixes).
- commit 8d37be1</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046402">- net: stmmac: Use resolved link config in mac_link_up()
  (git-fixes).
- commit 4dba15f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046403">- net: stmmac: Modify configuration method of EEE timers
  (git-fixes).
- commit b6da91b</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046404">- net: ftgmac100: Fix crash when removing driver (git-fixes).
- commit 6458cfa</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132800">- can: m_can: process interrupt only when not runtime suspended
  (git-fixes).
- commit bd4c919</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132801">- net: dsa: b53: fix an off by one in checking "vlan-&gt;vid"
  (git-fixes).
- commit ea4caa5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132802">- Update metadata references
- commit b372491</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132803">- net: hdlc_x25: Return meaningful error code in x25_open
  (git-fixes).
- commit 212e2be</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132804">- net: mvpp2: fix interrupt mask/unmask skip condition
  (git-fixes).
- commit 3584e08</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132805">- octeontx2-af: fix infinite loop in unmapping NPC counter
  (git-fixes).
- commit c88fc73</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132806">- net: lapbether: Prevent racing when checking whether the netif
  is running (git-fixes).
- commit 9af3eff</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132807">- kabi/severities: add stmmac driver local sumbols
- commit 31f077f</changelog>
</package>
<package pkgid="b0b23d44ea1750a7dd9e7692b4b4a9b3e6f9a3c795fe05d55219259fae1d8f84" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="150300.99.1"/>
  <changelog author="tiwai@suse.de" date="1659700800">- openvswitch: fix OOB access in reserve_sfa_size() (CVE-2022-2639
  bsc#1202154).
- commit bfc6551</changelog>
  <changelog author="tiwai@suse.de" date="1659700801">- clk: qcom: camcc-sdm845: Fix topology around titan_top power
  domain (git-fixes).
- clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks
  (git-fixes).
- clk: qcom: ipq8074: fix NSS port frequency tables (git-fixes).
- clk: qcom: ipq8074: SW workaround for UBI32 PLL lock
  (git-fixes).
- clk: qcom: ipq8074: fix NSS core PLL-s (git-fixes).
- clk: qcom: clk-krait: unlock spin after mux completion
  (git-fixes).
- clk: renesas: r9a06g032: Fix UART clkgrp bitsel (git-fixes).
- gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
  (git-fixes).
- HID: cp2112: prevent a buffer overflow in cp2112_xfer()
  (git-fixes).
- driver core: fix potential deadlock in __driver_attach
  (git-fixes).
- iio: amplifiers: ad8366: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-tlc4541: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8688: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads8344: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads7950: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-ads124s08: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc161s626: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc128s052: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc12138: Fix alignment for DMA safety (git-fixes).
- iio: adc: ti-adc084s021: Fix alignment for DMA safety
  (git-fixes).
- iio: adc: ti-adc0832: Fix alignment for DMA safety (git-fixes).
- iio: adc: mcp320x: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1118: Fix alignment for DMA safety (git-fixes).
- iio: adc: max11100: Fix alignment for DMA safety (git-fixes).
- iio: adc: max1027: Fix alignment for DMA safety (git-fixes).
- iio: adc: ltc2497: Fix alignment for DMA safety (git-fixes).
- iio: adc: hi8435: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7887: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7768-1: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7766: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7476: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7298: Fix alignment for DMA safety (git-fixes).
- iio: adc: ad7266: Fix alignment for DMA safety (git-fixes).
- iio: accel: sca3000: Fix alignment for DMA safety (git-fixes).
- iio: accel: bma220: Fix alignment for DMA safety (git-fixes).
- iio: core: Fix IIO_ALIGN and rename as it was not sufficiently
  large (git-fixes).
- fpga: altera-pr-ip: fix unsigned comparison with less than zero
  (git-fixes).
- commit 9bda156</changelog>
  <changelog author="tiwai@suse.de" date="1659700802">- iio: potentiometer: mcp4131: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: mcp41010: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: max5481: Fix alignment for DMA safety
  (git-fixes).
- iio: potentiometer: ad5272: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: fxas210002c: Fix alignment for DMA safety
  (git-fixes).
- iio: gyro: adxrs450: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16130: Fix alignment for DMA safety (git-fixes).
- iio: gyro: adis16080: Fix alignment for DMA safety (git-fixes).
- iio: frequency: adf4371: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: adf4350: Fix alignment for DMA safety
  (git-fixes).
- iio: frequency: ad9523: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: ti-dac7612: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac7311: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac5571: Fix alignment for DMA safety (git-fixes).
- iio: dac: ti-dac082s085: Fix alignment for DMA safety
  (git-fixes).
- iio: dac: mcp4922: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad8801: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad7303: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5791: Fix alignment for DMA saftey (git-fixes).
- iio: dac: ad5764: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5761: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5755: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5504: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5449: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5421: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5360: Fix alignment for DMA safety (git-fixes).
- iio: dac: ad5064: Fix alignment for DMA safety (git-fixes).
- commit 7981ef6</changelog>
  <changelog author="tiwai@suse.de" date="1659700803">- mmc: cavium-thunderx: Add of_node_put() when breaking out of
  loop (git-fixes).
- mmc: cavium-octeon: Add of_node_put() when breaking out of loop
  (git-fixes).
- mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
  (git-fixes).
- memstick/ms_block: Fix a memory leak (git-fixes).
- memstick/ms_block: Fix some incorrect memory allocation
  (git-fixes).
- mmc: sdhci-of-esdhc: Fix refcount leak in
  esdhc_signal_voltage_switch (git-fixes).
- PCI: tegra194: Fix link up retry sequence (git-fixes).
- PCI: tegra194: Fix Root Port interrupt handling (git-fixes).
- PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep()
  (git-fixes).
- PCI: qcom: Power on PHY before IPQ8074 DBI register accesses
  (git-fixes).
- PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks
  (git-fixes).
- PCI: dwc: Always enable CDM check if "snps,enable-cdm-check"
  exists (git-fixes).
- PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors
  (git-fixes).
- PCI: dwc: Disable outbound windows only for controllers using
  iATU (git-fixes).
- PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
  (git-fixes).
- PCI: dwc: Stop link on host_init errors and de-initialization
  (git-fixes).
- PCI/portdrv: Don't disable AER reporting in
  get_port_device_capability() (git-fixes).
- platform/olpc: Fix uninitialized data in debugfs write
  (git-fixes).
- USB: Follow-up to SPDX identifiers addition - remove now
  useless comments (git-fixes).
- staging: rtl8192u: Fix sleep in atomic context bug in
  dm_fsync_timer_callback (git-fixes).
- usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command
  completion (git-fixes).
- USB: serial: fix tty-port initialized comments (git-fixes).
- usb: gadget: udc: amd5536 depends on HAS_DMA (git-fixes).
- usb: host: xhci: use snprintf() in xhci_decode_trb()
  (git-fixes).
- usb: xhci: tegra: Fix error check (git-fixes).
- usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
  (git-fixes).
- usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
  (git-fixes).
- iio: light: isl29028: Fix the warning in isl29028_remove()
  (git-fixes).
- soundwire: bus_type: fix remove and shutdown support
  (git-fixes).
- iio: resolver: ad2s90: Fix alignment for DMA safety (git-fixes).
- iio: resolver: ad2s1200: Fix alignment for DMA safety
  (git-fixes).
- iio: proximity: as3935: Fix alignment for DMA safety
  (git-fixes).
- intel_th: msu: Fix vmalloced buffers (git-fixes).
- intel_th: msu-sink: Potential dereference of null pointer
  (git-fixes).
- intel_th: Fix a resource leak in an error handling path
  (git-fixes).
- misc: rtsx: Fix an error handling path in rtsx_pci_probe()
  (git-fixes).
- commit 2bc728a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659787200">- blacklist.conf: update blacklist
- commit cc1d04f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1659960000">- blacklist.conf: update blacklist
- commit 63fa2f9</changelog>
  <changelog author="iivanov@suse.de" date="1659960001">- KVM: arm64: Avoid setting the upper 32 bits of TCR_EL2 and CPTR_EL2 (bsc#1201442)
- commit ec6a677</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046400">- blacklist.conf: update blacklist
- commit 51d7b18</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046401">- net/sonic: Fix a resource leak in an error handling path in
  'jazz_sonic_probe()' (git-fixes).
- commit 8d37be1</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046402">- net: stmmac: Use resolved link config in mac_link_up()
  (git-fixes).
- commit 4dba15f</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046403">- net: stmmac: Modify configuration method of EEE timers
  (git-fixes).
- commit b6da91b</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660046404">- net: ftgmac100: Fix crash when removing driver (git-fixes).
- commit 6458cfa</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132800">- can: m_can: process interrupt only when not runtime suspended
  (git-fixes).
- commit bd4c919</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132801">- net: dsa: b53: fix an off by one in checking "vlan-&gt;vid"
  (git-fixes).
- commit ea4caa5</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132802">- Update metadata references
- commit b372491</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132803">- net: hdlc_x25: Return meaningful error code in x25_open
  (git-fixes).
- commit 212e2be</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132804">- net: mvpp2: fix interrupt mask/unmask skip condition
  (git-fixes).
- commit 3584e08</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132805">- octeontx2-af: fix infinite loop in unmapping NPC counter
  (git-fixes).
- commit c88fc73</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132806">- net: lapbether: Prevent racing when checking whether the netif
  is running (git-fixes).
- commit 9af3eff</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1660132807">- kabi/severities: add stmmac driver local sumbols
- commit 31f077f</changelog>
</package>
<package pkgid="0939d3978c7f46db158e30861fd9f896fe6c16b56974427fe7bad86536bec41e" name="kpartx" arch="aarch64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.14.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+190+suse.fe234ea:
  * Fixes for daemon shutdown issues from  SLE(bsc#1110060, bsc#1110439)
  - multipathd: allow shutdown during configure()
  * fix compilation of external programs with -lmultipath
  (bsc#1133957, necessary after the above fix)
  * Minor upstream fixes</changelog>
  <changelog author="mwilck@suse.com" date="1600257601">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
</package>
<package pkgid="311bdffcfa7909d022f63f6589861f94d807361f3b091fa8443de5416ea9399c" name="kpartx" arch="x86_64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.14.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+190+suse.fe234ea:
  * Fixes for daemon shutdown issues from  SLE(bsc#1110060, bsc#1110439)
  - multipathd: allow shutdown during configure()
  * fix compilation of external programs with -lmultipath
  (bsc#1133957, necessary after the above fix)
  * Minor upstream fixes</changelog>
  <changelog author="mwilck@suse.com" date="1600257601">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
</package>
<package pkgid="fdf2705e61ef5f9bb4ccf63530994db3389c159a08a026c67aa77fdc349ef5f0" name="kpartx" arch="aarch64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.17.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="bcea05bed39ac02bf0aa71b0b0abac089fbabd58c47b3e8dacd14900e3264c87" name="kpartx" arch="x86_64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.17.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="140b3c5b3ebeea70e3b792d79d21258fb48079161766f5f41054a127d619dceb" name="krb5" arch="aarch64">
  <version epoch="0" ver="1.19.2" rel="150300.10.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2; (jsc#SLE-23329);
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="b8c20e1cf3dd48c426a4da8d2e0ac78bf6c677ea075e2419829b0685f8398713" name="krb5" arch="src">
  <version epoch="0" ver="1.19.2" rel="150300.10.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2; (jsc#SLE-23329);
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="cacfda1ac083d10dd796467880e26ba019dcb076386f1b21297e863732a1a120" name="krb5" arch="x86_64">
  <version epoch="0" ver="1.19.2" rel="150300.10.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2; (jsc#SLE-23329);
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="7c90a5030e3016815fd8bb25f4bc2e0cfca7796a0dd7aa4ea77d12e076173300" name="krb5" arch="aarch64">
  <version epoch="0" ver="1.19.2" rel="150300.7.7.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2; (jsc#SLE-23329);
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="1f285c344b7c9b3d9dcf0864cab347bb34cf2eeeb543551fe0a2bba458cbb8de" name="krb5" arch="src">
  <version epoch="0" ver="1.19.2" rel="150300.7.7.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2; (jsc#SLE-23329);
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="e79f7acc4a045f0502d267d1422608a2d98468f04fe2738176d43d3a2f80d1e3" name="krb5" arch="x86_64">
  <version epoch="0" ver="1.19.2" rel="150300.7.7.1"/>
  <changelog author="hguo@suse.com" date="1503057600">- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
  in order to improve client security in handling service principle
  names. (bsc#1054028)</changelog>
  <changelog author="michael@stroeder.com" date="1506340800">- Upgrade to 1.15.2
  * Fix a KDC denial of service vulnerability caused by unset status
    strings [CVE-2017-11368]
  * Preserve GSS contexts on init/accept failure [CVE-2017-11462]
  * Fix kadm5 setkey operation with LDAP KDB module
  * Use a ten-second timeout after successful connection for HTTPS KDC
    requests, as we do for TCP requests
  * Fix client null dereference when KDC offers encrypted challenge
    without FAST
  * Ignore dotfiles when processing profile includedir directive
  * Improve documentation</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package descriptions.</changelog>
  <changelog author="hguo@suse.com" date="1509969600">- Remove build dependency doxygen, python-Cheetah, python-Sphinx,
  python-libxml2, python-lxml, most of which are python 2 programs.
  Consequently remove -doc subpackage. Users are encouraged to use
  online documentation. (bsc#1066461)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="jmcdonough@suse.com" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="scabrero@suse.de" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="scabrero@suse.de" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="scabrero@suse.de" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="scabrero@suse.de" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="scabrero@suse.de" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="scabrero@suse.de" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="scabrero@suse.de" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631880000">- Update to 1.19.2; (jsc#SLE-23329);
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="nopower@suse.com" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
</package>
<package pkgid="20c4154a0ee0a9bd204b5793b8d231db88dd8f3e53d40034754a6b3dfa42a28e" name="ldb" arch="src">
  <version epoch="0" ver="2.4.3" rel="150300.3.20.1"/>
  <changelog author="scabrero@suse.de" date="1542024000">- Update to 1.4.3
  + Python: Ensure ldb.Dn can accept utf8 encoded unicode (bug 13616)</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to 1.5.2
  + dirsync: Allow arbitrary length cookies (bug #13686)
  + The build uses python3 by default: --extra-python would take
    python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to 1.5.4
  + Fix standalone build of ldb.
  + C99 build fixes.
  + CVE-2019-3824 out of bounds read in wildcard compare (bug#13773)
- Update to 1.5.3
  + Avoid inefficient one-level searches (bug#13762)
  + The test api.py should not rely on order of entries in dict (bug#13772)</changelog>
  <changelog author="scabrero@suse.de" date="1564660800">- Update to 1.5.5
  + LDAP_REFERRAL_SCHEME_OPAQUE was added to ldb_module.h; (bso#12478);
  + Skip @ records early in a search full scan; (bso#13893);</changelog>
  <changelog author="jmcdonough@suse.com" date="1570104000">- Update to version 2.0.7
  + Robustness improvements against duplicate attributes in ldb_filter_attrs()
    (bso#13695)
  + Robustness improvements against invalid string DN values (bso#14049)
  + log database repack so users know what is happening (bso#14059)
  + add ldb_options_get
  + add "batch_mode" option.
  + Remove Python 2.x support except to build just the bare C library
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + Fix standalone build of ldb.
  + CVE-2019-3824 out of bounds read in wildcard compare (bso#13773)</changelog>
  <changelog author="nopower@suse.com" date="1576756800">- Add obsolete ldb1 directive to baselibs.conf</changelog>
  <changelog author="dmulder@suse.com" date="1579262400">- libldb1 fails to migrate to libldb2 when libldb2 version is less
  than libldb1 version; (bsc#1160341)</changelog>
  <changelog author="david.mulder@suse.com" date="1579694400">ldb: Release ldb 2.0.8
  + Upgrade waf to version 2.0.18 to match the rest of Samba 4.11.x
    (bso#13846)</changelog>
  <changelog author="nopower@suse.com" date="1583496000">- Release ldb 2.1.1
  + Samba 4.11 and later give incorrect results for SCOPE_ONE
    searches; (bso#14270).</changelog>
  <changelog author="nopower@suse.com" date="1588075200">- Release ldb 2.1.2
  + CVE-2020-10700: ldb: Always use ldb_next_request() in
    ASQ module; ;(bso#14331); (bsc#1169850).</changelog>
  <changelog author="david.mulder@suse.com" date="1589976000">ldb: Bump version to 2.1.3; (bso#14330)</changelog>
  <changelog author="nopower@suse.com" date="1593777600">- Release ldb 2.1.4
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when
    ASQ and VLV combined; (bso#14364); (bsc#1173159)</changelog>
  <changelog author="ddiss@suse.com" date="1599825600">- Release ldb 2.2.0
  + Fix memory leak in ldb_kv_index_dn_ordered(); (bso#14299)
  + Fix off-by-one increment in lldb_add_msg_attr; (bso#14413)</changelog>
  <changelog author="scabrero@suse.de" date="1616587200">- Release ldb 2.2.1
  + CVE-2020-27840: Unauthenticated remote heap corruption via bad DNs;
    (bso#14595); (bsc#1183572);
  + CVE-2021-20277: out of bounds read in ldb_handler_fold; (bso#14655);
    (bsc#1183574);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Add ldb-cve-2020-25718.patch &amp;
  CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch to backport all
  changes from ldb-2.4.1.
  + CVE-2020-25718: samba: An RODC can issue (forge) administrator
    tickets to other servers; (bsc#1192246); (bso#14558)
  + CVE-2021-3738: samba: crash in dsdb stack;
    (bsc#1192215);(bso#14848)
-  Release ldb 2.2.2
  + Corrected python behaviour for 'in' for LDAP attributes
  contained as part of ldb.Message;(bso#14845).
  + Fix memory handling in ldb.msg_diff
  Corrected python docstrings;(bso#14836)
  + Backport bronze bit fixes, tests, and selftest improvements;
  (bso#14881).</changelog>
  <changelog author="nopower@suse.com" date="1641297600">- Update to version 2.4.1; (jsc#SLE-23329);
  - Release 2.4.1
    + Corrected python behaviour for 'in' for LDAP attributes
    contained as part of ldb.Message; (bso#14845);
    + Fix memory handling in ldb.msg_diff; (bso#14836);
    + Corrected python docstrings
  - Release 2.4.0
    + Improve calculate_popt_array_length()
    + Use C99 initializers for builtin_popt_options[]
    + pyldb: Fix Message.items() for a message containing elements
    + pyldb: Add test for Message.items()
    + tests: Use ldbsearch '--scope instead of '-s'
    + pyldb: fix a typo
    + Change page size of guidindexpackv1.ldb
    + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream
    + attrib_handler casefold: simplify space dropping
    + fix ldb_comparison_fold off-by-one overrun
    + CVE-2020-27840: pytests: move Dn.validate test to ldb
    + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
    + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
    + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
    + improve comments for ldb_module_connect_backend()
    + test/ldb_tdb: correct introductory comments
    + ldb.h: remove undefined async_ctx function signatures
    + correct comments in attrib_handers val_to_int64
    + dn tests use cmocka print functions
    + ldb_match: remove redundant check
    + add tests for ldb_wildcard_compare
    + ldb_match: trailing chunk must match end of string
    + pyldb: catch potential overflow error in py_timestring
    + ldb: remove some 'if PY3's in tests
    + Add missing break in switch statement
- Drop obsolete patch CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch
- Drop obsolete patch ldb-cve-2020-25718.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Modify packaging to allow parallel installation with libldb1
  (bsc#1192684):
  + Private libraries are installed in %{_libdir}/ldb2/
  + Modules are installed in %{_libdir}/ldb2/modules</changelog>
  <changelog author="scabrero@suse.de" date="1649246400">- Update to version 2.4.2
  + Fix for CVE-2021-3670, ensure that the LDB request has not
    timed out during filter processing as the LDAP server
    MaxQueryDuration is otherwise not honoured (bsc#1198397).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to version 2.4.3
  + Fix build problems, waf produces incorrect names for python
    extensions; (bso#15071);</changelog>
  <changelog author="nopower@suse.com" date="1657886400">- Add ldb-memory-bug-15096-4.15-ldbonly.patch to backport all
  changes for ldb-2.4.4.
  + CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  + CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  + CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="39cd80db468eca17d60548152906c3d1552a7c746343cccf8160d08e58d27c7b" name="libX11" arch="src">
  <version epoch="0" ver="1.6.5" rel="150000.3.24.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1369396800">- Update to version 1.5.99.902 (1.6 RC2):
  This release is brought to you by the letters C, V, &amp; E, and more numbers
  than I can count, with a special guest appearance by the letters J? and j?.</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1370347200">- Update to final version 1.6.0:
  Changes since libX11 1.5 (found in the release candidates) include fixes
  for the recently announced security issues CVE-2013-1981, CVE-2013-1997,
  and CVE-2013-2004; the addition of the _XEatDataWords API for use by
  Xlib-based extension libraries, to help them avoid integer overflows when
  it is necessary to discard data; removal of ancient, unused, incomplete
  support for the Cray Unicos OS, and the DECnet and TLI transport types;
  numerous improvements to compose files and locale data; man page macro
  cleanups to improve compatibility with doclifter; and various other
  code cleanups and compiler warning fixes.</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1375185600">- Update to version 1.6.1:
  This release includes fixes to the code, docs &amp; build system.
  It makes both clang &amp; doclifter happier.  It includes patches
  upstreamed from Ubuntu, NetBSD, and Solaris.</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1378728000">- Update to version 1.6.2:
  This release of libX11 includes a number of fixes to handle realloc() failure
  better, resolves a number of compiler &amp; static analyzer warnings, fixes several
  bugs in the X Input Method framework, and cleans up the XKB code to be a little
  more maintainable.
- Drop upstreamed patches:
  + Patch10: bug-239698_libx11.diff
  + Patch13: bug-221326-xim-sync.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1395662400">- U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch
  * fix typo in en_US Compose file (s/dead_actute/dead_acute/)
    (bnc#869333)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
</package>
<package pkgid="5150653047ee3ce5b4393a430f742f3d0f64bd4d249d41d744676d37f68a6eb9" name="libX11" arch="src">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1370347200">- Update to final version 1.6.0:
  Changes since libX11 1.5 (found in the release candidates) include fixes
  for the recently announced security issues CVE-2013-1981, CVE-2013-1997,
  and CVE-2013-2004; the addition of the _XEatDataWords API for use by
  Xlib-based extension libraries, to help them avoid integer overflows when
  it is necessary to discard data; removal of ancient, unused, incomplete
  support for the Cray Unicos OS, and the DECnet and TLI transport types;
  numerous improvements to compose files and locale data; man page macro
  cleanups to improve compatibility with doclifter; and various other
  code cleanups and compiler warning fixes.</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1375185600">- Update to version 1.6.1:
  This release includes fixes to the code, docs &amp; build system.
  It makes both clang &amp; doclifter happier.  It includes patches
  upstreamed from Ubuntu, NetBSD, and Solaris.</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1378728000">- Update to version 1.6.2:
  This release of libX11 includes a number of fixes to handle realloc() failure
  better, resolves a number of compiler &amp; static analyzer warnings, fixes several
  bugs in the X Input Method framework, and cleans up the XKB code to be a little
  more maintainable.
- Drop upstreamed patches:
  + Patch10: bug-239698_libx11.diff
  + Patch13: bug-221326-xim-sync.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1395662400">- U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch
  * fix typo in en_US Compose file (s/dead_actute/dead_acute/)
    (bnc#869333)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="66b7254309bf739414d2d891891710eeec3fd3f128eb1761e8789d1186fffb52" name="libX11-6" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.24.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
</package>
<package pkgid="7e12f61c30f4c994cfd2c7cffcfe2d402f1f7553587dafec12e8c4afd2d0109a" name="libX11-6" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.24.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
</package>
<package pkgid="38243651224a223bff8eaec397c57762f180d47cae3e705b767477875fe63be3" name="libX11-6" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="c8e94dadc019282f7165995857f3cb75b1eb85b25371d72079d7710da368841a" name="libX11-6" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="5398324b560e3908feeccc7301a53eed267ec9633080d12e59b82235206b1c66" name="libX11-data" arch="noarch">
  <version epoch="0" ver="1.6.5" rel="150000.3.24.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
</package>
<package pkgid="a39d007b5aae1de803cb9b76827a7477152bb121ab7414adb6401f26bcf53db6" name="libX11-data" arch="noarch">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="fc010176c1631dc909b2ff9b7f0726f98d6dca0381ccd18a0d1a3c8846de91ef" name="libX11-xcb1" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.24.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
</package>
<package pkgid="f84a6b83f2a89a0c6bedd90cecc1774f502f20d777b3e730ba81f10c0f3d53ba" name="libX11-xcb1" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.24.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
</package>
<package pkgid="a11f38d8ac40e8d35d0e03c750ccf4cdd0ecccf526c1c3439b75d23da3adf59e" name="libX11-xcb1" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="07dff8f1db319ed94d1c53287d7036483bef6823038b35850454380f20d1b4ba" name="libX11-xcb1" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.27.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "?"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "?"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "?"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "?"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
</package>
<package pkgid="ce0acd2103f1bb0dc828c8985519652eedab78a9e7d3de3c5fcc7c05fbffcc6c" name="libapparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="suse-beta@cboltz.de" date="1485604800">- split libapparmor into separate spec to get rid of build loop
  involving mariadb, systemd, apparmor, libapr and mariadb again
  (see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
  with minimum BuildRequires</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Fix RPM groups</changelog>
  <changelog author="suse-beta@cboltz.de" date="1508932800">- update to AppArmor 2.11.1
  - mostly test-related changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
    upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1509451200">- update to AppArmor 2.11.95 aka 2.12 beta1
  - no changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1514203200">- update to AppArmor 2.12
  - preserve errno across aa_*_unref() functions
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
    for the detailed upstream changelog
- no longer package static libapparmor.a</changelog>
  <changelog author="suse-beta@cboltz.de" date="1523793600">- update to AppArmor 2.13
  - add support for multiple cache directories and cache overlays
    (boo#1069906, boo#1074429)
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1539518400">- update to AppArmor 2.13.1
  - several bug fixes
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1545393600">- update to AppArmor 2.13.2
  - no changes in libapparmor
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
    for the detailed upstream changelog</changelog>
  <changelog author="mliska@suse.cz" date="1556020800">- Disable LTO (boo#1133091).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1560859200">- update to AppArmor 2.13.1
  - some fixes in cache handling
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - fix log parsing for logs with an embedded newline
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - fix two potential build failures
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
</package>
<package pkgid="d43093cd18eca29e7c5dbac9e0abf6c139d2ee4c8021bfa19226d0e63c8fb28a" name="libapparmor1" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="suse-beta@cboltz.de" date="1485604800">- split libapparmor into separate spec to get rid of build loop
  involving mariadb, systemd, apparmor, libapr and mariadb again
  (see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
  with minimum BuildRequires</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Fix RPM groups</changelog>
  <changelog author="suse-beta@cboltz.de" date="1508932800">- update to AppArmor 2.11.1
  - mostly test-related changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
    upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1509451200">- update to AppArmor 2.11.95 aka 2.12 beta1
  - no changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1514203200">- update to AppArmor 2.12
  - preserve errno across aa_*_unref() functions
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
    for the detailed upstream changelog
- no longer package static libapparmor.a</changelog>
  <changelog author="suse-beta@cboltz.de" date="1523793600">- update to AppArmor 2.13
  - add support for multiple cache directories and cache overlays
    (boo#1069906, boo#1074429)
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1539518400">- update to AppArmor 2.13.1
  - several bug fixes
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1545393600">- update to AppArmor 2.13.2
  - no changes in libapparmor
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
    for the detailed upstream changelog</changelog>
  <changelog author="mliska@suse.cz" date="1556020800">- Disable LTO (boo#1133091).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1560859200">- update to AppArmor 2.13.1
  - some fixes in cache handling
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - fix log parsing for logs with an embedded newline
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - fix two potential build failures
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
</package>
<package pkgid="be53d55b76c533d8356afad092e8845fd128e46675dfde838b62ddf204def28e" name="libapparmor1" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="suse-beta@cboltz.de" date="1485604800">- split libapparmor into separate spec to get rid of build loop
  involving mariadb, systemd, apparmor, libapr and mariadb again
  (see the discussion in SR 448871 for details)
- libapparmor.spec is based on the AppArmor 2.11 apparmor.spec, but
  with minimum BuildRequires</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Fix RPM groups</changelog>
  <changelog author="suse-beta@cboltz.de" date="1508932800">- update to AppArmor 2.11.1
  - mostly test-related changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_1 for
    upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1509451200">- update to AppArmor 2.11.95 aka 2.12 beta1
  - no changes in libapparmor
  - see http://wiki.apparmor.net/index.php/ReleaseNotes_2_11_95
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1514203200">- update to AppArmor 2.12
  - preserve errno across aa_*_unref() functions
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.12
    for the detailed upstream changelog
- no longer package static libapparmor.a</changelog>
  <changelog author="suse-beta@cboltz.de" date="1523793600">- update to AppArmor 2.13
  - add support for multiple cache directories and cache overlays
    (boo#1069906, boo#1074429)
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1539518400">- update to AppArmor 2.13.1
  - several bug fixes
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.1
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1545393600">- update to AppArmor 2.13.2
  - no changes in libapparmor
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.2
    for the detailed upstream changelog</changelog>
  <changelog author="mliska@suse.cz" date="1556020800">- Disable LTO (boo#1133091).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1560859200">- update to AppArmor 2.13.1
  - some fixes in cache handling
  - see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13.3
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - fix log parsing for logs with an embedded newline
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - fix two potential build failures
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
</package>
<package pkgid="c8593bc500657498e108d8f00f0ac7b8bdd5599eb31bedcfbf8a06fa24ff3fbb" name="libasm1" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="4f8eb9d327cf20278a8eaf09efac3f49c0db973a5bb45e849092045413a7738a" name="libasm1" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="9b95c649fa51cf0adadfbcc306d461a5c7d824dc5907437f3acdf1e0f84f4ed9" name="libassuan" arch="src">
  <version epoch="0" ver="2.5.5" rel="150000.4.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1376913600">- update to 2.1.1
  * no changes on the GNU/Linux platform
- includes changes from 2.1.0:
  * Support for the nPth library.
  * Add assuan_check_version and two version macros.
  * Interface changes relative to the 2.0.3 release:
    ASSUAN_SYSTEM_NPTH_IMPL  NEW macro.
    ASSUAN_SYSTEM_NPTH       NEW macro.
    __assuan_read            NEW (private).
    __assuan_write           NEW (private).
    __assuan_recvmsg         NEW (private).
    __assuan_sendmsg         NEW (private).
    __assuan_waitpid         NEW (private).
    ASSUAN_VERSION           NEW macro.
    ASSUAN_VERSION_NUMBER    NEW macro.
    assuan_check_version     NEW.
- add tarball signature and keyring
- run unit tests during build
- libgpg-error requirement is &gt;= 1.8</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1408276800">- update to 2.1.2:
  * Added support for ppc64le.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1415448000">- update to 2.1.3:
  + Performance fix for a platform other than GNU/Linux</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1419768000">- libassuan 2.2.0:
  * Added support for socket redirection.
  * Interface changes relative to the 2.1.3 release:
  assuan_sock_set_sockaddr_un  NEW.
- fix SLE 11 SP2 build (make install)</changelog>
  <changelog author="astieger@suse.com" date="1431432000">- libassuan 2.2.1:
  * Documentation updates.
  * Fixes for platforms other than GNU/Linux</changelog>
  <changelog author="astieger@suse.com" date="1440763200">- libassuan 2.3.0:
  * Now wipes out the memory of the context structure before freeing.
  The context may have stored sensitive data in its line buffers.
  * Fixed a problem with the data length limit in assuan_inquire.
  * Returns GPG_ERR_SOURCE_ASSUAN with errors from functions w/o a
  context.
  * Two new functions to tweak the behaviour of the socket wrappers.
  * By default build without a build timestamp.
  * Interface changes relative to the 2.2.1 release:
  assuan_sock_set_flag     NEW.
  assuan_sock_get_flag     NEW.</changelog>
  <changelog author="astieger@suse.com" date="1446724800">- libassuan 2.4.0:
  * New flags "socks" and "tor-mode" for assuan_sock_{set,get}_flag.
  * New function assuan_sock_connect_byname.
  * Require at least libgpg-error 1.17.
  * Interface changes relative to the 2.3.0 release:
    assuan_sock_connect_byname    NEW.
    ASSUAN_SOCK_TOR               NEW.
    ASSUAN_SOCK_SOCKS             NEW.
    assuan_sock_set_flag          EXTENDED.
    assuan_sock_get_flag          EXTENDED.</changelog>
  <changelog author="astieger@suse.com" date="1448712000">- libassuan 2.4.1:
  * In Tor mode fallback to port 9150 if 9050 is not listening.</changelog>
  <changelog author="astieger@suse.com" date="1449144000">- libassuan 2.4.2:
  * The nPth version of the connect system hook does now wrap the
  call with npth_unprotec/npth_protect to avoid blocking during a
  connect.
  * Add feature to assuan_sock_connect_byname to test for SOCKS5
  availability.</changelog>
  <changelog author="astieger@suse.com" date="1468843200">- libassuan 2.4.3:
  * Allow socket redirection with assuan_socket_connect.
  * Speedup spawning programs on Linux
  * Fix minor memory leaks</changelog>
  <changelog author="schwab@suse.de" date="1478692800">- qemu-disable-fdpassing-test.patch: disable fdpassing test when running
  under qemu-linux-user</changelog>
  <changelog author="astieger@suse.com" date="1511265600">- libassuan 2.4.4:
  * New configure option --disable-doc
  * Fix the use of nanosleep
  * Portability fix for systems not defining INADDR_LOOPBACK</changelog>
  <changelog author="astieger@suse.com" date="1512388800">- libassuan 2.4.5:
  * fixes for platforms other than GNU/Linux</changelog>
  <changelog author="astieger@suse.com" date="1512993600">- libassuan 2.5.1:
  * New function to change the system hooks for the socket
    interface (assuan_sock_set_system_hooks)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="atoptsoglou@suse.com" date="1544702400">-Update to 2.5.2:
  * configure.ac: Bump LT version to C8/A8/R2
  * include libassuan.pc in the spec file</changelog>
  <changelog author="schwab@suse.de" date="1545220800">- qemu-disable-fdpassing-test.patch: remove</changelog>
  <changelog author="kbabioch@suse.de" date="1549886400">- Update to 2.5.3:
  * Add a timeout for writing to a SOCKS5 proxy.
  * Add workaround for a problem with LD_LIBRARY_PATH on newer systems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1603540800">- update to 2.5.4:
  * Fix some minor build annoyances</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1616760000">- update to 2.5.5:
  * Fix a crash in the logging code
  * Upgrade autoconf</changelog>
</package>
<package pkgid="a0d43ba303b67da3b92ded391d93c014aee47aaef8b23d7a365160c982227040" name="libassuan0" arch="aarch64">
  <version epoch="0" ver="2.5.5" rel="150000.4.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1415448000">- update to 2.1.3:
  + Performance fix for a platform other than GNU/Linux</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1419768000">- libassuan 2.2.0:
  * Added support for socket redirection.
  * Interface changes relative to the 2.1.3 release:
  assuan_sock_set_sockaddr_un  NEW.
- fix SLE 11 SP2 build (make install)</changelog>
  <changelog author="astieger@suse.com" date="1431432000">- libassuan 2.2.1:
  * Documentation updates.
  * Fixes for platforms other than GNU/Linux</changelog>
  <changelog author="astieger@suse.com" date="1440763200">- libassuan 2.3.0:
  * Now wipes out the memory of the context structure before freeing.
  The context may have stored sensitive data in its line buffers.
  * Fixed a problem with the data length limit in assuan_inquire.
  * Returns GPG_ERR_SOURCE_ASSUAN with errors from functions w/o a
  context.
  * Two new functions to tweak the behaviour of the socket wrappers.
  * By default build without a build timestamp.
  * Interface changes relative to the 2.2.1 release:
  assuan_sock_set_flag     NEW.
  assuan_sock_get_flag     NEW.</changelog>
  <changelog author="astieger@suse.com" date="1446724800">- libassuan 2.4.0:
  * New flags "socks" and "tor-mode" for assuan_sock_{set,get}_flag.
  * New function assuan_sock_connect_byname.
  * Require at least libgpg-error 1.17.
  * Interface changes relative to the 2.3.0 release:
    assuan_sock_connect_byname    NEW.
    ASSUAN_SOCK_TOR               NEW.
    ASSUAN_SOCK_SOCKS             NEW.
    assuan_sock_set_flag          EXTENDED.
    assuan_sock_get_flag          EXTENDED.</changelog>
  <changelog author="astieger@suse.com" date="1448712000">- libassuan 2.4.1:
  * In Tor mode fallback to port 9150 if 9050 is not listening.</changelog>
  <changelog author="astieger@suse.com" date="1449144000">- libassuan 2.4.2:
  * The nPth version of the connect system hook does now wrap the
  call with npth_unprotec/npth_protect to avoid blocking during a
  connect.
  * Add feature to assuan_sock_connect_byname to test for SOCKS5
  availability.</changelog>
  <changelog author="astieger@suse.com" date="1468843200">- libassuan 2.4.3:
  * Allow socket redirection with assuan_socket_connect.
  * Speedup spawning programs on Linux
  * Fix minor memory leaks</changelog>
  <changelog author="schwab@suse.de" date="1478692800">- qemu-disable-fdpassing-test.patch: disable fdpassing test when running
  under qemu-linux-user</changelog>
  <changelog author="astieger@suse.com" date="1511265600">- libassuan 2.4.4:
  * New configure option --disable-doc
  * Fix the use of nanosleep
  * Portability fix for systems not defining INADDR_LOOPBACK</changelog>
  <changelog author="astieger@suse.com" date="1512388800">- libassuan 2.4.5:
  * fixes for platforms other than GNU/Linux</changelog>
  <changelog author="astieger@suse.com" date="1512993600">- libassuan 2.5.1:
  * New function to change the system hooks for the socket
    interface (assuan_sock_set_system_hooks)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="atoptsoglou@suse.com" date="1544702400">-Update to 2.5.2:
  * configure.ac: Bump LT version to C8/A8/R2
  * include libassuan.pc in the spec file</changelog>
  <changelog author="schwab@suse.de" date="1545220800">- qemu-disable-fdpassing-test.patch: remove</changelog>
  <changelog author="kbabioch@suse.de" date="1549886400">- Update to 2.5.3:
  * Add a timeout for writing to a SOCKS5 proxy.
  * Add workaround for a problem with LD_LIBRARY_PATH on newer systems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1603540800">- update to 2.5.4:
  * Fix some minor build annoyances</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1616760000">- update to 2.5.5:
  * Fix a crash in the logging code
  * Upgrade autoconf</changelog>
</package>
<package pkgid="dbe162bd0deaba0b35d179658d6f965bd158d5e589516fe570d3d3b6f32a7e23" name="libassuan0" arch="x86_64">
  <version epoch="0" ver="2.5.5" rel="150000.4.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1415448000">- update to 2.1.3:
  + Performance fix for a platform other than GNU/Linux</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1419768000">- libassuan 2.2.0:
  * Added support for socket redirection.
  * Interface changes relative to the 2.1.3 release:
  assuan_sock_set_sockaddr_un  NEW.
- fix SLE 11 SP2 build (make install)</changelog>
  <changelog author="astieger@suse.com" date="1431432000">- libassuan 2.2.1:
  * Documentation updates.
  * Fixes for platforms other than GNU/Linux</changelog>
  <changelog author="astieger@suse.com" date="1440763200">- libassuan 2.3.0:
  * Now wipes out the memory of the context structure before freeing.
  The context may have stored sensitive data in its line buffers.
  * Fixed a problem with the data length limit in assuan_inquire.
  * Returns GPG_ERR_SOURCE_ASSUAN with errors from functions w/o a
  context.
  * Two new functions to tweak the behaviour of the socket wrappers.
  * By default build without a build timestamp.
  * Interface changes relative to the 2.2.1 release:
  assuan_sock_set_flag     NEW.
  assuan_sock_get_flag     NEW.</changelog>
  <changelog author="astieger@suse.com" date="1446724800">- libassuan 2.4.0:
  * New flags "socks" and "tor-mode" for assuan_sock_{set,get}_flag.
  * New function assuan_sock_connect_byname.
  * Require at least libgpg-error 1.17.
  * Interface changes relative to the 2.3.0 release:
    assuan_sock_connect_byname    NEW.
    ASSUAN_SOCK_TOR               NEW.
    ASSUAN_SOCK_SOCKS             NEW.
    assuan_sock_set_flag          EXTENDED.
    assuan_sock_get_flag          EXTENDED.</changelog>
  <changelog author="astieger@suse.com" date="1448712000">- libassuan 2.4.1:
  * In Tor mode fallback to port 9150 if 9050 is not listening.</changelog>
  <changelog author="astieger@suse.com" date="1449144000">- libassuan 2.4.2:
  * The nPth version of the connect system hook does now wrap the
  call with npth_unprotec/npth_protect to avoid blocking during a
  connect.
  * Add feature to assuan_sock_connect_byname to test for SOCKS5
  availability.</changelog>
  <changelog author="astieger@suse.com" date="1468843200">- libassuan 2.4.3:
  * Allow socket redirection with assuan_socket_connect.
  * Speedup spawning programs on Linux
  * Fix minor memory leaks</changelog>
  <changelog author="schwab@suse.de" date="1478692800">- qemu-disable-fdpassing-test.patch: disable fdpassing test when running
  under qemu-linux-user</changelog>
  <changelog author="astieger@suse.com" date="1511265600">- libassuan 2.4.4:
  * New configure option --disable-doc
  * Fix the use of nanosleep
  * Portability fix for systems not defining INADDR_LOOPBACK</changelog>
  <changelog author="astieger@suse.com" date="1512388800">- libassuan 2.4.5:
  * fixes for platforms other than GNU/Linux</changelog>
  <changelog author="astieger@suse.com" date="1512993600">- libassuan 2.5.1:
  * New function to change the system hooks for the socket
    interface (assuan_sock_set_system_hooks)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="atoptsoglou@suse.com" date="1544702400">-Update to 2.5.2:
  * configure.ac: Bump LT version to C8/A8/R2
  * include libassuan.pc in the spec file</changelog>
  <changelog author="schwab@suse.de" date="1545220800">- qemu-disable-fdpassing-test.patch: remove</changelog>
  <changelog author="kbabioch@suse.de" date="1549886400">- Update to 2.5.3:
  * Add a timeout for writing to a SOCKS5 proxy.
  * Add workaround for a problem with LD_LIBRARY_PATH on newer systems.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1603540800">- update to 2.5.4:
  * Fix some minor build annoyances</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1616760000">- update to 2.5.5:
  * Fix a crash in the logging code
  * Upgrade autoconf</changelog>
</package>
<package pkgid="d318b38e18f7312b16760e3f3526a4c0dc470a37d9e40693cd3a0f8bd9382d8f" name="libavahi-client3" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="aea9f5514becb3f667fbd69c52f83bcd092882123010116a43eda4647bc9c1f7" name="libavahi-client3" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="db4e6c25ee3b40c7f0bbc0113e04e2e270c97b55b4094a88b6b0e6200f349b86" name="libavahi-common3" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="23ca6e47da6086beee6f3279745edb1bc6a77271103890b708f175363a3a8906" name="libavahi-common3" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="27b7374c478949a1311450a1c40726494bb683b219812b95d8580a03430ea027" name="libavahi-core7" arch="aarch64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="5719fc3a2a9a813e82c05db59b49695992db210c4c0e8f79607317bf73ba0ae1" name="libavahi-core7" arch="x86_64">
  <version epoch="0" ver="0.7" rel="150100.3.21.4"/>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="zaitor@opensuse.org" date="1511956800">- Update to version 0.7:
  + The Avahi 0.7 release brings two new features, binary TXT
    records in XML service files and the ability to start the
    gobject client in a custom context.
  + New Features:
  - Add support for binary values in TXT records in XML service
    files by specifying
    value-format="text|binary-hex|binary-base64". If not
    specified, defaults to the normal value of "text" (thus
    backwards compatible).
  - avahi-gobject: Allow starting the client in a custom
    GMainContext by passing context to ga_client_start_in_context
    instead of ga_client_start (avahi-gobject minor version has
    been incremented).
  + Notable Changes:
  - avahi-daemon: Remove all default rlimits from
    avahi-daemon.conf, as two main problems happened with firstly
    rlimit-nproc causing avahi to fail when started in a
    container without user namespaces and secondly because memory
    rlimits were causing avahi to crash in some cases. Leave it
    up to the init system to impose any modified limits instead.
    It is recommend to ship this change in distribution default
    config files.
  - avahi-common: Fix watch cleanup issue in watch_free
  - avahi-discover (python): Updated for Python3 &amp; GTK3
  - avahi-autoipd:
    . Clear previously set address before binding a new one.
    . Fix dhclient hooks to check for avahi-autoipd before
    running.
  - build: Move default rundir from /var/run to /run as per
    modern system setups.
  + Other Changes:
  - build:
    . Fix the printed value of "Building libavahi-client" in
    ./configure.
    . autogen.sh improved to work when called from another
    directory.
    . Fix warnings when compiling against musl libc.
  - avahi-compat-libdns_sd: Fix incorrect URL in warnings.
  - service-type-database: Add new service Types: _ipps._tcp,
    _xpra._tcp.
  - avahi-dnsconfd: Update manpage with the correct action script
    name.
  - avahi-gobject:
    . Use the correct shared library name in AvahiCore-0.6.gir
    . Fix build failing under some locales.
  - avahi-common/dbus-watch-glue.c: remove Unneeded semicolon.
  - Update gentoo init scripts for newer openrc version.
  + Updated translations.
- Drop avahi-empty-share-dir.patch, avahi-gir-fixup.patch,
  avahi-move-everything-to-run.patch and avahi-outdated-URL.patch:
  Fixed upstream.
- Drop systemd_requires macro: on a machine managed by systemd, we
  don't have to require it. If the machine/container is not managed
  by systemd, we don't want to require it.
- Add pkgconfig(pygobject-3.0) BuildRequires: New dependency.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519041600">- Use SPDX3.0 license tags and package COPYING as %license.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Modernize spec file by calling spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1520683200">- Rename %*soname to %*sover to better reflect its use.</changelog>
  <changelog author="mgorse@suse.com" date="1521028800">- Add avahi-0.7-python3.patch: Port to python 3 (bsc#1076402).
- Build python bindings against python 3, rather than python 2;
- Python-avahi is now python3-avahi, and python-avahi-gtk is now
  python3-avahi-gtk
- Obsolete the python 2 packages
- Replace python_sitelib with python3_sitelib in %files, and add
  __pycache__.</changelog>
  <changelog author="tchvatal@suse.com" date="1521720000">- Drop the qt3 parts</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1546603200">- Replace avahi-0.7-python3.patch with avahi-0.7-dbm.patch: use
  what is upstream (boo#1110668).
- Add avahi-0.7-encode-strings-as-utf8.patch: encode strings as
  UTF-8 (boo#1110668).
- Add avahi-0.7-python3-bookmarks.patch: make bookmarks python 3
  compatible (boo#1110668).
- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).
- Drop avahi-0.6.31-invalid-packet.patch: fixed upstream.</changelog>
  <changelog author="mgorse@suse.com" date="1546862400">- Drop avahi-daemon-increase-rlimit.patch: rlimits are no longer
  set by default.</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
  <changelog author="mgorse@suse.com" date="1642161600">- Reinstate avahi-0.6.31-systemd-order.patch (boo#1194561).
  This can probably go away if/when gh#lathiat/avahi#118 is fixed.
- Drop avahi-0.6.32-suppress-resolv-conf-warning.patch: we should
  no longer need this given the above patch.
- Move sftp-ssh and ssh services to the doc directory. They allow
  a host's up/down status to be easily discovered and should not
  be enabled by default (boo#1179060).</changelog>
  <changelog author="mgorse@suse.com" date="1644235200">- Have python3-avahi require python3-dbus-python, not the
  python 2 dbus-1-python package (bsc#1195614).</changelog>
  <changelog author="mgorse@suse.com" date="1645099200">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-add-resolv-conf-to-inotify.patch: re-read configuration
  when resolv.conf changes, per discussion on the bug
  (boo#1194561).</changelog>
  <changelog author="mgorse@suse.com" date="1645704000">- Downgrade python3-Twisted to a Recommends. It is not available
  on SLED or PackageHub, and it is only needed by avahi-bookmarks
  (bsc#1196282).
- Add avahi-bookmarks-import-warning.patch: fix warning when
  twisted is not available.</changelog>
  <changelog author="mgorse@suse.com" date="1667476800">- Add avahi-bsc1163683.patch: do not cache responses generated
  locally (bsc#1163683).</changelog>
</package>
<package pkgid="9b47adf5dcb0f3dd0343f4a2898a909ba1da2f2f33a0f560ac9eff3d535caa3c" name="libblkid1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="ff4acd61e651e58899456b2a05ec40d52c8ada975b01990be01923567b6d52f5" name="libblkid1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="49dfeed055978c05386f6699f7f5f297390365652d98263ed18d63bc5b22f6d9" name="libblkid1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="e4dfdc64f605a5a2bf95eedee74b86ec6e8aa637e068234d67d6a93668f788fd" name="libblkid1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="f15ad065b82353045750928dcb82fbbfcb065016a59291b234edb25fa003c685" name="libblkid1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="f5249c32eced532a585f9fe89caeab176b119572c3f0b69889208d38e77b9a14" name="libblkid1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="bcbe9c84313f9df27211e4482c98de52779b2734bbe105300cc5866e82c7bb4b" name="libbtrfs0" arch="aarch64">
  <version epoch="0" ver="4.19.1" rel="150300.18.5.1"/>
  <changelog author="dsterba@suse.cz" date="1515326400">- spec: fix distro version condition</changelog>
  <changelog author="dsterba@suse.cz" date="1517486400">- update to version 4.15
  * mkfs --rootdir reworked, does not minimize the final image but can be still
    done using a new option --shrink
  * fix allocation of system chunk, don't allocate from the reserved area
  * other
  * new and updated tests
  * cleanups, refactoring
  * doc updates</changelog>
  <changelog author="dsterba@suse.cz" date="1518782400">- use documentation shipped by upstream tar, reduce dependencies</changelog>
  <changelog author="dsterba@suse.cz" date="1522929600">- update to version 4.16
  * libbtrfsutil - new LGPL library to wrap userspace functionality
  * several 'btrfs' commands converted to use it:
  * properties
  * filesystem sync
  * subvolume set-default/get-default/delete/show/sync
  * python bindings, tests
  * build
  * use configured pkg-config path
  * CI: add python, musl/clang, built dependencies caching
  * convert: build fix for e2fsprogs 1.44+
  * don't install library links with wrong permissions
  * fixes
  * prevent incorrect use of subvol_strip_mountpoint
  * dump-super: don't verify csum for unknown type
  * convert: fix inline extent creation condition
  * check:
  * lowmem: fix false alert for 'data extent backref lost for snapshot'
  * lowmem: fix false alert for orphan inode
  * lowmem: fix false alert for shared prealloc extents
  * mkfs:
  * add UUID and otime to root of FS_TREE - with the uuid, snapshots will
    be now linked to the toplevel subvol by the parent UUID
  * don't follow symlinks when calculating size
  * pre-create the UUID tree
  * fix --rootdir with selinux enabled
  * dump-tree: add option to print only children nodes of a given block
  * image: handle missing device for RAID1
  * other
  * new tests
  * test script cleanups (quoting, helpers)
  * tool to edit superblocks
  * updated docs
- Add patch: 0001-btrfs-progs-build-fix-static-build.patch
- Add new library packages: libbtrfsutil</changelog>
  <changelog author="dsterba@suse.cz" date="1524484800">- update to version 4.16.1
  * remove obsolete tools: btrfs-debug-tree, btrfs-zero-log, btrfs-show-super,
    btrfs-calc-size
  * sb-mod: new debugging tool to edit superblock items
  * mkfs: detect if thin-provisioned device does not have enough space
  * check: don't try to verify checksums on metadata dump images
  * build: fail documentation build if xmlto is not found
  * build: fix build of btrfs.static
- Remove patch: 0001-btrfs-progs-build-fix-static-build.patch (upstream)
- Update initrd script</changelog>
  <changelog author="jeffm@suse.com" date="1525089600">- Fix building on SLE11:
  * btrfs-progs: convert: fix support for e2fsprogs &lt; 1.42
  * btrfs-progs: build: detect whether -std=gnu90 is supported
  * btrfs-progs: build: autoconf 2.63 compatibility
  * Fixed mismerged addition of libbtrfsutil1 package description
- Added patches:
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1529582400">- update to version 4.17
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
- Removed patches (upstreamed):
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1533470400">- update to version 4.17.1
  * check:
  * add ability to fix wrong ram_bytes for compressed inline files
  * beautify progress output
  * btrfstune: allow to continue uuid change after unclean interruption
  * several fuzz fixes:
  * detect overalpping chunks
  * chunk loading error handling
  * don't crash with unexpected root refs to extents
  * relax option parsing again to allow mixing options and non-options
    arguments
  * fix qgroup rescan status reporting
  * build:
  * drop obsolete dir-test
  * new configure option to disable building of tools
  * add compatibility options --disable-static and --disable-shared
  * other:
  * cleanups and preparatory work
  * new test images
- spec cleanup</changelog>
  <changelog author="dsterba@suse.cz" date="1541937600">- update to version 4.19
  * check: support repair of fs with free-space-tree feature
  * core:
  * port delayed ref infrastructure from kernel
  * support write to free space tree
  * dump-tree: new options for BFS and DFS enumeration of b-trees
  * quota: rescan is now done automatically after 'assign'
  * btrfstune: incomplete fix to uuid change
  * subvol: fix 255 char limit checks
  * completion: complete block devices and now regular files too
  * docs:
  * ship uncompressed manual pages
  * btrfsck uses a manual page link instead of symlink
  * other
  * improved error handling
  * docs
  * new tests</changelog>
  <changelog author="dsterba@suse.cz" date="1544011200">- update to version 4.19.1
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
  * other
  * new tests
  * cleanups</changelog>
  <changelog author="nborisov@suse.com" date="1544184000">- Implement fate#325871
  * Added 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch
  * Added 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch
  * Added 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch
  * Added 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch
  * Added 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch</changelog>
  <changelog author="mfasheh@suse.com" date="1548417600">- Advise user of fs recovery options when we fail to mount (fate#320443,
  bsc#1122539)
  * Add dracut-fsck-help.txt
  * Add module-setup.sh</changelog>
  <changelog author="mfasheh@suse.com" date="1553515200">- Use correct path for dracut-fsck-help.txt in module-setup.sh (bsc#1122539)
  * Remove module-setup.sh
  * Add module-setup.sh.in</changelog>
  <changelog author="jeffm@suse.com" date="1563969600">- btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny
  metadata (bsc#1131334).
- Added patches:
  * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1581076800">- btrfs-progs: check: fix segfault with -Q (bsc#1158560)
- Added patches:
  * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch</changelog>
  <changelog author="rgoldwyn@suse.com" date="1607601600">- Enqueue feature to wait for exclusive operation to finish
  (JSC#SLE-15234)
- Added patches:
  * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch
  * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch
  * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch
  * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch
  * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch
  * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1609848000">- Refresh manual pages after the docs change (jsc#SLE-13586)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1617969600">- Correct check_running_fs_exclop() return value (bsc#1184481)
  btrfs-progs-Correct-check_running_fs_exclop-return-v.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652702400">- Ignore path devices when scanning btrfs filesystem (bsc#1199391)
  0001-btrfs-progs-build-add-optional-dependency-on-libudev.patch
  0002-btrfs-progs-ignore-devices-representing-paths-in-mul.patch
  0003-btrfs-progs-add-fallback-code-for-multipath-device-d.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652875200">- Build btrfsprogs against libudev-devel properly.
  0001-btrfs-progs-build-make-libudev-selectable.patch
- Also make libudev-devel a hard requirement in the spec file.</changelog>
</package>
<package pkgid="ca31993f7ce22943a354d1686fa445ab9896b4ccc8750a11c26b30928f74a853" name="libbtrfs0" arch="x86_64">
  <version epoch="0" ver="4.19.1" rel="150300.18.5.1"/>
  <changelog author="dsterba@suse.cz" date="1515326400">- spec: fix distro version condition</changelog>
  <changelog author="dsterba@suse.cz" date="1517486400">- update to version 4.15
  * mkfs --rootdir reworked, does not minimize the final image but can be still
    done using a new option --shrink
  * fix allocation of system chunk, don't allocate from the reserved area
  * other
  * new and updated tests
  * cleanups, refactoring
  * doc updates</changelog>
  <changelog author="dsterba@suse.cz" date="1518782400">- use documentation shipped by upstream tar, reduce dependencies</changelog>
  <changelog author="dsterba@suse.cz" date="1522929600">- update to version 4.16
  * libbtrfsutil - new LGPL library to wrap userspace functionality
  * several 'btrfs' commands converted to use it:
  * properties
  * filesystem sync
  * subvolume set-default/get-default/delete/show/sync
  * python bindings, tests
  * build
  * use configured pkg-config path
  * CI: add python, musl/clang, built dependencies caching
  * convert: build fix for e2fsprogs 1.44+
  * don't install library links with wrong permissions
  * fixes
  * prevent incorrect use of subvol_strip_mountpoint
  * dump-super: don't verify csum for unknown type
  * convert: fix inline extent creation condition
  * check:
  * lowmem: fix false alert for 'data extent backref lost for snapshot'
  * lowmem: fix false alert for orphan inode
  * lowmem: fix false alert for shared prealloc extents
  * mkfs:
  * add UUID and otime to root of FS_TREE - with the uuid, snapshots will
    be now linked to the toplevel subvol by the parent UUID
  * don't follow symlinks when calculating size
  * pre-create the UUID tree
  * fix --rootdir with selinux enabled
  * dump-tree: add option to print only children nodes of a given block
  * image: handle missing device for RAID1
  * other
  * new tests
  * test script cleanups (quoting, helpers)
  * tool to edit superblocks
  * updated docs
- Add patch: 0001-btrfs-progs-build-fix-static-build.patch
- Add new library packages: libbtrfsutil</changelog>
  <changelog author="dsterba@suse.cz" date="1524484800">- update to version 4.16.1
  * remove obsolete tools: btrfs-debug-tree, btrfs-zero-log, btrfs-show-super,
    btrfs-calc-size
  * sb-mod: new debugging tool to edit superblock items
  * mkfs: detect if thin-provisioned device does not have enough space
  * check: don't try to verify checksums on metadata dump images
  * build: fail documentation build if xmlto is not found
  * build: fix build of btrfs.static
- Remove patch: 0001-btrfs-progs-build-fix-static-build.patch (upstream)
- Update initrd script</changelog>
  <changelog author="jeffm@suse.com" date="1525089600">- Fix building on SLE11:
  * btrfs-progs: convert: fix support for e2fsprogs &lt; 1.42
  * btrfs-progs: build: detect whether -std=gnu90 is supported
  * btrfs-progs: build: autoconf 2.63 compatibility
  * Fixed mismerged addition of libbtrfsutil1 package description
- Added patches:
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1529582400">- update to version 4.17
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
- Removed patches (upstreamed):
  * 0001-btrfs-progs-convert-fix-support-for-e2fsprogs-1.42.patch
  * 0002-btrfs-progs-build-autoconf-2.63-compatibility.patch
  * 0003-btrfs-progs-build-detect-whether-std-gnu90-is-suppor.patch</changelog>
  <changelog author="dsterba@suse.cz" date="1533470400">- update to version 4.17.1
  * check:
  * add ability to fix wrong ram_bytes for compressed inline files
  * beautify progress output
  * btrfstune: allow to continue uuid change after unclean interruption
  * several fuzz fixes:
  * detect overalpping chunks
  * chunk loading error handling
  * don't crash with unexpected root refs to extents
  * relax option parsing again to allow mixing options and non-options
    arguments
  * fix qgroup rescan status reporting
  * build:
  * drop obsolete dir-test
  * new configure option to disable building of tools
  * add compatibility options --disable-static and --disable-shared
  * other:
  * cleanups and preparatory work
  * new test images
- spec cleanup</changelog>
  <changelog author="dsterba@suse.cz" date="1541937600">- update to version 4.19
  * check: support repair of fs with free-space-tree feature
  * core:
  * port delayed ref infrastructure from kernel
  * support write to free space tree
  * dump-tree: new options for BFS and DFS enumeration of b-trees
  * quota: rescan is now done automatically after 'assign'
  * btrfstune: incomplete fix to uuid change
  * subvol: fix 255 char limit checks
  * completion: complete block devices and now regular files too
  * docs:
  * ship uncompressed manual pages
  * btrfsck uses a manual page link instead of symlink
  * other
  * improved error handling
  * docs
  * new tests</changelog>
  <changelog author="dsterba@suse.cz" date="1544011200">- update to version 4.19.1
  * check
  * many lowmem mode improvements
  * properly report qgroup mismatch errors
  * check symlinks with append/immutable flags
  * fi usage
  * correctly calculate allocated/unallocated for raid10
  * minor output updates
  * mkfs
  * detect ENOSPC on thinly provisioned devices
  * fix spurious EEXIST during directory traversal
  * restore: fix relative path for restore target
  * dump-tree: print symbolic tree names for backrefs
  * send: fix regression preventing send -p with subvolumes mounted on "/"
  * corrupt-tree: refactoring and command line updates
  * build
  * make it work with e2fsprogs &lt; 1.42 again
  * restore support for autoconf 2.63
  * detect if -std=gnu90 is supported
  * other
  * new tests
  * cleanups</changelog>
  <changelog author="nborisov@suse.com" date="1544184000">- Implement fate#325871
  * Added 0001-btrfs-progs-Add-support-for-metadata_uuid-field.patch
  * Added 0002-btrfs-progs-btrfstune-Add-support-for-changing-the-u.patch
  * Added 0003-btrfs-progs-Remove-fsid-metdata_uuid-fields-from-fs_.patch
  * Added 0004-btrfs-progs-Remove-btrfs_fs_info-new_fsid.patch
  * Added 0005-btrfs-progs-Directly-pass-root-to-change_devices_uui.patch</changelog>
  <changelog author="mfasheh@suse.com" date="1548417600">- Advise user of fs recovery options when we fail to mount (fate#320443,
  bsc#1122539)
  * Add dracut-fsck-help.txt
  * Add module-setup.sh</changelog>
  <changelog author="mfasheh@suse.com" date="1553515200">- Use correct path for dracut-fsck-help.txt in module-setup.sh (bsc#1122539)
  * Remove module-setup.sh
  * Add module-setup.sh.in</changelog>
  <changelog author="jeffm@suse.com" date="1563969600">- btrfs-progs: check: fixup_extent_flags needs to deal with non-skinny
  metadata (bsc#1131334).
- Added patches:
  * btrfs-progs-check-fixup_extent_flags-needs-to-deal-with-non-skinny-metadata.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1581076800">- btrfs-progs: check: fix segfault with -Q (bsc#1158560)
- Added patches:
  * btrfs-progs-check-initialize-qgroup_item_count-in-ea.patch</changelog>
  <changelog author="rgoldwyn@suse.com" date="1607601600">- Enqueue feature to wait for exclusive operation to finish
  (JSC#SLE-15234)
- Added patches:
  * 0001-btrfs-progs-add-get_fsid_fd-for-getting-fsid-using-f.patch
  * 0002-btrfs-progs-add-sysfs-file-reading-helpers.patch
  * 0003-btrfs-progs-add-helpers-for-parsing-filesystem-exclu.patch
  * 0004-btrfs-progs-check-for-exclusive-operation-before-iss.patch
  * 0005-btrfs-progs-add-helper-to-check-or-wait-for-exclusiv.patch
  * 0006-btrfs-progs-add-enqueue-parameter-for-exclusive-ops.patch</changelog>
  <changelog author="lpechacek@suse.com" date="1609848000">- Refresh manual pages after the docs change (jsc#SLE-13586)</changelog>
  <changelog author="rgoldwyn@suse.com" date="1617969600">- Correct check_running_fs_exclop() return value (bsc#1184481)
  btrfs-progs-Correct-check_running_fs_exclop-return-v.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652702400">- Ignore path devices when scanning btrfs filesystem (bsc#1199391)
  0001-btrfs-progs-build-add-optional-dependency-on-libudev.patch
  0002-btrfs-progs-ignore-devices-representing-paths-in-mul.patch
  0003-btrfs-progs-add-fallback-code-for-multipath-device-d.patch</changelog>
  <changelog author="nborisov@suse.com" date="1652875200">- Build btrfsprogs against libudev-devel properly.
  0001-btrfs-progs-build-make-libudev-selectable.patch
- Also make libudev-devel a hard requirement in the spec file.</changelog>
</package>
<package pkgid="176f38e3c753aa4ba50b7552310a1f047609675fe20d7412aa418b58dbcb65fd" name="libcares2" arch="aarch64">
  <version epoch="0" ver="1.19.0" rel="150000.3.20.1"/>
  <changelog author="jengelh@inai.de" date="1519128000">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
</package>
<package pkgid="34a1ff50a491aade1b5d3c6b777b803195d69028ef046f92c61cd6b02e868ca4" name="libcares2" arch="x86_64">
  <version epoch="0" ver="1.19.0" rel="150000.3.20.1"/>
  <changelog author="jengelh@inai.de" date="1519128000">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="dmueller@suse.com" date="1610798400">- update to 1.17.1:
    Travis: add iOS target built with CMake (#378)
    Issue #377 suggested that CMake builds for iOS with c-ares were broken. This PR adds an automatic Travis build for iOS CMake.
  - fix build
    External projects were using non-public header ares_dns.h, make public again (#376)
    It appears some outside projects were relying on macros in ares_dns.h, even
    though it doesn't appear that header was ever meant to be public.  That said,
    we don't want to break external integrators so we should distribute this header
    again.
  - note that so versioning has moved to configure.ac
  - note about 1.17.1
  - fix sed gone wrong
    autotools cleanup (#372)
  * buildconf: remove custom logic with autoreconf
- remove missing_header.patch (upstream)</changelog>
  <changelog author="adam.majer@suse.de" date="1628769600">- update to 1.17.2:
  Security:
  * When building c-ares with CMake, the RANDOM_FILE would not be set
    and therefore downgrade to the less secure random number generator
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause a crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as per
    RFC1035 5.1 to prevent spoofing follow-up
    (bsc#1188881, CVE-2021-3672)
  * Perform validation on hostnames to prevent possible XSS
    due to applications not performing valiation themselves
  Changes:
  * ares_malloc(0) is now defined behavior (returns NULL) rather than system-specific to catch edge cases
  Bug fixes:
  * Building tests should not force building of static libraries except on Windows
  * Relative headers must use double quotes to prevent pulling in a system library
  for details see,
  https://c-ares.haxx.se/changelog.html#1_17_2</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
  <changelog author="adam.majer@suse.de" date="1631188800">- new upstream website
- drop multibuild - tests do not require static library anymore
- spec file cleanup
- drop sources that were re-added to upstream distibution
  (c-ares-config.cmake.in ares_dns.h libcares.pc.cmake)</changelog>
  <changelog author="adam.majer@suse.de" date="1638878400">- update to 1.18.1. Changes since 1.17.2:
  * Allow '/' as a valid character for a returned name for
    CNAME in-addr.arpa delegation
  * no longer forwards requests for localhost resolution per RFC6761
  * During a domain search, treat ARES_ENODATA as ARES_NXDOMAIN so
    that the search process will continue to the next domain
    in the search.
  * Provide ares_nameser.h as a public interface as needed by NodeJS
  * Add support for URI(Uniform Resource Identifier) records via
    ares_parse_uri_reply()
- disable unit tests for SLE12 since GCC compiler too old to build
  unit tests
- 5c995d5.patch: upstreamed
- disable-live-tests.patch: refreshed</changelog>
  <changelog author="mardnh@gmx.de" date="1674993600">- Update to version 1.19.0
  Security:
  * Low. Stack overflow in ares_set_sortlist() which is used
    during c-ares initialization and typically provided by an
    administrator and not an end user.
    (bsc#1208067, CVE-2022-4904)
  Changes:
  * Add ARES_OPT_HOSTS_FILE similar to ARES_OPT_RESOLVCONF for
    specifying a custom hosts file location.
  Bug fixes:
  * Fix memory leak in reading /etc/hosts when using localhost
    fallback.
  * Fix chain building c-ares when libresolv is already included by
    another project.
  * File lookup should not immediately abort as there may be other
    tries due to search criteria.
  * Asterisks should be allowed in host validation as CNAMEs may
    reference wildcard domains.
  * AutoTools build system referenced bad STDC_HEADERS macro.
  * Even if one address class returns a failure for
    ares_getaddrinfo() we should still return the results we have.
  * Fix ares_getaddrinfo() numerical address resolution with
    AF_UNSPEC
  * Fix tools and help information.
  * Various documentation fixes and cleanups.
  * Add include guards to ares_data.h
  * c-ares could try to exceed maximum number of iovec entries
    supported by system.
  * The RFC6761 6.3 states localhost subdomains must be offline too</changelog>
</package>
<package pkgid="8c07ca72b19e4329aa6736672f67cf1dd527c5ad7807398775f23dbd10143633" name="libcolord2" arch="aarch64">
  <version epoch="0" ver="1.4.4" rel="150200.4.6.1"/>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Update to version 1.3.4:
  + New Features:
  - colord:
    . Add cd_color_rgb_from_wavelength().
    . Add cd_spectrum_resample_to_size().
  - colorhug:
    . Add commands for getting the device calibration spectra.
    . Increase the size of the EP0 transfer.
    . Support enabling the illuminants on the ColorHug+.
  + Bugfixes:
  - Fix a possible NULL dereference when talking to Spark
    devices.
  - Fix compile with -Wformat-signedness.
  - Fix possible division by zero if parsing /proc/cpuinfo fails.</changelog>
  <changelog author="zaitor@opensuse.org" date="1485259200">- Split out color profiles in sub package colord-color-profiles.
  Add shared-color-profiles Obsoletes and Provides.
- Replace shared-color-profiles with colord-color-profiles
  Requires.
- Pass --enable-libcolordcompat, build compatability lib.
- Pass --enable-print-profiles, build print profiles.
- Pass --disable-examples, ensure we do not build examples.</changelog>
  <changelog author="zaitor@opensuse.org" date="1488369600">- Update to version 1.3.5:
  + New Features:
  - Add cd_color_get_blackbody_rgb_full().
  - Add cd_spectrum_multiply_scalar().
  + Bugfixes: Check the parsed context arguments in the session
    helper.</changelog>
  <changelog author="fezhang@suse.com" date="1488888000">- Apparmor profile (usr.lib.colord): Allow reading / writing
  /var/lib/colord/.cache (bsc#1024933).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1504785600">- Update to version 1.4.1:
  + Bugfixes:
  - Add back the meson -Denable-systemd=false configure argument.
  - Add the fallback rules for older PolicyKit versions.
  - Define PATH_MAX if not available.
  - Enable C99 support in meson.build.
  - Include all the files in the GIR target.
  - Include the correct file when using Colord-1.0.gir.
  - Use appropriate feature macro for realpath().
  - Use gio-2.0 when generating the VAPI.
- Changes from version 1.4.0:
  + New Features:
  - Port to the Meson build system.
  - Enable Travis CI for Fedora 25 and Debian Stretch.
  - Make PolicyKit, gusb and udev a hard requirement.
  + Bugfixes:
  - Add some experimental tools for the HueyCOLOR sensor as found
    in the P70.
  - Conditionally build documentation and man pages.
  - Correctly build the ICC transfer curve for Rec709.
  - Do not build the examples as part of the regular build.
  - Do not spin the Huey LEDs when the sensor is embedded.
  - Do not use /tmp to create profiles.
  - Fix the version numbers in cd-version.h to reflect reality.
  - Get the Huey status before trying to unlock.
  - Use a different Huey unlock code on the W700 laptop.
- Add meson BuildRequires, and switch autotools macros configure,
  make and makeinstall to meson, meson_build and meson_install
  following upstream switch to Meson Build System.
- Add gtk-doc and docbook-utils BuildRequires: new dependencies.
- Drop %glib2_gsettings_schema_* post/postun macros: the
  functionality is now covered by file triggers.
- Drop intltool and vala BuildRequires: no longer needed.
- Upstream rename of ColorHug-1.0.typelib file to
  Colorhug-1.0.typelib, thus its package has been renamed as well.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Add pkgconfig(vapigen) BuildRequires and pass
  enable-session-example=false, enable-bash-completion=true,
  enable-systemd=true, enable-libcolordcompat=true,
  enable-argyllcms-sensor=true, enable-reverse=false,
  enable-sane=false, enable-vala=true, enable-print-profiles=true,
  enable-tests=false, enable-installed-tests=false,
  with-daemon-user=colord, enable-man=true and enable-docs=true to
  meson, ensure we build the feature we want.</changelog>
  <changelog author="zaitor@opensuse.org" date="1506427200">- Add ulimit -Sv 2000000 entry before build, set ~2 GiB limit so
  that colprof is forced to work in chunks when generating the
  print profile rather than trying to allocate a 3.1 GiB chunk of
  RAM to put the entire B-to-A tables in.</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in version 1.4.5)
- Move colord-session.service and tmpfiles config from libcolord-devel to colord package</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak in
  sqlite3_exec (boo#1202802 CVE-2021-42523).</changelog>
</package>
<package pkgid="8e124ce90b7d7e490d100a76017afd2e8d06dda0ff547d0acf3c7ae4589a8d2e" name="libcolord2" arch="x86_64">
  <version epoch="0" ver="1.4.4" rel="150200.4.6.1"/>
  <changelog author="dimstar@opensuse.org" date="1480939200">- Update to version 1.3.4:
  + New Features:
  - colord:
    . Add cd_color_rgb_from_wavelength().
    . Add cd_spectrum_resample_to_size().
  - colorhug:
    . Add commands for getting the device calibration spectra.
    . Increase the size of the EP0 transfer.
    . Support enabling the illuminants on the ColorHug+.
  + Bugfixes:
  - Fix a possible NULL dereference when talking to Spark
    devices.
  - Fix compile with -Wformat-signedness.
  - Fix possible division by zero if parsing /proc/cpuinfo fails.</changelog>
  <changelog author="zaitor@opensuse.org" date="1485259200">- Split out color profiles in sub package colord-color-profiles.
  Add shared-color-profiles Obsoletes and Provides.
- Replace shared-color-profiles with colord-color-profiles
  Requires.
- Pass --enable-libcolordcompat, build compatability lib.
- Pass --enable-print-profiles, build print profiles.
- Pass --disable-examples, ensure we do not build examples.</changelog>
  <changelog author="zaitor@opensuse.org" date="1488369600">- Update to version 1.3.5:
  + New Features:
  - Add cd_color_get_blackbody_rgb_full().
  - Add cd_spectrum_multiply_scalar().
  + Bugfixes: Check the parsed context arguments in the session
    helper.</changelog>
  <changelog author="fezhang@suse.com" date="1488888000">- Apparmor profile (usr.lib.colord): Allow reading / writing
  /var/lib/colord/.cache (bsc#1024933).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1504785600">- Update to version 1.4.1:
  + Bugfixes:
  - Add back the meson -Denable-systemd=false configure argument.
  - Add the fallback rules for older PolicyKit versions.
  - Define PATH_MAX if not available.
  - Enable C99 support in meson.build.
  - Include all the files in the GIR target.
  - Include the correct file when using Colord-1.0.gir.
  - Use appropriate feature macro for realpath().
  - Use gio-2.0 when generating the VAPI.
- Changes from version 1.4.0:
  + New Features:
  - Port to the Meson build system.
  - Enable Travis CI for Fedora 25 and Debian Stretch.
  - Make PolicyKit, gusb and udev a hard requirement.
  + Bugfixes:
  - Add some experimental tools for the HueyCOLOR sensor as found
    in the P70.
  - Conditionally build documentation and man pages.
  - Correctly build the ICC transfer curve for Rec709.
  - Do not build the examples as part of the regular build.
  - Do not spin the Huey LEDs when the sensor is embedded.
  - Do not use /tmp to create profiles.
  - Fix the version numbers in cd-version.h to reflect reality.
  - Get the Huey status before trying to unlock.
  - Use a different Huey unlock code on the W700 laptop.
- Add meson BuildRequires, and switch autotools macros configure,
  make and makeinstall to meson, meson_build and meson_install
  following upstream switch to Meson Build System.
- Add gtk-doc and docbook-utils BuildRequires: new dependencies.
- Drop %glib2_gsettings_schema_* post/postun macros: the
  functionality is now covered by file triggers.
- Drop intltool and vala BuildRequires: no longer needed.
- Upstream rename of ColorHug-1.0.typelib file to
  Colorhug-1.0.typelib, thus its package has been renamed as well.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Add pkgconfig(vapigen) BuildRequires and pass
  enable-session-example=false, enable-bash-completion=true,
  enable-systemd=true, enable-libcolordcompat=true,
  enable-argyllcms-sensor=true, enable-reverse=false,
  enable-sane=false, enable-vala=true, enable-print-profiles=true,
  enable-tests=false, enable-installed-tests=false,
  with-daemon-user=colord, enable-man=true and enable-docs=true to
  meson, ensure we build the feature we want.</changelog>
  <changelog author="zaitor@opensuse.org" date="1506427200">- Add ulimit -Sv 2000000 entry before build, set ~2 GiB limit so
  that colprof is forced to work in chunks when generating the
  print profile rather than trying to allocate a 3.1 GiB chunk of
  RAM to put the entire B-to-A tables in.</changelog>
  <changelog author="jengelh@inai.de" date="1506945600">- Update package summaries. Replace old RPM shell variables.</changelog>
  <changelog author="dimstar@opensuse.org" date="1507291200">- Collapse files section for gtk-doc.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942400">- Update to version 1.4.2:
  + New Features:
  - Add cd_icc_set_created.
  - Add --enable-timestamps option for CREATED header.
  + Bugfixes:
  - Avoid buffer overflow when reading profile_id.
  - Fix the detection of duplicate EDIDs.
  - Make udev hwdb optional by using pnp.ids as fallback.
  - Raise _XOPEN_SOURCE to 700 to enable C99 on FreeBSD.
  - Refactor build directory selection.
  - Set cd-create-profile date to SOURCE_DATE_EPOCH.
- Pass new option enable-udev-rules=true to meson.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524398400">- Update to version 1.4.3:
  + Bugfixes:
  - Make cd_color_get_blackbody_rgb_full safer.
  - Update style of Meson build options.
  - Update warning about running daemon as root.
- Update options passed to meson following upstream changes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1549886400">- Fix meson parameters: -Dargyllcms-sensor=true must be
  - Dargyllcms_sensor=true (boo#1124388).</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1561550400">- Change BuildRequires to docbook-utils-minimal, otherwise the build
  pulls in half of texlive and all its dependencies. Only man pages
  and HTML API docs are generated, no need for PS/PDF generation.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570536000">- Also allow /var/lib/colord/icc/ in AppArmor profile (boo#1112230)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 1.4.4:
  + New Features:
  - Actually install the installed tests.
  - Allow building without the daemon.
  + Bugfixes:
  - Consistently search for spotread in $PATH.
  - Don't hard-require spotread to build argyll sensor.
  - Fix linker argument checks.
  - Include C header in Colorhug-1.0.gir.
  - Pass -DCD_COMPILATION to gir compiler.
  - Port manpages to xsltproc and DocBook 5.
- Replace docbook-utils-minimal with docbook5-xsl-stylesheets
  BuildRequires following upstreams port.
- Add _constraints file, avoid random buildfails for i586 and other
  arches.</changelog>
  <changelog author="rbrown@suse.com" date="1575460800">- Add add-spyderx.patch for datacolor SpyderX supprot (will be in version 1.4.5)
- Move colord-session.service and tmpfiles config from libcolord-devel to colord package</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="suse-beta@cboltz.de" date="1610625600">- allow access to /usr/local/share/color in AppArmor profile (boo#1180898)</changelog>
  <changelog author="mgorse@suse.com" date="1663329600">- Add colord-CVE-2021-42523.patch: fix a small memory leak in
  sqlite3_exec (boo#1202802 CVE-2021-42523).</changelog>
</package>
<package pkgid="b11780f97a63930bc802a3738fb36d47404382ba32d0ce374266152e6a3e0789" name="libcrypt1" arch="aarch64">
  <version epoch="0" ver="4.4.15" rel="150300.4.4.3"/>
  <changelog author="schwab@suse.de" date="1525867200">- ABI compatible replacement for libcypt from glibc</changelog>
  <changelog author="schwab@suse.de" date="1527076800">- Update to libxcrypt 4.0.1</changelog>
  <changelog author="schwab@suse.de" date="1533124800">- Update to libxcrypt 4.1.0
  * Fix spelling of SUSE.
  * Lower the minimum required automake version to 1.14.
  * Fix build with USE_SWAPCONTEXT turned off.
  * Extend --enable-weak-hashes configure option to accept optional
    "glibc" parameter.
  * Fix the leak of obtained random bytes.
  * Check expected output strings for deterministic methods.
  * Fix memory leak in crypt_sha1_rn.
  * Fix read of random bytes out of bounds in gensalt_sha1_rn.
  * Make it possible to disable individual hashes at configure time.
  * Make salt validation pickier.
  * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation.
  * Make crypt_gensalt for $sha1 deterministic.
  * Fix incorrect output-size computation in crypt_sha1_rn.
  * Add docs for SHA1, MD5/Sun, NTHASH.
  * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros.
  * Install libcrypt.pc symlink along with libxcrypt.pc.
  * Extend --enable-obsolete-api configure option.
  * Extend overall test coverage.</changelog>
  <changelog author="jengelh@inai.de" date="1533556800">- Fix RPM groups for Factory.</changelog>
  <changelog author="schwab@suse.de" date="1533729600">- Add conflicts with glibc-devel &lt; 2.28</changelog>
  <changelog author="schwab@suse.de" date="1539086400">- Set compatibility level to suse</changelog>
  <changelog author="mliska@suse.cz" date="1550145600">- Update to version 4.4.3:
  * Add libxcrypt.so, libxcrypt.a and xcrypt.h.
  * Add new man3 manual pages.</changelog>
  <changelog author="schwab@suse.de" date="1550577600">- format-overflow.patch: Fix -Werror=format-overflow</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Disable LTO due to symbol versioning (boo#1138833).</changelog>
  <changelog author="schwab@suse.de" date="1575720000">- Update to version 4.4.10
  * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
  * The crypt_* functions will now all fail and set errno to ERANGE if
    their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
    characters (this is currently 512)
  * The NT hashing method no longer truncates passphrases at 128
    characters; Windows does not do this.
- format-overflow.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1576152000">- gcc10.patch: fix build with gcc10 (bsc#1158192)</changelog>
  <changelog author="schwab@suse.de" date="1579694400">- Update to version 4.4.11
  * Fixes for GCC v10.x
  * Change how the known-answer tests are parallelized
- gcc10.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1580385600">- Update to version 4.4.12
  * Another fix for GCC v10.x, which occurs on s390 architectures only.</changelog>
  <changelog author="schwab@suse.de" date="1583150400">- Update to version 4.4.15
  * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
    xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
  * Speed up ka-sunmd5 by skipping most of the test phrases
- Package README.md and TODO.md (bsc#1165389)</changelog>
  <changelog author="schwab@suse.de" date="1598961600">- Add compatibility provides for SLE15</changelog>
  <changelog author="dmueller@suse.com" date="1612612800">- add compatibility provides for Step 15 as well (bsc#1181571)</changelog>
</package>
<package pkgid="5742635fc1daffabdf0397e696ea64447c212e6e608e1cbf88942da01ae006dc" name="libcrypt1" arch="x86_64">
  <version epoch="0" ver="4.4.15" rel="150300.4.4.3"/>
  <changelog author="schwab@suse.de" date="1525867200">- ABI compatible replacement for libcypt from glibc</changelog>
  <changelog author="schwab@suse.de" date="1527076800">- Update to libxcrypt 4.0.1</changelog>
  <changelog author="schwab@suse.de" date="1533124800">- Update to libxcrypt 4.1.0
  * Fix spelling of SUSE.
  * Lower the minimum required automake version to 1.14.
  * Fix build with USE_SWAPCONTEXT turned off.
  * Extend --enable-weak-hashes configure option to accept optional
    "glibc" parameter.
  * Fix the leak of obtained random bytes.
  * Check expected output strings for deterministic methods.
  * Fix memory leak in crypt_sha1_rn.
  * Fix read of random bytes out of bounds in gensalt_sha1_rn.
  * Make it possible to disable individual hashes at configure time.
  * Make salt validation pickier.
  * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation.
  * Make crypt_gensalt for $sha1 deterministic.
  * Fix incorrect output-size computation in crypt_sha1_rn.
  * Add docs for SHA1, MD5/Sun, NTHASH.
  * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros.
  * Install libcrypt.pc symlink along with libxcrypt.pc.
  * Extend --enable-obsolete-api configure option.
  * Extend overall test coverage.</changelog>
  <changelog author="jengelh@inai.de" date="1533556800">- Fix RPM groups for Factory.</changelog>
  <changelog author="schwab@suse.de" date="1533729600">- Add conflicts with glibc-devel &lt; 2.28</changelog>
  <changelog author="schwab@suse.de" date="1539086400">- Set compatibility level to suse</changelog>
  <changelog author="mliska@suse.cz" date="1550145600">- Update to version 4.4.3:
  * Add libxcrypt.so, libxcrypt.a and xcrypt.h.
  * Add new man3 manual pages.</changelog>
  <changelog author="schwab@suse.de" date="1550577600">- format-overflow.patch: Fix -Werror=format-overflow</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Disable LTO due to symbol versioning (boo#1138833).</changelog>
  <changelog author="schwab@suse.de" date="1575720000">- Update to version 4.4.10
  * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
  * The crypt_* functions will now all fail and set errno to ERANGE if
    their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
    characters (this is currently 512)
  * The NT hashing method no longer truncates passphrases at 128
    characters; Windows does not do this.
- format-overflow.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1576152000">- gcc10.patch: fix build with gcc10 (bsc#1158192)</changelog>
  <changelog author="schwab@suse.de" date="1579694400">- Update to version 4.4.11
  * Fixes for GCC v10.x
  * Change how the known-answer tests are parallelized
- gcc10.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1580385600">- Update to version 4.4.12
  * Another fix for GCC v10.x, which occurs on s390 architectures only.</changelog>
  <changelog author="schwab@suse.de" date="1583150400">- Update to version 4.4.15
  * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
    xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
  * Speed up ka-sunmd5 by skipping most of the test phrases
- Package README.md and TODO.md (bsc#1165389)</changelog>
  <changelog author="schwab@suse.de" date="1598961600">- Add compatibility provides for SLE15</changelog>
  <changelog author="dmueller@suse.com" date="1612612800">- add compatibility provides for Step 15 as well (bsc#1181571)</changelog>
</package>
<package pkgid="ab1a69e98f7b0a3eb0badab08e5bdbe9e761d2a05a9e106814c3b4be36c3eb0c" name="libcups2" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.35.1"/>
  <changelog author="jsmeix@suse.de" date="1496923200">- In /usr/lib/tmpfiles.d/cups.conf use
  group 'root' for /run/cups/certs (boo#1042916).</changelog>
  <changelog author="schwab@suse.de" date="1505908800">- Pre-require user(lp) in cups-libs</changelog>
  <changelog author="jengelh@inai.de" date="1506772800">- Remove redundant Requires(pre) line? the use of %post -p
  already implies it.</changelog>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
</package>
<package pkgid="3519dae9ea1b6a794d6113d9f26e8fd107b72dbf3ae9db8b4b7d2cb899668973" name="libcups2" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.35.1"/>
  <changelog author="jsmeix@suse.de" date="1496923200">- In /usr/lib/tmpfiles.d/cups.conf use
  group 'root' for /run/cups/certs (boo#1042916).</changelog>
  <changelog author="schwab@suse.de" date="1505908800">- Pre-require user(lp) in cups-libs</changelog>
  <changelog author="jengelh@inai.de" date="1506772800">- Remove redundant Requires(pre) line? the use of %post -p
  already implies it.</changelog>
  <changelog author="jengelh@inai.de" date="1507896000">- Implement shared library packaging guideline [boo#862112]
- Update package descriptions.</changelog>
  <changelog author="opensuse@dstoecker.de" date="1508328000">- Fix typo in requires</changelog>
  <changelog author="jsmeix@suse.de" date="1508500800">- Use again the baselibs.conf from Fri Oct 13 11:11:10 UTC 2017
  that got broken by the change on Wed Oct 18 06:11:10 UTC 2017.
- Version upgrade to 2.2.5:
  CUPS 2.2.5 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Version upgrade to 2.2.4:
  CUPS 2.2.4 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
- Removed
  0001-Update-cupsEnumDests-implementation-to-return-early-if-all.patch
  0002-Save-work-on-Avahi-code.patch
  0003-Avahi-fixes-for-cupsEnumDests.patch
  because since CUPS 2.2.4 it is fixed in the upstream code
  via https://github.com/apple/cups/pull/4989 more precisely via
  https://github.com/apple/cups/commit/a2187a63425a3d6c05de1e1cbf8c26fd39a1aced
  https://github.com/apple/cups/commit/657c5b5f91e6d5120c4ad7b118cf9098dd27f03d
  https://github.com/apple/cups/commit/3fae3b337df0be1a766857be741173d8a9915da7</changelog>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
</package>
<package pkgid="fc2cd4ce948e7e22492a23ed699d359234e4dd2d5d8aae13903bf8db28a51552" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="9a835b3873006d312b30a7848536c8944b4fa5699c4634056e36156daedc794a" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.36.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
</package>
<package pkgid="7ccd7c692a8b650098d583b7046e228a1555636d0c2189e15318676fb347fc0f" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.39.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
</package>
<package pkgid="f8ad93355385825e9d55065b24d5f188aa63c16fa6026e9c66bda414b703a89f" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.39.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
</package>
<package pkgid="70c0bce78ecfa8b653c99aa88cd057eb5d52a21b675b261c4f5603371c9e19e3" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.42.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
</package>
<package pkgid="467457ea785c490db4da157dfd45970ec8714ccfbe9419e001b87186bdf4c11e" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.42.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
</package>
<package pkgid="8c4925d56cb13a4a72219e275cb7ac60fcd94688c3dd4f1a077b396c9d9d1b90" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="150200.4.45.1"/>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="4b27fb780f03c6a61dbc01c68cb6a7472d3e1c9b523e73d8545c4bedd4cde59a" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="150200.4.45.1"/>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
  <changelog author="david.anes@suse.com" date="1650628800">- Security fix: [bsc#1198766, CVE-2022-27776]
  * Auth/cookie leak on redirect
  * Add backported curl-CVE-2022-27776.patch
- Security fix: [bsc#1198723, CVE-2022-27775]
  * Bad local IPv6 connection reuse
  * Add backported curl-CVE-2022-27775.patch
- Security fix: [bsc#1198614, CVE-2022-22576]
  * OAUTH2 bearer bypass in connection re-use
  * Add backported curl-CVE-2022-22576.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651752000">- Securiy fix: [bsc#1199223, CVE-2022-27781]
  * CERTINFO never-ending busy-loop
  * Add curl-CVE-2022-27781.patch
- Securiy fix: [bsc#1199224, CVE-2022-27782]
  * TLS and SSH connection too eager reuse
  * Add curl-CVE-2022-27782.patch</changelog>
  <changelog author="david.anes@suse.com" date="1656331200">- Security fix: [bsc#1200735, CVE-2022-32206]
  * HTTP compression denial of service
  * Add curl-CVE-2022-32206.patch
- Security fix: [bsc#1200737, CVE-2022-32208]
  * FTP-KRB bad message verification
  * Add curl-CVE-2022-32208.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661169600">- Security fix: [bsc#1202593, CVE-2022-35252]
  * Control codes in cookie denial of service
  * Add curl-CVE-2022-35252.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
</package>
<package pkgid="81e68887bc334333eaa6af397987ea95316a5e0dfaea3be90e2eff82c4103526" name="libdb-4_8" arch="aarch64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="0205fdee7a070af95ec9eb98b2d58f06d97d515494a91fe0d1a5d5d4e2e1d2bf" name="libdb-4_8" arch="src">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="jengelh@medozas.de" date="1316174400">- Add libdb-devel to baselibs</changelog>
  <changelog author="prusnak@opensuse.org" date="1317124800">- enable C++ bindings
- spec cleanup</changelog>
  <changelog author="adrian@suse.de" date="1317211200">- fix arm build</changelog>
  <changelog author="coolo@suse.com" date="1324382400">- add autoconf as buildrequire to avoid implicit dependency</changelog>
  <changelog author="jengelh@medozas.de" date="1324555200">- Remove redundant/unwanted tags/section (cf. specfile guidelines)</changelog>
  <changelog author="aj@suse.de" date="1326110400">- Do not use build date as version string.</changelog>
  <changelog author="ro@suse.de" date="1353153600">- fix check-build.sh for kernel &gt; 3.0</changelog>
  <changelog author="jengelh@inai.de" date="1371124800">- Rename db_ binaries to db48_ to make room for libdb-6_0
- Add conflict markers against libdb-4_5 (overlapping files)</changelog>
  <changelog author="werner@suse.de" date="1371556800">- Try to change baselibs.conf to fit coolo's comment hopefully</changelog>
  <changelog author="werner@suse.de" date="1371643200">- Explicit add a conflict to other providers of /usr/lib/libdb.so
  and /usr/lib/libdb-4.so</changelog>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="bdef2597cd89294d01d6e03ca0baa1eea8cd4349290753917ffe4a9ec55c5d79" name="libdb-4_8" arch="x86_64">
  <version epoch="0" ver="4.8.30" rel="150000.7.6.1"/>
  <changelog author="coolo@suse.com" date="1374580800">- readd the provides of db-*, we're not going to switch to db 6.0
  too eagerly: http://lwn.net/Articles/557487/</changelog>
  <changelog author="jengelh@inai.de" date="1381233600">- Add update-alternatives rules to db48-utils (bnc#840738)</changelog>
  <changelog author="coolo@suse.com" date="1382356800">- fix update-alternatives usage</changelog>
  <changelog author="schwab@suse.de" date="1399896000">- remove generation of unused tarball
- remove setting of unused variable</changelog>
  <changelog author="tchvatal@suse.com" date="1459425600">- Use upstream tarball
- Cleanup a bit with spec-cleaner
- remove unused script check-build.sh</changelog>
  <changelog author="rguenther@suse.com" date="1520942400">- Add libdb-fix-atomic.patch to fix __atomic_compare_exchange clash
  with GCCs builtin.  Fixes build with GCC8 which now rejects this.</changelog>
  <changelog author="tchvatal@suse.com" date="1545307200">- Fix the license to match up really what is in there</changelog>
  <changelog author="tchvatal@suse.com" date="1566216000">- Remove the getpatches as it does not work at all, oracle
  removed the pages
- Use spec-cleaner
- Fix stripped debuginfo to make sure we can debug with libdb</changelog>
  <changelog author="william.brown@suse.com" date="1566907200">- Add opd deadlock patch as found and documented by Red Hat.
  (bsc#1148244)
  * 0001-OPD-deadlock-RH-BZ-1349779.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668513600">- Security fix: [bsc#1174414, CVE-2019-2708]
  * libdb: Data store execution leads to partial DoS
  * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
  * Add libdb-4_8-CVE-2019-2708.patch</changelog>
</package>
<package pkgid="bf6330ebd720c5c3cded27dcde4f7160f7e3f469d8dd4b307083e53ce9c2f8f7" name="libdbus-1-3" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="230f0220f2349a438359a2a761c59b3f518788012b648c5eef77bf12095e8fd4" name="libdbus-1-3" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="150100.8.14.1"/>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
  <changelog author="sflees@suse.de" date="1665662400">- Fix a potential crash that could be triggered by an invalid signature.
  (CVE-2022-42010, bsc#1204111)
  * fix-upstream-CVE-2022-42010.patch
- Fix an out of bounds read caused by a fixed length array (CVE-2022-42011,
  bsc#1204112)
  * fix-upstream-CVE-2022-42011.patch
- A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption CVE-2022-42012,
  bsc#1204113)
  * fix-upstream-CVE-2022-42012.patch
- Disable asserts (bsc#1087072)
- Refreshed patches
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="6b0a7c02d502ed07c2de3bd3c2976453df7d04662a920cfc796f1f4099a50201" name="libdevmapper-event1_03" arch="aarch64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="5d05ecbf4fe1ea35a7b1c781d03da6c9148d83df5b7fabcab524e61070444a85" name="libdevmapper-event1_03" arch="x86_64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="f3681560164a7fcd15e84a1a08a00ed9654d304080325b315f2c89798d5eb280" name="libdevmapper1_03" arch="aarch64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="9e64e43f69f78a3a500d0b4f1bf386177810cb154572d866205991b2bbf8aca5" name="libdevmapper1_03" arch="x86_64">
  <version epoch="0" ver="2.03.05_1.02.163" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="b436675b4ba07b62dd030ea89fd59978896f9588968d78fd2b341a77437c6075" name="libdw1" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="9fc4155b084b0f9bf53e853da37033d7e01a6c520b4cfc4f98cb5b93dc17b29b" name="libdw1" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="7aa26617cdb9c11538dccfcd198accf91058e8134ff26a9a00738b1f37cea218" name="libdwarves-devel" arch="aarch64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="e5b4a9558162d234eb9ee3d8ecc87159222b958f3cbb04084a29a10d61ae5564" name="libdwarves-devel" arch="x86_64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="54197aaf55d5a2059d1208806e7593c657a1d4a1a725942c1a39c74aa8b96216" name="libdwarves1" arch="aarch64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="cbece900f91ffdea788df377436144ec9a7a8206f89fc3362dfc837ef99a34a5" name="libdwarves1" arch="x86_64">
  <version epoch="0" ver="1.22" rel="150300.7.3.1"/>
  <changelog author="jengelh@inai.de" date="1584273600">- Update to release 1.17
  * Support raw BTF as available in /sys/kernel/btf/vmlinux.
  * Make --find_pointers_to consider unions.
  * Make --contains and --find_pointers_to honour --unions.
  * Add support for finding pointers to void.
  * Make --contains and --find_pointers_to to work with base types.</changelog>
  <changelog author="idonmez@suse.com" date="1589889600">- Don't require libebl-plugins on suse_version &gt;= 1550</changelog>
  <changelog author="jslaby@suse.com" date="1599048000">- add libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch</changelog>
  <changelog author="tdevries@suse.com" date="1600689600">- Backport fixes for segfault when processing dwz-ed kernel
  [bsc#1176095,https://github.com/acmel/dwarves/issues/10].
  * dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  * dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch</changelog>
  <changelog author="jengelh@inai.de" date="1601640000">- Update to release 1.18
  * pahole now should be segfault free when handling gdb test
    suit DWARF files, including ADA, FORTRAN, rust and dwp
    compressed files (the latter is refused).
  * Bail out on partial units for now, avoiding segfaults.
- Drop
  dwarves-dwarf_loader-Ignore-entries-in-a-DW_TAG_partial_unit-for-now.patch,
  dwarves-dwarf_loader-Bail-out-at-DW_TAG_imported_unit-tags.patch
  (merged)
- Add forced ELF symvers because of ABI breaks</changelog>
  <changelog author="dmueller@suse.com" date="1603800000">- update to 1.18_15g040fd7f (bsc#1177921):
  * btf_encoder: Support cross-compiled ELF binaries with different endianness
  * strings: use BTF's string APIs for strings management
  * strings: Rename strings.h to avoid clashing with /usr/include/strings.h
  * dwarf_loader: increase the size of lookup hash map
  * btf_encoder: revamp how per-CPU variables are encoded
  * btf_encoder: Discard CUs after BTF encoding
  * btf_encoder: Fix emitting __ARRAY_SIZE_TYPE__ as index range type
  * btf_encoder: Use libbpf APIs to encode BTF type info
  * btf_loader: Use libbpf to load BTF
  * dwarves: Expose and maintain active debug info loader operations
  * btf_encoder: detect BTF encoding errors and exit
  * libbpf: Update to latest libbpf version
  * dwarf_loader: Conditionally define DW_AT_alignment
  * pahole: Implement --packed
  * man-pages: Fix 'coimbine' typo
- remove libbpf-Fix-libbpf-hashmap-on-I-LP32-architectures.patch (upstream)</changelog>
  <changelog author="jengelh@inai.de" date="1603800001">- Add _service file / move to 1.18.g19 (863e6f0f)
  * btf_encoder: Ignore zero-sized ELF symbols</changelog>
  <changelog author="jengelh@inai.de" date="1606219200">- Update to release 1.19
  * Support for split BTF.
  * Support cross-compiled ELF binaries with different endianness.
  * Support for showing typedefs for anonymous types, like structs,
    unions and enums.</changelog>
  <changelog author="glin@suse.com" date="1609934400">- Drop the version requirement of libdw-devel
  + DW_AT_alignment is defined in 1.19 so dwarves now is compatible
    with older libdw.</changelog>
  <changelog author="jengelh@inai.de" date="1612526400">- Update to release 1.20
  * Addresses problems related to gcc 11 defaulting to DWARF5
    for -g.
  * Support SHN_XINDEX in st_shndx symbol indexes, to handle ELF
    objects with more than 65534 sections, for instance, which
    happens with kernels built with KCFLAGS="-ffunction-sections
  - fdata-sections", Other cases may include when using FG-ASLR,
    LTO.
  * Fix BTF variable generation for kernel modules, not skipping
    variables at offset zero.
  * Fix address size to match what is in the ELF file being
    processed, to fix using a 64-bit pahole binary to generate
    BTF for a 32-bit vmlinux image.</changelog>
  <changelog author="jengelh@inai.de" date="1618228800">- Update to release 1.21
  * Handle DWARF5 DW_OP_addrx and
    subprogram ret type with abstract_origin properly.</changelog>
  <changelog author="jengelh@inai.de" date="1619092800">- Codify build requirement on elfutils &gt;= 0.171</changelog>
  <changelog author="jslaby@suse.cz" date="1620043200">- add remove-ftrace-filter.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1622548800">- Handle zero sized per-cpu veriables in Linux BTF.
  + btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch</changelog>
  <changelog author="dmueller@suse.com" date="1622635200">- use https for url (and more beautification changes from spec-cleaner)</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 1.21+git175.1ef87b2 (jsc#SLE-17288):
  * libbpf: bump dependency to &gt;= 0.4.0
  * CMakeLists.txt: Enable SHARED and STATIC lib creation
  * libbpf: Allow to use packaged version
  * btfdiff: Support diffing DWARF vs detached BTF
  * pahole: Allow encoding BTF into a detached file
  * pahole: Add --kabi_prefix flag
  * btf_encoder: fix and complete filtering out zero-sized per-CPU variables
  * btf: Remove ftrace filter
  * pahole: Introduce --with_flexible_array option to show just types ending in a flexible array
  * Many updates to btf_encoder and bug fixes
- Remove upstreamed patches
  - btf_encoder-fix-and-complete-filtering-out-zero-sized-per-CPU-variables.patch
  - remove-ftrace-filter.patch
- Pretend version 1.22 to make kernel happy
  + dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626523200">- Use system libbpf when available (bsc#1188420 bsc#1188419 jsc#SLE-17288 jsc#SLE-18805).</changelog>
  <changelog author="msuchanek@suse.com" date="1628856000">- 15.4 has new elfutils, drop libebl-plugins dependency.
- Update to version 1.21+git177.1ef87b2:
  * Fix crash with split BTF debuginfo
  * CMakeList.txt: Bump version to the upcoming 1.22 release, not out of the door yet
  - Remove upstreamed patch dwarves-Prep-1.22.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1629288000">- When building with system libbpf depend also on new enough Linux headers.</changelog>
  <changelog author="jengelh@inai.de" date="1629720000">- Update to release 1.22 (bsc#1190340).
  * Ability to encode BTF to a separate file
  * Multithreaded DWARF loading
  * Details at https://marc.info/?l=dwarves&amp;m=162975403628056&amp;w=2</changelog>
</package>
<package pkgid="ccb91cf4c4d17422743404308073c8f25b77b2932cd196ab81796b8db5227ff5" name="libebl-plugins" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="05d3ce96874564dcc13219ed2f9eb3afb6a667353850b2b81c91ccc439e15706" name="libebl-plugins" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="c57d665943a266f6f436e960e4fa006851770baaf9133f5410b12fef8261900e" name="libeconf" arch="src">
  <version epoch="0" ver="0.4.4+git20220104.962774f" rel="150300.3.8.1"/>
  <changelog author="kukuk@suse.de" date="1567771200">- Update to version 0.3.0+git20190906.0e60a88:
  * Ensure LICENSE, README, and TODO are included in the release tarball
  * Rewrite set*ValueNum functions to avoid libm usage and add error checking
  * Move src/*.c to lib and release version 0.3.0</changelog>
  <changelog author="rbrown@suse.com" date="1569326400">- Update to version 0.3.1+git20190924.822cf5b:
  * release version 0.3.1
  * Set delimiter in readFile
  * Change parser interface to store file name and line numbers per key
  * Update ccpp.yml</changelog>
  <changelog author="kukuk@suse.com" date="1569499200">- Update to version 0.3.2+git20190926.fea4a03:
  * Release version 0.3.2
  * Fix merging an empty file (#105)
  * Add test cases for merge function</changelog>
  <changelog author="iforster@suse.com" date="1572264000">- Update to version 0.3.3+git20191028.3ac14ce:
  * Release version 0.3.3
  * Reset *key_file to NULL after free</changelog>
  <changelog author="rbrown@suse.com" date="1579608000">- Update to version 0.3.4+git20200121.febebf2:
  * Release version 0.3.4
  * Fix buffer overflow in econf_readDirs
  * Fix parsing of quoted strings, and values starting with delimiters
  * tests: add test for quoted strings
  * tests: tst-configdirs5: fix config dir paths</changelog>
  <changelog author="rbrown@suse.com" date="1580731200">- Update to version 0.3.5+git20200203.3144b69:
  * Release version 0.3.5
  * Use float.h instead of obsolete gnuism values.h
  * Remove gnuism (strdupa)
  * Check for empty value (NULL pointer) before calling strdup.</changelog>
  <changelog author="rbrown@suse.com" date="1591272000">- Update to version 0.3.6+git20200529.276359f:
  * Package meson files with autotools
  * Use newer version of actions/checkout
  * Add actions for meson
  * Create meson.yml
  * Use meson source root for tests configuration files
  * Add additional compiler warnings
  * First useable meson build support including unit tests
  * Add global options, build with pie and GNU_SOURCE
  * Fix name of library, add example binary
  * add support for meson
  * Add C++ compatibility
  * Add test case for crash with empty value keys</changelog>
  <changelog author="rbrown@suse.com" date="1591358400">- Update to version 0.3.7+git20200605.c67ef9a:
  * Fix build on i586</changelog>
  <changelog author="rbrown@suse.com" date="1594382400">- Update to version 0.3.8+git20200710.5126fff:
  * Add CMake build scripts, remove autotools support
  * Move C++ ABI compatibility section</changelog>
  <changelog author="lnussel@suse.de" date="1603368000">- explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
  On TW it's pulled in implicitly by libxcrypt-devel which is not the
  case on 15.2</changelog>
  <changelog author="schubi@suse.com" date="1617883200">- Update to version 0.4.0+git20210408.6d33e5e:
  * Man pages libeconf.3 and econftool.8.
  * Handling multiline strings.
  * Added libeconf_ext which returns more information like
    line_nr, comments, path of the configuration file,...
  * Econftool, an command line interface for handling configuration
    files.
  * Generating HTML API documentation with doxygen.
  * Improving error handling and semantic file check.
  * Joining entries with the same key to one single entry if
    env variable ECONF_JOIN_SAME_ENTRIES has been set.</changelog>
  <changelog author="schubi@suse.com" date="1618228800">- Update to version 0.4.0+git20210412.1513a26:
  * Added econftool cat option (#146)
  * new API call: econf_readDirsHistory (showing ALL locations)
  * new API call: econf_getPath (absolute path of the configuration file)</changelog>
  <changelog author="schubi@suse.com" date="1618315200">- Update to version 0.4.0+git20210413.fdb8025:
  * Installing man pages via meson. (#147)</changelog>
  <changelog author="schubi@suse.com" date="1618488000">- Removed doxygen from build requires.</changelog>
  <changelog author="schubi@suse.com" date="1625659200">- Update to version 0.4.0+git20210707.537a8a:
  * Fixed resource leaks found by Iker Pedrosa.</changelog>
  <changelog author="Stefan Schubert schubi@suse.com" date="1625745600">- Update to version 0.4.0+git20210708.6918ea1:
  * Fixed covscan FORWARD_NULL_issues warnings</changelog>
  <changelog author="schubi@localhost" date="1625832000">- Update to version 0.4.1+git20210709.cf671f2:
  * CMake fixes regarding installation of econftool and man pages.</changelog>
  <changelog author="schubi@suse.com" date="1636632000">- Update to version libeconf-0.4.2+git20211111.c7a2c52:
  * CMake fixes regarding document installation.
  * Fixed different issues while writing string values to file.
  * Writing comments to file too.
  * Fixed memory leaks.
  * Fixed crash while merging values.</changelog>
  <changelog author="schubi@suse.com" date="1641297600">- Update to version 0.4.2+git20220104.5dfd69d:
  * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)</changelog>
  <changelog author="schubi@suse.com" date="1641297601">- Update to version 0.4.4+git20220104.962774f:
  * Fixed i586 build (#158)</changelog>
</package>
<package pkgid="8db43539fa86114d6cc7f9618c593eed3f0dc4e47bf8a0ae4a5389aa9c71a3dd" name="libeconf0" arch="aarch64">
  <version epoch="0" ver="0.4.4+git20220104.962774f" rel="150300.3.8.1"/>
  <changelog author="kukuk@suse.de" date="1567771200">- Update to version 0.3.0+git20190906.0e60a88:
  * Ensure LICENSE, README, and TODO are included in the release tarball
  * Rewrite set*ValueNum functions to avoid libm usage and add error checking
  * Move src/*.c to lib and release version 0.3.0</changelog>
  <changelog author="rbrown@suse.com" date="1569326400">- Update to version 0.3.1+git20190924.822cf5b:
  * release version 0.3.1
  * Set delimiter in readFile
  * Change parser interface to store file name and line numbers per key
  * Update ccpp.yml</changelog>
  <changelog author="kukuk@suse.com" date="1569499200">- Update to version 0.3.2+git20190926.fea4a03:
  * Release version 0.3.2
  * Fix merging an empty file (#105)
  * Add test cases for merge function</changelog>
  <changelog author="iforster@suse.com" date="1572264000">- Update to version 0.3.3+git20191028.3ac14ce:
  * Release version 0.3.3
  * Reset *key_file to NULL after free</changelog>
  <changelog author="rbrown@suse.com" date="1579608000">- Update to version 0.3.4+git20200121.febebf2:
  * Release version 0.3.4
  * Fix buffer overflow in econf_readDirs
  * Fix parsing of quoted strings, and values starting with delimiters
  * tests: add test for quoted strings
  * tests: tst-configdirs5: fix config dir paths</changelog>
  <changelog author="rbrown@suse.com" date="1580731200">- Update to version 0.3.5+git20200203.3144b69:
  * Release version 0.3.5
  * Use float.h instead of obsolete gnuism values.h
  * Remove gnuism (strdupa)
  * Check for empty value (NULL pointer) before calling strdup.</changelog>
  <changelog author="rbrown@suse.com" date="1591272000">- Update to version 0.3.6+git20200529.276359f:
  * Package meson files with autotools
  * Use newer version of actions/checkout
  * Add actions for meson
  * Create meson.yml
  * Use meson source root for tests configuration files
  * Add additional compiler warnings
  * First useable meson build support including unit tests
  * Add global options, build with pie and GNU_SOURCE
  * Fix name of library, add example binary
  * add support for meson
  * Add C++ compatibility
  * Add test case for crash with empty value keys</changelog>
  <changelog author="rbrown@suse.com" date="1591358400">- Update to version 0.3.7+git20200605.c67ef9a:
  * Fix build on i586</changelog>
  <changelog author="rbrown@suse.com" date="1594382400">- Update to version 0.3.8+git20200710.5126fff:
  * Add CMake build scripts, remove autotools support
  * Move C++ ABI compatibility section</changelog>
  <changelog author="lnussel@suse.de" date="1603368000">- explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
  On TW it's pulled in implicitly by libxcrypt-devel which is not the
  case on 15.2</changelog>
  <changelog author="schubi@suse.com" date="1617883200">- Update to version 0.4.0+git20210408.6d33e5e:
  * Man pages libeconf.3 and econftool.8.
  * Handling multiline strings.
  * Added libeconf_ext which returns more information like
    line_nr, comments, path of the configuration file,...
  * Econftool, an command line interface for handling configuration
    files.
  * Generating HTML API documentation with doxygen.
  * Improving error handling and semantic file check.
  * Joining entries with the same key to one single entry if
    env variable ECONF_JOIN_SAME_ENTRIES has been set.</changelog>
  <changelog author="schubi@suse.com" date="1618228800">- Update to version 0.4.0+git20210412.1513a26:
  * Added econftool cat option (#146)
  * new API call: econf_readDirsHistory (showing ALL locations)
  * new API call: econf_getPath (absolute path of the configuration file)</changelog>
  <changelog author="schubi@suse.com" date="1618315200">- Update to version 0.4.0+git20210413.fdb8025:
  * Installing man pages via meson. (#147)</changelog>
  <changelog author="schubi@suse.com" date="1618488000">- Removed doxygen from build requires.</changelog>
  <changelog author="schubi@suse.com" date="1625659200">- Update to version 0.4.0+git20210707.537a8a:
  * Fixed resource leaks found by Iker Pedrosa.</changelog>
  <changelog author="Stefan Schubert schubi@suse.com" date="1625745600">- Update to version 0.4.0+git20210708.6918ea1:
  * Fixed covscan FORWARD_NULL_issues warnings</changelog>
  <changelog author="schubi@localhost" date="1625832000">- Update to version 0.4.1+git20210709.cf671f2:
  * CMake fixes regarding installation of econftool and man pages.</changelog>
  <changelog author="schubi@suse.com" date="1636632000">- Update to version libeconf-0.4.2+git20211111.c7a2c52:
  * CMake fixes regarding document installation.
  * Fixed different issues while writing string values to file.
  * Writing comments to file too.
  * Fixed memory leaks.
  * Fixed crash while merging values.</changelog>
  <changelog author="schubi@suse.com" date="1641297600">- Update to version 0.4.2+git20220104.5dfd69d:
  * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)</changelog>
  <changelog author="schubi@suse.com" date="1641297601">- Update to version 0.4.4+git20220104.962774f:
  * Fixed i586 build (#158)</changelog>
</package>
<package pkgid="47027a8afd4cd9990dbe140049e34a7dfe613b7c14fe4781d1bc29ee593db58a" name="libeconf0" arch="x86_64">
  <version epoch="0" ver="0.4.4+git20220104.962774f" rel="150300.3.8.1"/>
  <changelog author="kukuk@suse.de" date="1567771200">- Update to version 0.3.0+git20190906.0e60a88:
  * Ensure LICENSE, README, and TODO are included in the release tarball
  * Rewrite set*ValueNum functions to avoid libm usage and add error checking
  * Move src/*.c to lib and release version 0.3.0</changelog>
  <changelog author="rbrown@suse.com" date="1569326400">- Update to version 0.3.1+git20190924.822cf5b:
  * release version 0.3.1
  * Set delimiter in readFile
  * Change parser interface to store file name and line numbers per key
  * Update ccpp.yml</changelog>
  <changelog author="kukuk@suse.com" date="1569499200">- Update to version 0.3.2+git20190926.fea4a03:
  * Release version 0.3.2
  * Fix merging an empty file (#105)
  * Add test cases for merge function</changelog>
  <changelog author="iforster@suse.com" date="1572264000">- Update to version 0.3.3+git20191028.3ac14ce:
  * Release version 0.3.3
  * Reset *key_file to NULL after free</changelog>
  <changelog author="rbrown@suse.com" date="1579608000">- Update to version 0.3.4+git20200121.febebf2:
  * Release version 0.3.4
  * Fix buffer overflow in econf_readDirs
  * Fix parsing of quoted strings, and values starting with delimiters
  * tests: add test for quoted strings
  * tests: tst-configdirs5: fix config dir paths</changelog>
  <changelog author="rbrown@suse.com" date="1580731200">- Update to version 0.3.5+git20200203.3144b69:
  * Release version 0.3.5
  * Use float.h instead of obsolete gnuism values.h
  * Remove gnuism (strdupa)
  * Check for empty value (NULL pointer) before calling strdup.</changelog>
  <changelog author="rbrown@suse.com" date="1591272000">- Update to version 0.3.6+git20200529.276359f:
  * Package meson files with autotools
  * Use newer version of actions/checkout
  * Add actions for meson
  * Create meson.yml
  * Use meson source root for tests configuration files
  * Add additional compiler warnings
  * First useable meson build support including unit tests
  * Add global options, build with pie and GNU_SOURCE
  * Fix name of library, add example binary
  * add support for meson
  * Add C++ compatibility
  * Add test case for crash with empty value keys</changelog>
  <changelog author="rbrown@suse.com" date="1591358400">- Update to version 0.3.7+git20200605.c67ef9a:
  * Fix build on i586</changelog>
  <changelog author="rbrown@suse.com" date="1594382400">- Update to version 0.3.8+git20200710.5126fff:
  * Add CMake build scripts, remove autotools support
  * Move C++ ABI compatibility section</changelog>
  <changelog author="lnussel@suse.de" date="1603368000">- explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
  On TW it's pulled in implicitly by libxcrypt-devel which is not the
  case on 15.2</changelog>
  <changelog author="schubi@suse.com" date="1617883200">- Update to version 0.4.0+git20210408.6d33e5e:
  * Man pages libeconf.3 and econftool.8.
  * Handling multiline strings.
  * Added libeconf_ext which returns more information like
    line_nr, comments, path of the configuration file,...
  * Econftool, an command line interface for handling configuration
    files.
  * Generating HTML API documentation with doxygen.
  * Improving error handling and semantic file check.
  * Joining entries with the same key to one single entry if
    env variable ECONF_JOIN_SAME_ENTRIES has been set.</changelog>
  <changelog author="schubi@suse.com" date="1618228800">- Update to version 0.4.0+git20210412.1513a26:
  * Added econftool cat option (#146)
  * new API call: econf_readDirsHistory (showing ALL locations)
  * new API call: econf_getPath (absolute path of the configuration file)</changelog>
  <changelog author="schubi@suse.com" date="1618315200">- Update to version 0.4.0+git20210413.fdb8025:
  * Installing man pages via meson. (#147)</changelog>
  <changelog author="schubi@suse.com" date="1618488000">- Removed doxygen from build requires.</changelog>
  <changelog author="schubi@suse.com" date="1625659200">- Update to version 0.4.0+git20210707.537a8a:
  * Fixed resource leaks found by Iker Pedrosa.</changelog>
  <changelog author="Stefan Schubert schubi@suse.com" date="1625745600">- Update to version 0.4.0+git20210708.6918ea1:
  * Fixed covscan FORWARD_NULL_issues warnings</changelog>
  <changelog author="schubi@localhost" date="1625832000">- Update to version 0.4.1+git20210709.cf671f2:
  * CMake fixes regarding installation of econftool and man pages.</changelog>
  <changelog author="schubi@suse.com" date="1636632000">- Update to version libeconf-0.4.2+git20211111.c7a2c52:
  * CMake fixes regarding document installation.
  * Fixed different issues while writing string values to file.
  * Writing comments to file too.
  * Fixed memory leaks.
  * Fixed crash while merging values.</changelog>
  <changelog author="schubi@suse.com" date="1641297600">- Update to version 0.4.2+git20220104.5dfd69d:
  * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)</changelog>
  <changelog author="schubi@suse.com" date="1641297601">- Update to version 0.4.4+git20220104.962774f:
  * Fixed i586 build (#158)</changelog>
</package>
<package pkgid="da92b5255d5807d4d25ebfbdc2123cdf568a53cf4bd7711a7643c95d81f6a0c3" name="libelf1" arch="aarch64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="57f6ad4a050e3c95f9f1cf29dcacff1cde237fe6aff5292433483425394bfd0f" name="libelf1" arch="x86_64">
  <version epoch="0" ver="0.177" rel="150300.11.3.1"/>
  <changelog author="normand@linux.vnet.ibm.com" date="1456574400">- rename dt-ppc-opt.patch as elfutils-0.164-dt-ppc-opt.patch
  and add reference to upstream commit id</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1460808000">-  add elfutils-0.164-gcc6.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1467028800">- Update to version 0.166:
  + config: The default program prefix for the installed tools is now
  eu-. Use configure --program-prefix="" to not use a program
  prefix.
  + Various bugfixes.
- Drop elfutils-0.164-dt-ppc-opt.patch and
  elfutils-0.164-gcc6.patch (merged upstream)
- Add patch elfutils-0.166-elfcmp-comp-gcc6.patch: fix
  self-comparison error with GCC 6.
- Changes from 0.165:
  + Add eu-elfcompress
  + Add pkg-config files for libelf and libdw.</changelog>
  <changelog author="schwab@suse.de" date="1468238400">- disable-tests-with-ptrace.patch: disable tests that use ptrace when
  running under qemu-linux-user</changelog>
  <changelog author="matz@suse.com" date="1472558400">- Update to version 0.167:
  libasm: Add eBPF disassembler for EM_BPF files.
  backends: Add m68k and BPF backends.
  ld: Removed.
  dwelf: Add ELF/DWARF string table creation functions. dwelf_strtab_init,
    dwelf_strtab_add, dwelf_strtab_add_len, dwelf_strtab_finalize,
    dwelf_strent_off, dwelf_strent_str and dwelf_strtab_free.
  Support compressed sections from binutils 2.27.
- Remove patch elfutils-0.166-elfcmp-comp-gcc6.patch: included upstream.</changelog>
  <changelog author="mliska@suse.cz" date="1481284800">- Add 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch: fix
  new warning introduced in GCC 7.
- Add 0001-ar-Fix-GCC7-Wformat-length-issues.patch: fix -Wformat-length
  warning introduced in GCC 7.</changelog>
  <changelog author="rguenther@suse.com" date="1490875200">- Update to version 0.168:
  libelf: gelf_newehdr and gelf_newehdr now return void *.
  libdw: dwarf.h corrected the DW_LANG_PLI constant name (was DW_LANG_PL1).
  readelf: Add optional --symbols[=SECTION] argument to select section name.
- Includes changes from 0001-Add-GCC7-Wimplicit-fallthrough-support-fixes.patch
  and 0001-ar-Fix-GCC7-Wformat-length-issues.patch.
- Remove elfutils-0.137-dwarf-header-check-fix.diff which is no longer
  required after a debugedit fix.</changelog>
  <changelog author="bwiedemann@suse.com" date="1490961600">- make tests pass when user does not want debuginfo (boo#1031556)</changelog>
  <changelog author="jengelh@inai.de" date="1491566400">- Add missing ldconfig calls for libasm1</changelog>
  <changelog author="mliska@suse.cz" date="1493121600">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch:
  fix .gnu.attributes checking on ppc64{,le}.</changelog>
  <changelog author="mliska@suse.cz" date="1493294400">- Add 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  unconditionally in the spec file. As we can't support binary diff,
  a newly added test-case is removed from the patch.</changelog>
  <changelog author="jengelh@inai.de" date="1495972800">- Update Git-Clone URL</changelog>
  <changelog author="schwab@linux-m68k.org" date="1497787200">- ppc-machine-flags.patch: support EM_PPC machine flags
- disable-tests-with-ptrace.patch: disable more tests</changelog>
  <changelog author="jengelh@inai.de" date="1501588800">- Update package descriptions.
- Rename libebl1 to libebl-plugins as these are not linked,
  but dlopened using their unversioned libebl_$ARCH.so name.
- Have libelf1 require libebl-plugins (libebl.a, which does the
  dlopen call, is staticly built into libelf1). This is necessary
  for pahole to display its results. [boo#1049871]</changelog>
  <changelog author="jengelh@inai.de" date="1503748800">- Restore obsolete on libebl.</changelog>
  <changelog author="jmoreira@suse.com" date="1537876800">- CVE-2017-7613: elfutils: denial of service (memory consumption)
  via a crafted ELF file (bnc#1033090)
  Add patch:
  elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
- CVE-2017-7612: elfutils: denial of service (heap-based buffer
  over-read and application crash) via a crafted ELF file
  (bnc#1033089)
  Add patch: elfutils-dont-trust-sh_entsize.patch</changelog>
  <changelog author="jmoreira@suse.com" date="1558526400">- CVE-2018-16402: libelf: denial of service/double free on an
  attempt to decompress the same section twice (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
  function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  Add patch:
  arlib-check-that-sh_entsize-isnt-zero.patch
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
  application crash) via a crafted ELF file (bnc#1033088)
  Add patch:
  elflint-check-symbol-table-data-is-big-enough-before-check.patch
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group
  (bnc#1033087)
  Add patch:
  elflint-dont-check-section-group-without-flags-word.patch
- CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  Add patch:
  libdw-check-end-of-attributes-list-consistently.patch
- CVE-2018-16062: heap-buffer-overflow in
  /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
  Add patch:
  libdw-readelf-make-sure-there-is-enough-data-to-read.patch
- CVE-2018-18310: Invalid Address Read problem in
  dwfl_segment_report_module.c (bnc#1111973)
  Add patch:
  libdwfl-sanity-check-partial-core-file-data-reads.patch
- CVE-2019-7150: dwfl_segment_report_module doesn't check whether
  the dyn data read from core file is truncated (bnc#1123685)
  Add patch:
  libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
- CVE-2019-7665: NT_PLATFORM core file note should be a zero
  terminated string (CVE is a bit misleading, as this is not a bug
  in libelf as described) (bnc#1125007)
  Add patch:
  libebl-check-NT_PLATFORM-core-notes.patch
- CVE-2017-7609: memory allocation failure in __libelf_decompress
  (bnc#1033086)
  Add patch:
  libelf-check-compression-before-allocate-output-buffer.patch
- CVE-2018-16402: Double-free crash in nm and readelf (bnc#1107066)
  Add patch:
  libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
  (readelf.c) (bnc#1033084)
  Add patch:
  readelf-fix-off-by-one-sanity-check.patch
- CVE-2018-18520: eu-size: Bad handling of ar files inside are
  files (bnc#1112726)
  Add patch:
  size-handle-recursive-elf-ar-files.patch
- CVE-2017-7608: heap-based buffer overflow in
  ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  Add patch:
  use-the-empty-string-for-note-names-with-zero-size.patch</changelog>
  <changelog author="schwab@suse.de" date="1573732800">- disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
- dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657108800">- Update to version 0.177 (Martin Li?ka):
    elfclassify: New tool to analyze ELF objects.
    readelf: Print DW_AT_data_member_location as decimal offset.
    Decode DW_AT_discr_list block attributes.
    libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
    libdwelf: Add dwelf_elf_e_machine_string.
    dwelf_elf_begin now only returns NULL when there is an error
    reading or decompressing a file. If the file is not an ELF file
    an ELF handle of type ELF_K_NONE is returned.
    backends: Add support for C-SKY.
  - Update to version 0.176
    build: Add new --enable-install-elfh option.
    Do NOT use this for system installs (it overrides glibc elf.h).
    backends: riscv improved core file and return value location support.
    Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664
  - CVE-2019-7150: dwfl_segment_report_module doesn't check whether
    the dyn data read from core file is truncated (bnc#1123685)
  - CVE-2019-7665: NT_PLATFORM core file note should be a zero
    terminated string (CVE is a bit misleading, as this is not a bug
    in libelf as described) (bnc#1125007)
  - Removed patches:
  - libdwfl-sanity-check-partial-core-file-dyn-data-read.patch
  - libebl-check-NT_PLATFORM-core-notes.patch
  - Update to version 0.175 (Martin Li?ka):
    readelf: Handle mutliple .debug_macro sections.
    Recognize and parse GNU Property, NT_VERSION and
    GNU Build Attribute ELF Notes.
    strip: Handle SHT_GROUP correctly.
    Add strip --reloc-debug-sections-only option.
    Handle relocations against GNU compressed sections.
    libdwelf: New function dwelf_elf_begin.
    libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
    and BPF_JSLE.
    backends: RISCV handles ADD/SUB relocations.
    Handle SHT_X86_64_UNWIND.
  - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the
    function arlib_add_symbols() used by eu-ranlib (bnc#1112723)
  - CVE-2018-18310: Invalid Address Read problem in
    dwfl_segment_report_module.c (bnc#1111973)
  - CVE-2018-18520: eu-size: Bad handling of ar files inside are
    files (bnc#1112726)
  - Removed patches:
  - arlib-check-that-sh_entsize-isnt-zero.patch
  - libdwfl-sanity-check-partial-core-file-data-reads.patch
  - size-handle-recursive-elf-ar-files.patch
  - Update to version 0.174 (Martin Li?ka):
    libelf, libdw and all tools now handle extended shnum and
    shstrndx correctly.
    elfcompress: Don't rewrite input file if no section data needs
    updating. Try harder to keep same file mode bits
    (suid) on rewrite.
    strip: Handle mixed (out of order) allocated/non-allocated
    sections.
    unstrip: Handle SHT_GROUP sections.
    backends: RISCV and M68K now have backend implementations to
    generate CFI based backtraces.
  - CVE-2018-16402: libelf: denial of service/double free on an
    attempt to decompress the same section twice (bnc#1107066)
    Double-free crash in nm and readelf
  - CVE-2018-16403: heap buffer overflow in readelf (bnc#1107067)
  - CVE-2018-16062: heap-buffer-overflow in
    /elfutils/libdw/dwarf_getaranges.c:156 (bnc#1106390)
    Removed patches:
    libelf-error-if-elf_compress_gnu-is-used-on-SHF_COMPRESSED.patch
    libdw-check-end-of-attributes-list-consistently.patch
    libdw-readelf-make-sure-there-is-enough-data-to-read.patch
  - Update to version 0.173 (Martin Li?ka):
    More fixes for crashes and hangs found by afl-fuzz. In particular various
    functions now detect and break infinite loops caused by bad DIE tree cycles.
    readelf: Will now lookup the size and signedness of constant value types
    to display them correctly (and not just how they were encoded).
    libdw: New function dwarf_next_lines to read CU-less .debug_line data.
    dwarf_begin_elf now accepts ELF files containing just .debug_line
    or .debug_frame sections (which can be read without needing a DIE
    tree from the .debug_info section).
    Removed dwarf_getscn_info, which was never implemented.
    backends: Handle BPF simple relocations.
    The RISCV backends now handles ABI specific CFI and knows about
    RISCV register types and names.
  - Update to version 0.172 (Martin Li?ka):
    No functional changes compared to 0.171.
    Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
    Thanks to running the afl fuzzer on eu-readelf and various testcases.
  - Update to version 0.171 (Martin Li?ka):
    DWARF5 and split dwarf, including GNU DebugFission, are supported now.
    Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
    .debug_loclists, .debug_str_offsets and .debug_rnglists.  Plus the new
    DWARF5 and GNU DebugFission encodings of the existing .debug sections.
    Also in split DWARF .dwo (DWARF object) files.  This support is mostly
    handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
    dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
    sections and data formats.  But some new functions have been added
    to more easily get information about skeleton and split compile units
    (dwarf_get_units and dwarf_cu_info), handle new attribute data
    (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
    that might come from different sections or files (dwarf_die_addr_die).
    Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
    files, the .debug_names index, the .debug_cu_index and .debug_tu_index
    sections. Only a single .debug_info (and .debug_types) section are
    currently handled.
    readelf: Handle all new DWARF5 sections.
  - -debug-dump=info+ will show split unit DIEs when found.
  - -dwarf-skeleton can be used when inspecting a .dwo file.
    Recognizes GNU locviews with --debug-dump=loc.
    libdw: New functions dwarf_die_addr_die, dwarf_get_units,
    dwarf_getabbrevattr_data and dwarf_cu_info.
    libdw will now try to resolve the alt file on first use of
    an alt attribute FORM when not set yet with dwarf_set_alt.
    dwarf_aggregate_size() now works with multi-dimensional arrays.
    libdwfl: Use process_vm_readv when available instead of ptrace.
    backends: Add a RISC-V backend.
    There were various improvements to build on Windows.
    The sha1 and md5 implementations have been removed, they weren't used.
  - Update to version 0.170 (Martin Li?ka):
    libdw: Added new DWARF5 attribute, tag, character encoding, language code,
    calling convention, defaulted member function and macro constants
    to dwarf.h.
  New functions dwarf_default_lower_bound and dwarf_line_file.
  dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
  dwarf_getmacros now handles DWARF5 .debug_macro sections.
    strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
    backends: The bpf disassembler is now always build on all platforms.
  - Includes changes in 0.169
    backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
    Frame pointer unwinding fallback support for i386, x86_64, aarch64.
    translations: Update Polish translation.
  - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and
    application crash) via a crafted ELF file (bnc#1033088)
  - CVE-2017-7610: elflint: heap-based buffer overflow in check_group
    (bnc#1033087)
  - CVE-2017-7609: memory allocation failure in __libelf_decompress
    (bnc#1033086)
  - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi
    (readelf.c) (bnc#1033084)
  - CVE-2017-7608: heap-based buffer overflow in
    ebl_object_note_type_name (eblobjnotetypename.c) (bnc#1033085)
  - CVE-2017-7613: elfutils: denial of service (memory consumption)
    via a crafted ELF file (bnc#1033090)
  - CVE-2017-7612: elfutils: denial of service (heap-based buffer
    over-read and application crash) via a crafted ELF file (bnc#1033089)
  - Removed patches:
  - obsolete 0001-backends-Add-support-for-EM_PPC64-GNU_ATTRIBUTES.patch
  - ppc-machine-flags.patch
  - elflint-check-symbol-table-data-is-big-enough-before-check.patch
  - elflint-dont-check-section-group-without-flags-word.patch
  - libelf-check-compression-before-allocate-output-buffer.patch
  - readelf-fix-off-by-one-sanity-check.patch
  - use-the-empty-string-for-note-names-with-zero-size.patch
  - elflint-sanity-check-the-number-of-phdrs-and-shdrs.patch
  - elfutils-dont-trust-sh_entsize.patch
- Packaging cleanups:
  - Modernize specfile and metadata. (Jan Engelhardt)
  - Use %make_build (Martin Li?ka)
  - Update License tag to GPL-3.0-or-later, as requested by legal
    review. (Dominique Leuenberger)
  - Don't make elfutils recommend elfutils-lang as elfutils-lang
    already supplements elfutils. (Antoine Belvire)
  - Fix typo in the recommends name bsc#1104264 (Tomas Chvatal)
  - Use %license (boo#1082318) (Fabian Vogt)
- Test fixes (Andreas Schwab):
  - disable-tests-with-ptrace.patch: Remove, set XFAIL_TESTS instead
  - dwelf_elf_e_machine_string.patch: Avoid spurious failure</changelog>
  <changelog author="jeffm@suse.com" date="1657627200">- Added 4G memory build constraint for aarch64 to pass testing.</changelog>
</package>
<package pkgid="bc5ab354d08869b4adcf6e32259176366b3d9e6c451970a33556f97b3b9bb3d1" name="libexpat1" arch="aarch64">
  <version epoch="0" ver="2.2.5" rel="150000.3.22.1"/>
  <changelog author="mpluskal@suse.com" date="1436616000">- Cleanup spec file with spec-cleaner
- Remove old ppc obsoletes/provides</changelog>
  <changelog author="idonmez@suse.com" date="1458734400">- Update to version 2.1.1
  * Fixes CVE-2015-1283 ? Multiple integer overflows in the
    XML_GetBuffer function
  * Fix potential null pointer dereference
  * Symbol XML_SetHashSalt was not exported
  * Output of xmlwf -h was incomplete
  * Document behavior of calling XML_SetHashSalt with salt 0
  * Minor improvements to man page xmlwf(1)
- Simplify expat-visibility.patch, refresh expat-alloc-size.patch
- Drop config-guess-sub-update.patch, fixed upstream.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1459512000">- After simplification of expat-visibility.patch, it became
  uneffective as no symbols are getting hidden. add
  - fvisibility=hidden to CFLAGS again.
- expat-alloc-size.patch: fix braino, realloc()-like functions
  should not take __attribute__(malloc)</changelog>
  <changelog author="kstreitova@suse.com" date="1463572800">- add expat-2.1.1-avoid_relying_on_undef_behaviour.patch to avoid
  relying on undefined behavior in the original CVE-2015-1283 fix
  [bnc#980391], [bnc#983985], [CVE-2016-4472]
- add expat-2.1.1-parser_crashes_on_malformed_input.patch to fix
  Expat XML parser that mishandles certain kinds of malformed input
  documents [bnc#979441], [CVE-2016-0718]
- use spec-cleaner to clean specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1468497600">- Version update to 2.2.0:
  * Fixes bnc#983215 CVE-2012-6702
  * Fixes bnc#983216 CVE-2016-5300
  * Various cmake and autotools script updates
  * Fix detection of utf8 character boundaries
- Remove all patches merged upstream:
  * expat-2.1.1-avoid_relying_on_undef_behaviour.patch
  * expat-2.1.1-parser_crashes_on_malformed_input.patch
  * expat-alloc-size.patch
  * expat-visibility.patch</changelog>
  <changelog author="jengelh@inai.de" date="1468843200">- Remove pointless --with-pic (for static only)</changelog>
  <changelog author="meissner@suse.com" date="1499169600">- Version update to 2.2.1 Sat June 17 2017
  - Security fixes:
    CVE-2017-9233 / bsc#1047236 -- External entity infinite loop DoS
    Details: https://libexpat.github.io/doc/cve-2017-9233/
    Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
  - [MOX-002]      CVE-2016-9063 / bsc#1047240 -- Detect integer overflow;
    (Fixed version of existing downstream patches!)
  - (SF.net) #539  Fix regression from fix to CVE-2016-0718 cutting off
    longer tag names;
    [#25]  More integer overflow detection (function poolGrow);
  - [MOX-002]      Detect overflow from len=INT_MAX call to XML_Parse;
  - [MOX-005] #30  Use high quality entropy for hash initialization:
  * arc4random_buf on BSD, systems with libbsd
    (when configured with --with-libbsd), CloudABI
  * RtlGenRandom on Windows XP / Server 2003 and later
  * getrandom on Linux 3.17+
    In a way, that's still part of CVE-2016-5300.
    https://github.com/libexpat/libexpat/pull/30/commits
  - [MOX-005] For the low quality entropy extraction fallback code,
    the parser instance address can no longer leak,
  - [MOX-003] Prevent use of uninitialised variable; commit
  - [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
    Add missing parameter validation to public API functions
    and dedicated error code XML_ERROR_INVALID_ARGUMENT:
  - [MOX-006] * NULL checks; commits
  * Negative length (XML_Parse); commit
  - [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
  - [MOX-001] #35  Change hash algorithm to William Ahern's version of SipHash
    to go further with fixing CVE-2012-0876.
    https://github.com/libexpat/libexpat/pull/39/commits
  - Bug fixes:
    [#32] Fix sharing of hash salt across parsers;
    relevant where XML_ExternalEntityParserCreate is called
    prior to XML_Parse, in particular (e.g. FBReader)
    [#28] xmlwf: Auto-disable use of memory-mapping (and parsing
    as a single chunk) for files larger than ~1 GB (2^30 bytes)
    rather than failing with error "out of memory"
    [#3]  Fix double free after malloc failure in DTD code; commit
    7ae9c3d3af433cd4defe95234eae7dc8ed15637f
    [#17] Fix memory leak on parser error for unbound XML attribute
    prefix with new namespaces defined in the same tag;
    found by Google's OSS-Fuzz; commits
    xmlwf on Windows: Add missing calls to CloseHandle
  - New features:
    [#30] Introduced environment switch EXPAT_ENTROPY_DEBUG=1
    for runtime debugging of entropy extraction
    Bump version info from 7:2:6 to 7:3:6</changelog>
  <changelog author="mpluskal@suse.com" date="1499774400">- Build with profiling when possible</changelog>
  <changelog author="jayvdb@gmail.com" date="1507377600">- Allow building when do_profiling is undefined</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1509019200">- Version update to 2.2.4 Sat August 19 2017
  * Bug fixes:
    [#115]  Fix copying of partial characters for UTF-8 input
  * Other changes:
    [#109]  Fix "make check" for non-x86 architectures that default
    to unsigned type char (-128..127 rather than 0..255)
    [#109]  coverage.sh: Cover -funsigned-char
    Autotools: Introduce --without-xmlwf argument
    [#65]  Autotools: Replace handwritten Makefile with GNU Automake
    [#43]  CMake: Auto-detect high quality entropy extractors, add new
    option USE_libbsd=ON to use arc4random_buf of libbsd
    [#74]  CMake: Add -fno-strict-aliasing only where supported
    [#114]  CMake: Always honor manually set BUILD_* options
    [#114]  CMake: Compile man page if docbook2x-man is available, only
    [#117]  Include file tests/xmltest.log.expected in source tarball
    (required for "make run-xmltest")
    [#111]  Fix some typos in documentation
    Version info bumped from 7:5:6 to 7:6:6
- Release 2.2.3 Wed August 2 2017
  * Bug fixes:
    [#85]  Fix a dangling pointer issue related to realloc
  * Other changes:
    [#91]  Linux: Allow getrandom to fail if nonblocking pool has not
    yet been initialized and read /dev/urandom then, instead.
    This is in line with what recent Python does.
    [#86]  Check that a UTF-16 encoding in an XML declaration has the
    right endianness
  [#4] #5 #7  Recover correctly when some reallocations fail
    Repair "./configure &amp;&amp; make" for systems without any
    provider of high quality entropy
    and try reading /dev/urandom on those
    Ensure that user-defined character encodings have converter
    functions when they are needed
    Fix mis-leading description of argument -c in xmlwf.1
    Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__)
    for CloudABI
    [#100]  Fix use of SIPHASH_MAIN in siphash.h
    [#23]  Test suite: Fix memory leaks
    Version info bumped from 7:4:6 to 7:5:6
- Release 2.2.2 Wed July 12 2017
  * Security fixes:
    [#43]  Protect against compilation without any source of high
    quality entropy enabled, e.g. with CMake build system;
  * [MOX-006] Fix non-NULL parser parameter validation in XML_Parse;
    resulted in NULL dereference, previously;
  * Bug fixes:
    [#69]  Fix improper use of unsigned long long integer literals
  * Other changes:
    [#73]  Start requiring a C99 compiler
    [#49]  Fix "==" Bashism in configure script
    [#58]  Address compile warnings
    [#68]  Fix "./buildconf.sh &amp;&amp; ./configure" for some versions
    of Dash for /bin/sh
    [#72]  CMake: Ease use of Expat in context of a parent project
    with multiple CMakeLists.txt files
    [#72]  CMake: Resolve mistaken executable permissions
    [#76]  Address compile warning with -DNDEBUG (not recommended!)
    [#77]  Address compile warning about macro redefinition
  * Added patch expat-docbook.patch to compile the man pages with
  docbook-to-man
  * Cleaned spec file with spec-cleaner</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- Version update to 2.2.5 Tue October 31 2017
  * Bug fixes:
  - If the parser runs out of memory, make sure its internal
    state reflects the memory it actually has, not the memory
    it wanted to have.
  - The default handler wasn't being called when it should for
    a SYSTEM or PUBLIC doctype if an entity declaration handler
    was registered.
  - Fix a case of mistakenly reported parsing success where
    XML_StopParser was called from an element handler
  - Function XML_ErrorString was returning NULL rather than
    a message for code XML_ERROR_INVALID_ARGUMENT
    introduced with release 2.2.1
  * Other changes:
  - Add argument -N adding notation declarations
  - various compiler-specific fixes
  - Improve docbook2x-man detection
- drop expat-docbook.patch
  * fixed in 0f5186c7b8e503c669e332d944712de010b265f3
- switch to github for release tarballs and website</changelog>
  <changelog author="mpluskal@suse.com" date="1510833600">- Do not generate manpages from docbook
- Temporarily disable profiling due to bug in build system</changelog>
  <changelog author="jengelh@inai.de" date="1510833601">- Expand description of expat-devel.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix (CVE-2018-20843, bsc#1139937)
  * Large number of colons in input makes parser consume high
    amount of resources
  * Added expat-CVE-2018-20843.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567598400">- Security fix (CVE-2019-15903, bsc#1149429)
  * Crafted XML input results in heap-based buffer over-read by fooling
    the parser into changing from DTD parsing to document parsing
  * Added patches:
  - expat-CVE-2019-15903.patch
  - expat-CVE-2019-15903-tests.patch</changelog>
  <changelog author="david.anes@suse.com" date="1642420800">- Security fix (CVE-2021-45960, bsc#1194251)
  * A left shift by 29 (or more) places in the storeAtts function
    in xmlparse.c can lead to realloc misbehavior.
  * Added expat-CVE-2021-45960.patch
- Security fix (CVE-2021-46143, bsc#1194362)
  * Integer overflow exists for m_groupSize in doProlog
  * Added expat-CVE-2021-46143.patch
- Security fix (CVE-2022-22822, bsc#1194474)
  * Integer overflow in addBinding in xmlparse.c
  * Added expat-CVE-2022-22822.patch
- Security fix (CVE-2022-22823, bsc#1194476)
  * Integer overflow in build_model in xmlparse.c
  * Added expat-CVE-2022-22823.patch
- Security fix (CVE-2022-22824, bsc#1194477)
  * Integer overflow in defineAttribute in xmlparse.c
  * Added expat-CVE-2022-22824.patch
- Security fix (CVE-2022-22825, bsc#1194478)
  * Integer overflow in lookup in xmlparse.c
  * Added expat-CVE-2022-22825.patch
- Security fix (CVE-2022-22826, bsc#1194479)
  * Integer overflow in nextScaffoldPart in xmlparse.c
  * Added expat-CVE-2022-22826.patch
- Security fix (CVE-2022-22827, bsc#1194480)
  * Integer overflow in storeAtts in xmlparse.c
  * Added expat-CVE-2022-22827.patch
- Refresh expat-CVE-2018-20843.patch as a p1 patch.
- Use %autosetup macro</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- Security fix (CVE-2022-23852, bsc#1195054)
  * Expat (aka libexpat) before 2.4.4 has a signed integer overflow
    in XML_GetBuffer, for configurations with a nonzero
    XML_CONTEXT_BYTES
  * Add tests for CVE-2022-23852.
  * Added expat-CVE-2022-23852.patch
- Security fix (CVE-2022-23990, bsc#1195217)
  * Fix unsigned integer overflow in function doProlog triggered
    by large content in element type declarations when there is
    an element declaration handler present (from a prior call to
    XML_SetElementDeclHandler).
  * Add expat-CVE-2022-23990.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645444800">- Security fixes:
  * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
    attackers to insert namespace-separator characters into
    namespace URIs
  - Added expat-CVE-2022-25236.patch
  * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
    2.4.5 does not check whether a UTF-8 character is valid in a
    certain context.
  - Added expat-CVE-2022-25235.patch
  * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
    build_model() via uncontrolled recursion
  - Added expat-CVE-2022-25313.patch
  - The fix upstream introduced a regression that was later
    amended in 2.4.6 version
    + Added expat-CVE-2022-25313-fix-regression.patch
  * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
  - Added expat-CVE-2022-25314.patch
  * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
  - Added expat-CVE-2022-25315.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- Security fixes:
  * (CVE-2022-25236, bsc#1196784) [&gt;=2.4.5] Fix to CVE-2022-25236
    breaks biboumi, ClairMeta, jxmlease, libwbxml,
    openleadr-python, rnv, xmltodict
  - Added expat-CVE-2022-25236-relax-fix.patch</changelog>
  <changelog author="david.anes@suse.com" date="1664193600">- Security fix:
  * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent
    function in xmlparse.c
  - Added patch expat-CVE-2022-40674.patch</changelog>
</package>
<package pkgid="9b5786a846d41010f60c366741e5b98a66d3ff6315d6010c1b1ae964b2bc4bb0" name="libexpat1" arch="x86_64">
  <version epoch="0" ver="2.2.5" rel="150000.3.22.1"/>
  <changelog author="mpluskal@suse.com" date="1436616000">- Cleanup spec file with spec-cleaner
- Remove old ppc obsoletes/provides</changelog>
  <changelog author="idonmez@suse.com" date="1458734400">- Update to version 2.1.1
  * Fixes CVE-2015-1283 ? Multiple integer overflows in the
    XML_GetBuffer function
  * Fix potential null pointer dereference
  * Symbol XML_SetHashSalt was not exported
  * Output of xmlwf -h was incomplete
  * Document behavior of calling XML_SetHashSalt with salt 0
  * Minor improvements to man page xmlwf(1)
- Simplify expat-visibility.patch, refresh expat-alloc-size.patch
- Drop config-guess-sub-update.patch, fixed upstream.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1459512000">- After simplification of expat-visibility.patch, it became
  uneffective as no symbols are getting hidden. add
  - fvisibility=hidden to CFLAGS again.
- expat-alloc-size.patch: fix braino, realloc()-like functions
  should not take __attribute__(malloc)</changelog>
  <changelog author="kstreitova@suse.com" date="1463572800">- add expat-2.1.1-avoid_relying_on_undef_behaviour.patch to avoid
  relying on undefined behavior in the original CVE-2015-1283 fix
  [bnc#980391], [bnc#983985], [CVE-2016-4472]
- add expat-2.1.1-parser_crashes_on_malformed_input.patch to fix
  Expat XML parser that mishandles certain kinds of malformed input
  documents [bnc#979441], [CVE-2016-0718]
- use spec-cleaner to clean specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1468497600">- Version update to 2.2.0:
  * Fixes bnc#983215 CVE-2012-6702
  * Fixes bnc#983216 CVE-2016-5300
  * Various cmake and autotools script updates
  * Fix detection of utf8 character boundaries
- Remove all patches merged upstream:
  * expat-2.1.1-avoid_relying_on_undef_behaviour.patch
  * expat-2.1.1-parser_crashes_on_malformed_input.patch
  * expat-alloc-size.patch
  * expat-visibility.patch</changelog>
  <changelog author="jengelh@inai.de" date="1468843200">- Remove pointless --with-pic (for static only)</changelog>
  <changelog author="meissner@suse.com" date="1499169600">- Version update to 2.2.1 Sat June 17 2017
  - Security fixes:
    CVE-2017-9233 / bsc#1047236 -- External entity infinite loop DoS
    Details: https://libexpat.github.io/doc/cve-2017-9233/
    Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
  - [MOX-002]      CVE-2016-9063 / bsc#1047240 -- Detect integer overflow;
    (Fixed version of existing downstream patches!)
  - (SF.net) #539  Fix regression from fix to CVE-2016-0718 cutting off
    longer tag names;
    [#25]  More integer overflow detection (function poolGrow);
  - [MOX-002]      Detect overflow from len=INT_MAX call to XML_Parse;
  - [MOX-005] #30  Use high quality entropy for hash initialization:
  * arc4random_buf on BSD, systems with libbsd
    (when configured with --with-libbsd), CloudABI
  * RtlGenRandom on Windows XP / Server 2003 and later
  * getrandom on Linux 3.17+
    In a way, that's still part of CVE-2016-5300.
    https://github.com/libexpat/libexpat/pull/30/commits
  - [MOX-005] For the low quality entropy extraction fallback code,
    the parser instance address can no longer leak,
  - [MOX-003] Prevent use of uninitialised variable; commit
  - [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
    Add missing parameter validation to public API functions
    and dedicated error code XML_ERROR_INVALID_ARGUMENT:
  - [MOX-006] * NULL checks; commits
  * Negative length (XML_Parse); commit
  - [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
  - [MOX-001] #35  Change hash algorithm to William Ahern's version of SipHash
    to go further with fixing CVE-2012-0876.
    https://github.com/libexpat/libexpat/pull/39/commits
  - Bug fixes:
    [#32] Fix sharing of hash salt across parsers;
    relevant where XML_ExternalEntityParserCreate is called
    prior to XML_Parse, in particular (e.g. FBReader)
    [#28] xmlwf: Auto-disable use of memory-mapping (and parsing
    as a single chunk) for files larger than ~1 GB (2^30 bytes)
    rather than failing with error "out of memory"
    [#3]  Fix double free after malloc failure in DTD code; commit
    7ae9c3d3af433cd4defe95234eae7dc8ed15637f
    [#17] Fix memory leak on parser error for unbound XML attribute
    prefix with new namespaces defined in the same tag;
    found by Google's OSS-Fuzz; commits
    xmlwf on Windows: Add missing calls to CloseHandle
  - New features:
    [#30] Introduced environment switch EXPAT_ENTROPY_DEBUG=1
    for runtime debugging of entropy extraction
    Bump version info from 7:2:6 to 7:3:6</changelog>
  <changelog author="mpluskal@suse.com" date="1499774400">- Build with profiling when possible</changelog>
  <changelog author="jayvdb@gmail.com" date="1507377600">- Allow building when do_profiling is undefined</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1509019200">- Version update to 2.2.4 Sat August 19 2017
  * Bug fixes:
    [#115]  Fix copying of partial characters for UTF-8 input
  * Other changes:
    [#109]  Fix "make check" for non-x86 architectures that default
    to unsigned type char (-128..127 rather than 0..255)
    [#109]  coverage.sh: Cover -funsigned-char
    Autotools: Introduce --without-xmlwf argument
    [#65]  Autotools: Replace handwritten Makefile with GNU Automake
    [#43]  CMake: Auto-detect high quality entropy extractors, add new
    option USE_libbsd=ON to use arc4random_buf of libbsd
    [#74]  CMake: Add -fno-strict-aliasing only where supported
    [#114]  CMake: Always honor manually set BUILD_* options
    [#114]  CMake: Compile man page if docbook2x-man is available, only
    [#117]  Include file tests/xmltest.log.expected in source tarball
    (required for "make run-xmltest")
    [#111]  Fix some typos in documentation
    Version info bumped from 7:5:6 to 7:6:6
- Release 2.2.3 Wed August 2 2017
  * Bug fixes:
    [#85]  Fix a dangling pointer issue related to realloc
  * Other changes:
    [#91]  Linux: Allow getrandom to fail if nonblocking pool has not
    yet been initialized and read /dev/urandom then, instead.
    This is in line with what recent Python does.
    [#86]  Check that a UTF-16 encoding in an XML declaration has the
    right endianness
  [#4] #5 #7  Recover correctly when some reallocations fail
    Repair "./configure &amp;&amp; make" for systems without any
    provider of high quality entropy
    and try reading /dev/urandom on those
    Ensure that user-defined character encodings have converter
    functions when they are needed
    Fix mis-leading description of argument -c in xmlwf.1
    Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__)
    for CloudABI
    [#100]  Fix use of SIPHASH_MAIN in siphash.h
    [#23]  Test suite: Fix memory leaks
    Version info bumped from 7:4:6 to 7:5:6
- Release 2.2.2 Wed July 12 2017
  * Security fixes:
    [#43]  Protect against compilation without any source of high
    quality entropy enabled, e.g. with CMake build system;
  * [MOX-006] Fix non-NULL parser parameter validation in XML_Parse;
    resulted in NULL dereference, previously;
  * Bug fixes:
    [#69]  Fix improper use of unsigned long long integer literals
  * Other changes:
    [#73]  Start requiring a C99 compiler
    [#49]  Fix "==" Bashism in configure script
    [#58]  Address compile warnings
    [#68]  Fix "./buildconf.sh &amp;&amp; ./configure" for some versions
    of Dash for /bin/sh
    [#72]  CMake: Ease use of Expat in context of a parent project
    with multiple CMakeLists.txt files
    [#72]  CMake: Resolve mistaken executable permissions
    [#76]  Address compile warning with -DNDEBUG (not recommended!)
    [#77]  Address compile warning about macro redefinition
  * Added patch expat-docbook.patch to compile the man pages with
  docbook-to-man
  * Cleaned spec file with spec-cleaner</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- Version update to 2.2.5 Tue October 31 2017
  * Bug fixes:
  - If the parser runs out of memory, make sure its internal
    state reflects the memory it actually has, not the memory
    it wanted to have.
  - The default handler wasn't being called when it should for
    a SYSTEM or PUBLIC doctype if an entity declaration handler
    was registered.
  - Fix a case of mistakenly reported parsing success where
    XML_StopParser was called from an element handler
  - Function XML_ErrorString was returning NULL rather than
    a message for code XML_ERROR_INVALID_ARGUMENT
    introduced with release 2.2.1
  * Other changes:
  - Add argument -N adding notation declarations
  - various compiler-specific fixes
  - Improve docbook2x-man detection
- drop expat-docbook.patch
  * fixed in 0f5186c7b8e503c669e332d944712de010b265f3
- switch to github for release tarballs and website</changelog>
  <changelog author="mpluskal@suse.com" date="1510833600">- Do not generate manpages from docbook
- Temporarily disable profiling due to bug in build system</changelog>
  <changelog author="jengelh@inai.de" date="1510833601">- Expand description of expat-devel.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix (CVE-2018-20843, bsc#1139937)
  * Large number of colons in input makes parser consume high
    amount of resources
  * Added expat-CVE-2018-20843.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567598400">- Security fix (CVE-2019-15903, bsc#1149429)
  * Crafted XML input results in heap-based buffer over-read by fooling
    the parser into changing from DTD parsing to document parsing
  * Added patches:
  - expat-CVE-2019-15903.patch
  - expat-CVE-2019-15903-tests.patch</changelog>
  <changelog author="david.anes@suse.com" date="1642420800">- Security fix (CVE-2021-45960, bsc#1194251)
  * A left shift by 29 (or more) places in the storeAtts function
    in xmlparse.c can lead to realloc misbehavior.
  * Added expat-CVE-2021-45960.patch
- Security fix (CVE-2021-46143, bsc#1194362)
  * Integer overflow exists for m_groupSize in doProlog
  * Added expat-CVE-2021-46143.patch
- Security fix (CVE-2022-22822, bsc#1194474)
  * Integer overflow in addBinding in xmlparse.c
  * Added expat-CVE-2022-22822.patch
- Security fix (CVE-2022-22823, bsc#1194476)
  * Integer overflow in build_model in xmlparse.c
  * Added expat-CVE-2022-22823.patch
- Security fix (CVE-2022-22824, bsc#1194477)
  * Integer overflow in defineAttribute in xmlparse.c
  * Added expat-CVE-2022-22824.patch
- Security fix (CVE-2022-22825, bsc#1194478)
  * Integer overflow in lookup in xmlparse.c
  * Added expat-CVE-2022-22825.patch
- Security fix (CVE-2022-22826, bsc#1194479)
  * Integer overflow in nextScaffoldPart in xmlparse.c
  * Added expat-CVE-2022-22826.patch
- Security fix (CVE-2022-22827, bsc#1194480)
  * Integer overflow in storeAtts in xmlparse.c
  * Added expat-CVE-2022-22827.patch
- Refresh expat-CVE-2018-20843.patch as a p1 patch.
- Use %autosetup macro</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- Security fix (CVE-2022-23852, bsc#1195054)
  * Expat (aka libexpat) before 2.4.4 has a signed integer overflow
    in XML_GetBuffer, for configurations with a nonzero
    XML_CONTEXT_BYTES
  * Add tests for CVE-2022-23852.
  * Added expat-CVE-2022-23852.patch
- Security fix (CVE-2022-23990, bsc#1195217)
  * Fix unsigned integer overflow in function doProlog triggered
    by large content in element type declarations when there is
    an element declaration handler present (from a prior call to
    XML_SetElementDeclHandler).
  * Add expat-CVE-2022-23990.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645444800">- Security fixes:
  * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
    attackers to insert namespace-separator characters into
    namespace URIs
  - Added expat-CVE-2022-25236.patch
  * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
    2.4.5 does not check whether a UTF-8 character is valid in a
    certain context.
  - Added expat-CVE-2022-25235.patch
  * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
    build_model() via uncontrolled recursion
  - Added expat-CVE-2022-25313.patch
  - The fix upstream introduced a regression that was later
    amended in 2.4.6 version
    + Added expat-CVE-2022-25313-fix-regression.patch
  * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
  - Added expat-CVE-2022-25314.patch
  * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
  - Added expat-CVE-2022-25315.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- Security fixes:
  * (CVE-2022-25236, bsc#1196784) [&gt;=2.4.5] Fix to CVE-2022-25236
    breaks biboumi, ClairMeta, jxmlease, libwbxml,
    openleadr-python, rnv, xmltodict
  - Added expat-CVE-2022-25236-relax-fix.patch</changelog>
  <changelog author="david.anes@suse.com" date="1664193600">- Security fix:
  * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent
    function in xmlparse.c
  - Added patch expat-CVE-2022-40674.patch</changelog>
</package>
<package pkgid="481ea8368fd2df0cd726b95a2b754ec8d3c76f65bfe56cd414a1f0fafa1c41bf" name="libexpat1" arch="aarch64">
  <version epoch="0" ver="2.2.5" rel="150000.3.25.1"/>
  <changelog author="idonmez@suse.com" date="1458734400">- Update to version 2.1.1
  * Fixes CVE-2015-1283 ? Multiple integer overflows in the
    XML_GetBuffer function
  * Fix potential null pointer dereference
  * Symbol XML_SetHashSalt was not exported
  * Output of xmlwf -h was incomplete
  * Document behavior of calling XML_SetHashSalt with salt 0
  * Minor improvements to man page xmlwf(1)
- Simplify expat-visibility.patch, refresh expat-alloc-size.patch
- Drop config-guess-sub-update.patch, fixed upstream.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1459512000">- After simplification of expat-visibility.patch, it became
  uneffective as no symbols are getting hidden. add
  - fvisibility=hidden to CFLAGS again.
- expat-alloc-size.patch: fix braino, realloc()-like functions
  should not take __attribute__(malloc)</changelog>
  <changelog author="kstreitova@suse.com" date="1463572800">- add expat-2.1.1-avoid_relying_on_undef_behaviour.patch to avoid
  relying on undefined behavior in the original CVE-2015-1283 fix
  [bnc#980391], [bnc#983985], [CVE-2016-4472]
- add expat-2.1.1-parser_crashes_on_malformed_input.patch to fix
  Expat XML parser that mishandles certain kinds of malformed input
  documents [bnc#979441], [CVE-2016-0718]
- use spec-cleaner to clean specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1468497600">- Version update to 2.2.0:
  * Fixes bnc#983215 CVE-2012-6702
  * Fixes bnc#983216 CVE-2016-5300
  * Various cmake and autotools script updates
  * Fix detection of utf8 character boundaries
- Remove all patches merged upstream:
  * expat-2.1.1-avoid_relying_on_undef_behaviour.patch
  * expat-2.1.1-parser_crashes_on_malformed_input.patch
  * expat-alloc-size.patch
  * expat-visibility.patch</changelog>
  <changelog author="jengelh@inai.de" date="1468843200">- Remove pointless --with-pic (for static only)</changelog>
  <changelog author="meissner@suse.com" date="1499169600">- Version update to 2.2.1 Sat June 17 2017
  - Security fixes:
    CVE-2017-9233 / bsc#1047236 -- External entity infinite loop DoS
    Details: https://libexpat.github.io/doc/cve-2017-9233/
    Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
  - [MOX-002]      CVE-2016-9063 / bsc#1047240 -- Detect integer overflow;
    (Fixed version of existing downstream patches!)
  - (SF.net) #539  Fix regression from fix to CVE-2016-0718 cutting off
    longer tag names;
    [#25]  More integer overflow detection (function poolGrow);
  - [MOX-002]      Detect overflow from len=INT_MAX call to XML_Parse;
  - [MOX-005] #30  Use high quality entropy for hash initialization:
  * arc4random_buf on BSD, systems with libbsd
    (when configured with --with-libbsd), CloudABI
  * RtlGenRandom on Windows XP / Server 2003 and later
  * getrandom on Linux 3.17+
    In a way, that's still part of CVE-2016-5300.
    https://github.com/libexpat/libexpat/pull/30/commits
  - [MOX-005] For the low quality entropy extraction fallback code,
    the parser instance address can no longer leak,
  - [MOX-003] Prevent use of uninitialised variable; commit
  - [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
    Add missing parameter validation to public API functions
    and dedicated error code XML_ERROR_INVALID_ARGUMENT:
  - [MOX-006] * NULL checks; commits
  * Negative length (XML_Parse); commit
  - [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
  - [MOX-001] #35  Change hash algorithm to William Ahern's version of SipHash
    to go further with fixing CVE-2012-0876.
    https://github.com/libexpat/libexpat/pull/39/commits
  - Bug fixes:
    [#32] Fix sharing of hash salt across parsers;
    relevant where XML_ExternalEntityParserCreate is called
    prior to XML_Parse, in particular (e.g. FBReader)
    [#28] xmlwf: Auto-disable use of memory-mapping (and parsing
    as a single chunk) for files larger than ~1 GB (2^30 bytes)
    rather than failing with error "out of memory"
    [#3]  Fix double free after malloc failure in DTD code; commit
    7ae9c3d3af433cd4defe95234eae7dc8ed15637f
    [#17] Fix memory leak on parser error for unbound XML attribute
    prefix with new namespaces defined in the same tag;
    found by Google's OSS-Fuzz; commits
    xmlwf on Windows: Add missing calls to CloseHandle
  - New features:
    [#30] Introduced environment switch EXPAT_ENTROPY_DEBUG=1
    for runtime debugging of entropy extraction
    Bump version info from 7:2:6 to 7:3:6</changelog>
  <changelog author="mpluskal@suse.com" date="1499774400">- Build with profiling when possible</changelog>
  <changelog author="jayvdb@gmail.com" date="1507377600">- Allow building when do_profiling is undefined</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1509019200">- Version update to 2.2.4 Sat August 19 2017
  * Bug fixes:
    [#115]  Fix copying of partial characters for UTF-8 input
  * Other changes:
    [#109]  Fix "make check" for non-x86 architectures that default
    to unsigned type char (-128..127 rather than 0..255)
    [#109]  coverage.sh: Cover -funsigned-char
    Autotools: Introduce --without-xmlwf argument
    [#65]  Autotools: Replace handwritten Makefile with GNU Automake
    [#43]  CMake: Auto-detect high quality entropy extractors, add new
    option USE_libbsd=ON to use arc4random_buf of libbsd
    [#74]  CMake: Add -fno-strict-aliasing only where supported
    [#114]  CMake: Always honor manually set BUILD_* options
    [#114]  CMake: Compile man page if docbook2x-man is available, only
    [#117]  Include file tests/xmltest.log.expected in source tarball
    (required for "make run-xmltest")
    [#111]  Fix some typos in documentation
    Version info bumped from 7:5:6 to 7:6:6
- Release 2.2.3 Wed August 2 2017
  * Bug fixes:
    [#85]  Fix a dangling pointer issue related to realloc
  * Other changes:
    [#91]  Linux: Allow getrandom to fail if nonblocking pool has not
    yet been initialized and read /dev/urandom then, instead.
    This is in line with what recent Python does.
    [#86]  Check that a UTF-16 encoding in an XML declaration has the
    right endianness
  [#4] #5 #7  Recover correctly when some reallocations fail
    Repair "./configure &amp;&amp; make" for systems without any
    provider of high quality entropy
    and try reading /dev/urandom on those
    Ensure that user-defined character encodings have converter
    functions when they are needed
    Fix mis-leading description of argument -c in xmlwf.1
    Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__)
    for CloudABI
    [#100]  Fix use of SIPHASH_MAIN in siphash.h
    [#23]  Test suite: Fix memory leaks
    Version info bumped from 7:4:6 to 7:5:6
- Release 2.2.2 Wed July 12 2017
  * Security fixes:
    [#43]  Protect against compilation without any source of high
    quality entropy enabled, e.g. with CMake build system;
  * [MOX-006] Fix non-NULL parser parameter validation in XML_Parse;
    resulted in NULL dereference, previously;
  * Bug fixes:
    [#69]  Fix improper use of unsigned long long integer literals
  * Other changes:
    [#73]  Start requiring a C99 compiler
    [#49]  Fix "==" Bashism in configure script
    [#58]  Address compile warnings
    [#68]  Fix "./buildconf.sh &amp;&amp; ./configure" for some versions
    of Dash for /bin/sh
    [#72]  CMake: Ease use of Expat in context of a parent project
    with multiple CMakeLists.txt files
    [#72]  CMake: Resolve mistaken executable permissions
    [#76]  Address compile warning with -DNDEBUG (not recommended!)
    [#77]  Address compile warning about macro redefinition
  * Added patch expat-docbook.patch to compile the man pages with
  docbook-to-man
  * Cleaned spec file with spec-cleaner</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- Version update to 2.2.5 Tue October 31 2017
  * Bug fixes:
  - If the parser runs out of memory, make sure its internal
    state reflects the memory it actually has, not the memory
    it wanted to have.
  - The default handler wasn't being called when it should for
    a SYSTEM or PUBLIC doctype if an entity declaration handler
    was registered.
  - Fix a case of mistakenly reported parsing success where
    XML_StopParser was called from an element handler
  - Function XML_ErrorString was returning NULL rather than
    a message for code XML_ERROR_INVALID_ARGUMENT
    introduced with release 2.2.1
  * Other changes:
  - Add argument -N adding notation declarations
  - various compiler-specific fixes
  - Improve docbook2x-man detection
- drop expat-docbook.patch
  * fixed in 0f5186c7b8e503c669e332d944712de010b265f3
- switch to github for release tarballs and website</changelog>
  <changelog author="mpluskal@suse.com" date="1510833600">- Do not generate manpages from docbook
- Temporarily disable profiling due to bug in build system</changelog>
  <changelog author="jengelh@inai.de" date="1510833601">- Expand description of expat-devel.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix (CVE-2018-20843, bsc#1139937)
  * Large number of colons in input makes parser consume high
    amount of resources
  * Added expat-CVE-2018-20843.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567598400">- Security fix (CVE-2019-15903, bsc#1149429)
  * Crafted XML input results in heap-based buffer over-read by fooling
    the parser into changing from DTD parsing to document parsing
  * Added patches:
  - expat-CVE-2019-15903.patch
  - expat-CVE-2019-15903-tests.patch</changelog>
  <changelog author="david.anes@suse.com" date="1642420800">- Security fix (CVE-2021-45960, bsc#1194251)
  * A left shift by 29 (or more) places in the storeAtts function
    in xmlparse.c can lead to realloc misbehavior.
  * Added expat-CVE-2021-45960.patch
- Security fix (CVE-2021-46143, bsc#1194362)
  * Integer overflow exists for m_groupSize in doProlog
  * Added expat-CVE-2021-46143.patch
- Security fix (CVE-2022-22822, bsc#1194474)
  * Integer overflow in addBinding in xmlparse.c
  * Added expat-CVE-2022-22822.patch
- Security fix (CVE-2022-22823, bsc#1194476)
  * Integer overflow in build_model in xmlparse.c
  * Added expat-CVE-2022-22823.patch
- Security fix (CVE-2022-22824, bsc#1194477)
  * Integer overflow in defineAttribute in xmlparse.c
  * Added expat-CVE-2022-22824.patch
- Security fix (CVE-2022-22825, bsc#1194478)
  * Integer overflow in lookup in xmlparse.c
  * Added expat-CVE-2022-22825.patch
- Security fix (CVE-2022-22826, bsc#1194479)
  * Integer overflow in nextScaffoldPart in xmlparse.c
  * Added expat-CVE-2022-22826.patch
- Security fix (CVE-2022-22827, bsc#1194480)
  * Integer overflow in storeAtts in xmlparse.c
  * Added expat-CVE-2022-22827.patch
- Refresh expat-CVE-2018-20843.patch as a p1 patch.
- Use %autosetup macro</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- Security fix (CVE-2022-23852, bsc#1195054)
  * Expat (aka libexpat) before 2.4.4 has a signed integer overflow
    in XML_GetBuffer, for configurations with a nonzero
    XML_CONTEXT_BYTES
  * Add tests for CVE-2022-23852.
  * Added expat-CVE-2022-23852.patch
- Security fix (CVE-2022-23990, bsc#1195217)
  * Fix unsigned integer overflow in function doProlog triggered
    by large content in element type declarations when there is
    an element declaration handler present (from a prior call to
    XML_SetElementDeclHandler).
  * Add expat-CVE-2022-23990.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645444800">- Security fixes:
  * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
    attackers to insert namespace-separator characters into
    namespace URIs
  - Added expat-CVE-2022-25236.patch
  * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
    2.4.5 does not check whether a UTF-8 character is valid in a
    certain context.
  - Added expat-CVE-2022-25235.patch
  * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
    build_model() via uncontrolled recursion
  - Added expat-CVE-2022-25313.patch
  - The fix upstream introduced a regression that was later
    amended in 2.4.6 version
    + Added expat-CVE-2022-25313-fix-regression.patch
  * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
  - Added expat-CVE-2022-25314.patch
  * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
  - Added expat-CVE-2022-25315.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- Security fixes:
  * (CVE-2022-25236, bsc#1196784) [&gt;=2.4.5] Fix to CVE-2022-25236
    breaks biboumi, ClairMeta, jxmlease, libwbxml,
    openleadr-python, rnv, xmltodict
  - Added expat-CVE-2022-25236-relax-fix.patch</changelog>
  <changelog author="david.anes@suse.com" date="1664193600">- Security fix:
  * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent
    function in xmlparse.c
  - Added patch expat-CVE-2022-40674.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Security fix:
  * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager
    destruction of a shared DTD in XML_ExternalEntityParserCreate in
    out-of-memory situations
  - Added patch expat-CVE-2022-43680.patch</changelog>
</package>
<package pkgid="a9622b173d45def517374a488a37d66213ea6cad3f763ee263a7ce2dcdb97354" name="libexpat1" arch="x86_64">
  <version epoch="0" ver="2.2.5" rel="150000.3.25.1"/>
  <changelog author="idonmez@suse.com" date="1458734400">- Update to version 2.1.1
  * Fixes CVE-2015-1283 ? Multiple integer overflows in the
    XML_GetBuffer function
  * Fix potential null pointer dereference
  * Symbol XML_SetHashSalt was not exported
  * Output of xmlwf -h was incomplete
  * Document behavior of calling XML_SetHashSalt with salt 0
  * Minor improvements to man page xmlwf(1)
- Simplify expat-visibility.patch, refresh expat-alloc-size.patch
- Drop config-guess-sub-update.patch, fixed upstream.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1459512000">- After simplification of expat-visibility.patch, it became
  uneffective as no symbols are getting hidden. add
  - fvisibility=hidden to CFLAGS again.
- expat-alloc-size.patch: fix braino, realloc()-like functions
  should not take __attribute__(malloc)</changelog>
  <changelog author="kstreitova@suse.com" date="1463572800">- add expat-2.1.1-avoid_relying_on_undef_behaviour.patch to avoid
  relying on undefined behavior in the original CVE-2015-1283 fix
  [bnc#980391], [bnc#983985], [CVE-2016-4472]
- add expat-2.1.1-parser_crashes_on_malformed_input.patch to fix
  Expat XML parser that mishandles certain kinds of malformed input
  documents [bnc#979441], [CVE-2016-0718]
- use spec-cleaner to clean specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1468497600">- Version update to 2.2.0:
  * Fixes bnc#983215 CVE-2012-6702
  * Fixes bnc#983216 CVE-2016-5300
  * Various cmake and autotools script updates
  * Fix detection of utf8 character boundaries
- Remove all patches merged upstream:
  * expat-2.1.1-avoid_relying_on_undef_behaviour.patch
  * expat-2.1.1-parser_crashes_on_malformed_input.patch
  * expat-alloc-size.patch
  * expat-visibility.patch</changelog>
  <changelog author="jengelh@inai.de" date="1468843200">- Remove pointless --with-pic (for static only)</changelog>
  <changelog author="meissner@suse.com" date="1499169600">- Version update to 2.2.1 Sat June 17 2017
  - Security fixes:
    CVE-2017-9233 / bsc#1047236 -- External entity infinite loop DoS
    Details: https://libexpat.github.io/doc/cve-2017-9233/
    Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
  - [MOX-002]      CVE-2016-9063 / bsc#1047240 -- Detect integer overflow;
    (Fixed version of existing downstream patches!)
  - (SF.net) #539  Fix regression from fix to CVE-2016-0718 cutting off
    longer tag names;
    [#25]  More integer overflow detection (function poolGrow);
  - [MOX-002]      Detect overflow from len=INT_MAX call to XML_Parse;
  - [MOX-005] #30  Use high quality entropy for hash initialization:
  * arc4random_buf on BSD, systems with libbsd
    (when configured with --with-libbsd), CloudABI
  * RtlGenRandom on Windows XP / Server 2003 and later
  * getrandom on Linux 3.17+
    In a way, that's still part of CVE-2016-5300.
    https://github.com/libexpat/libexpat/pull/30/commits
  - [MOX-005] For the low quality entropy extraction fallback code,
    the parser instance address can no longer leak,
  - [MOX-003] Prevent use of uninitialised variable; commit
  - [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
    Add missing parameter validation to public API functions
    and dedicated error code XML_ERROR_INVALID_ARGUMENT:
  - [MOX-006] * NULL checks; commits
  * Negative length (XML_Parse); commit
  - [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
  - [MOX-001] #35  Change hash algorithm to William Ahern's version of SipHash
    to go further with fixing CVE-2012-0876.
    https://github.com/libexpat/libexpat/pull/39/commits
  - Bug fixes:
    [#32] Fix sharing of hash salt across parsers;
    relevant where XML_ExternalEntityParserCreate is called
    prior to XML_Parse, in particular (e.g. FBReader)
    [#28] xmlwf: Auto-disable use of memory-mapping (and parsing
    as a single chunk) for files larger than ~1 GB (2^30 bytes)
    rather than failing with error "out of memory"
    [#3]  Fix double free after malloc failure in DTD code; commit
    7ae9c3d3af433cd4defe95234eae7dc8ed15637f
    [#17] Fix memory leak on parser error for unbound XML attribute
    prefix with new namespaces defined in the same tag;
    found by Google's OSS-Fuzz; commits
    xmlwf on Windows: Add missing calls to CloseHandle
  - New features:
    [#30] Introduced environment switch EXPAT_ENTROPY_DEBUG=1
    for runtime debugging of entropy extraction
    Bump version info from 7:2:6 to 7:3:6</changelog>
  <changelog author="mpluskal@suse.com" date="1499774400">- Build with profiling when possible</changelog>
  <changelog author="jayvdb@gmail.com" date="1507377600">- Allow building when do_profiling is undefined</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1509019200">- Version update to 2.2.4 Sat August 19 2017
  * Bug fixes:
    [#115]  Fix copying of partial characters for UTF-8 input
  * Other changes:
    [#109]  Fix "make check" for non-x86 architectures that default
    to unsigned type char (-128..127 rather than 0..255)
    [#109]  coverage.sh: Cover -funsigned-char
    Autotools: Introduce --without-xmlwf argument
    [#65]  Autotools: Replace handwritten Makefile with GNU Automake
    [#43]  CMake: Auto-detect high quality entropy extractors, add new
    option USE_libbsd=ON to use arc4random_buf of libbsd
    [#74]  CMake: Add -fno-strict-aliasing only where supported
    [#114]  CMake: Always honor manually set BUILD_* options
    [#114]  CMake: Compile man page if docbook2x-man is available, only
    [#117]  Include file tests/xmltest.log.expected in source tarball
    (required for "make run-xmltest")
    [#111]  Fix some typos in documentation
    Version info bumped from 7:5:6 to 7:6:6
- Release 2.2.3 Wed August 2 2017
  * Bug fixes:
    [#85]  Fix a dangling pointer issue related to realloc
  * Other changes:
    [#91]  Linux: Allow getrandom to fail if nonblocking pool has not
    yet been initialized and read /dev/urandom then, instead.
    This is in line with what recent Python does.
    [#86]  Check that a UTF-16 encoding in an XML declaration has the
    right endianness
  [#4] #5 #7  Recover correctly when some reallocations fail
    Repair "./configure &amp;&amp; make" for systems without any
    provider of high quality entropy
    and try reading /dev/urandom on those
    Ensure that user-defined character encodings have converter
    functions when they are needed
    Fix mis-leading description of argument -c in xmlwf.1
    Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__)
    for CloudABI
    [#100]  Fix use of SIPHASH_MAIN in siphash.h
    [#23]  Test suite: Fix memory leaks
    Version info bumped from 7:4:6 to 7:5:6
- Release 2.2.2 Wed July 12 2017
  * Security fixes:
    [#43]  Protect against compilation without any source of high
    quality entropy enabled, e.g. with CMake build system;
  * [MOX-006] Fix non-NULL parser parameter validation in XML_Parse;
    resulted in NULL dereference, previously;
  * Bug fixes:
    [#69]  Fix improper use of unsigned long long integer literals
  * Other changes:
    [#73]  Start requiring a C99 compiler
    [#49]  Fix "==" Bashism in configure script
    [#58]  Address compile warnings
    [#68]  Fix "./buildconf.sh &amp;&amp; ./configure" for some versions
    of Dash for /bin/sh
    [#72]  CMake: Ease use of Expat in context of a parent project
    with multiple CMakeLists.txt files
    [#72]  CMake: Resolve mistaken executable permissions
    [#76]  Address compile warning with -DNDEBUG (not recommended!)
    [#77]  Address compile warning about macro redefinition
  * Added patch expat-docbook.patch to compile the man pages with
  docbook-to-man
  * Cleaned spec file with spec-cleaner</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- Version update to 2.2.5 Tue October 31 2017
  * Bug fixes:
  - If the parser runs out of memory, make sure its internal
    state reflects the memory it actually has, not the memory
    it wanted to have.
  - The default handler wasn't being called when it should for
    a SYSTEM or PUBLIC doctype if an entity declaration handler
    was registered.
  - Fix a case of mistakenly reported parsing success where
    XML_StopParser was called from an element handler
  - Function XML_ErrorString was returning NULL rather than
    a message for code XML_ERROR_INVALID_ARGUMENT
    introduced with release 2.2.1
  * Other changes:
  - Add argument -N adding notation declarations
  - various compiler-specific fixes
  - Improve docbook2x-man detection
- drop expat-docbook.patch
  * fixed in 0f5186c7b8e503c669e332d944712de010b265f3
- switch to github for release tarballs and website</changelog>
  <changelog author="mpluskal@suse.com" date="1510833600">- Do not generate manpages from docbook
- Temporarily disable profiling due to bug in build system</changelog>
  <changelog author="jengelh@inai.de" date="1510833601">- Expand description of expat-devel.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix (CVE-2018-20843, bsc#1139937)
  * Large number of colons in input makes parser consume high
    amount of resources
  * Added expat-CVE-2018-20843.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567598400">- Security fix (CVE-2019-15903, bsc#1149429)
  * Crafted XML input results in heap-based buffer over-read by fooling
    the parser into changing from DTD parsing to document parsing
  * Added patches:
  - expat-CVE-2019-15903.patch
  - expat-CVE-2019-15903-tests.patch</changelog>
  <changelog author="david.anes@suse.com" date="1642420800">- Security fix (CVE-2021-45960, bsc#1194251)
  * A left shift by 29 (or more) places in the storeAtts function
    in xmlparse.c can lead to realloc misbehavior.
  * Added expat-CVE-2021-45960.patch
- Security fix (CVE-2021-46143, bsc#1194362)
  * Integer overflow exists for m_groupSize in doProlog
  * Added expat-CVE-2021-46143.patch
- Security fix (CVE-2022-22822, bsc#1194474)
  * Integer overflow in addBinding in xmlparse.c
  * Added expat-CVE-2022-22822.patch
- Security fix (CVE-2022-22823, bsc#1194476)
  * Integer overflow in build_model in xmlparse.c
  * Added expat-CVE-2022-22823.patch
- Security fix (CVE-2022-22824, bsc#1194477)
  * Integer overflow in defineAttribute in xmlparse.c
  * Added expat-CVE-2022-22824.patch
- Security fix (CVE-2022-22825, bsc#1194478)
  * Integer overflow in lookup in xmlparse.c
  * Added expat-CVE-2022-22825.patch
- Security fix (CVE-2022-22826, bsc#1194479)
  * Integer overflow in nextScaffoldPart in xmlparse.c
  * Added expat-CVE-2022-22826.patch
- Security fix (CVE-2022-22827, bsc#1194480)
  * Integer overflow in storeAtts in xmlparse.c
  * Added expat-CVE-2022-22827.patch
- Refresh expat-CVE-2018-20843.patch as a p1 patch.
- Use %autosetup macro</changelog>
  <changelog author="david.anes@suse.com" date="1643371200">- Security fix (CVE-2022-23852, bsc#1195054)
  * Expat (aka libexpat) before 2.4.4 has a signed integer overflow
    in XML_GetBuffer, for configurations with a nonzero
    XML_CONTEXT_BYTES
  * Add tests for CVE-2022-23852.
  * Added expat-CVE-2022-23852.patch
- Security fix (CVE-2022-23990, bsc#1195217)
  * Fix unsigned integer overflow in function doProlog triggered
    by large content in element type declarations when there is
    an element declaration handler present (from a prior call to
    XML_SetElementDeclHandler).
  * Add expat-CVE-2022-23990.patch</changelog>
  <changelog author="david.anes@suse.com" date="1645444800">- Security fixes:
  * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
    attackers to insert namespace-separator characters into
    namespace URIs
  - Added expat-CVE-2022-25236.patch
  * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
    2.4.5 does not check whether a UTF-8 character is valid in a
    certain context.
  - Added expat-CVE-2022-25235.patch
  * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
    build_model() via uncontrolled recursion
  - Added expat-CVE-2022-25313.patch
  - The fix upstream introduced a regression that was later
    amended in 2.4.6 version
    + Added expat-CVE-2022-25313-fix-regression.patch
  * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
  - Added expat-CVE-2022-25314.patch
  * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
  - Added expat-CVE-2022-25315.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646481600">- Security fixes:
  * (CVE-2022-25236, bsc#1196784) [&gt;=2.4.5] Fix to CVE-2022-25236
    breaks biboumi, ClairMeta, jxmlease, libwbxml,
    openleadr-python, rnv, xmltodict
  - Added expat-CVE-2022-25236-relax-fix.patch</changelog>
  <changelog author="david.anes@suse.com" date="1664193600">- Security fix:
  * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent
    function in xmlparse.c
  - Added patch expat-CVE-2022-40674.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666785600">- Security fix:
  * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager
    destruction of a shared DTD in XML_ExternalEntityParserCreate in
    out-of-memory situations
  - Added patch expat-CVE-2022-43680.patch</changelog>
</package>
<package pkgid="bfdaf023479bf5362f8bed692bd127bb9d5a02fd41e59981cc48bc7f1f0b1e22" name="libfdisk1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="38839b622b56e14e6d0c7dfe58725eac4dfb6da87455d3a252f3cfc129f2f54e" name="libfdisk1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="15d0ba21fb455bdbb50c314587d11db91acaca7631c349ff880da141e29e7fe7" name="libfdisk1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="6812c8b05ba9dd64b1b5cf1203fa00c330fcdb2329b52daba56431138cd7650e" name="libfdisk1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="54a74e9fa9472f5926266ca43ff4c234936ed06ac62f849bd99bf6c0e16698a6" name="libfdisk1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="6583ed2bc82ed44eba8a8a48778c055eb59e424ca99b4ab273944b28229ae2be" name="libfdisk1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="f32e9b1099cd5d362a18bdba09a643ecc3d20de9034c50a7b7fa1651b6586a61" name="libfmt8" arch="aarch64">
  <version epoch="0" ver="8.0.1" rel="150300.7.5.1"/>
  <changelog author="olaf@aepfle.de" date="1553515200">- Install fmt.pc into libdir with
  0001-install-pkg-config-file-into-libdir.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1575028800">- Update to version 6.0.0
  (too many changes to list, see ChangeLog.rst)
- Dropped 0001-install-pkg-config-file-into-libdir.patch (no
  longer necessary)
- Switched to MIT license
- Increased SOVERSION to 6</changelog>
  <changelog author="aloisio@gmx.com" date="1575201600">- Added fmt-bigendian_1.patch, fmt-bigendian_2.patch,
  fmt-bigendian_3.patch and fmt-bigendian_4.patch to fix tests
  on big endian targets</changelog>
  <changelog author="aloisio@gmx.com" date="1575460800">- Update to version 6.1.0
  * {fmt} now formats IEEE 754 ``float`` and ``double`` using
    the shortest decimal representation with correct rounding by
    default:
    .. code:: c++
    [#]include &lt;cmath&gt;
    [#]include &lt;fmt/core.h&gt;
    int main() {
    fmt::print("{}", M_PI);
    }
    prints ``3.141592653589793``.
  * Made the fast binary to decimal floating-point formatter the
    default, simplified it and improved performance. {fmt} is now
    15 times faster than libc++'s ``std::ostringstream``, 11
    times faster than ``printf`` and 10% faster than
    double-conversion on `dtoa-benchmark
    (https://github.com/fmtlib/dtoa-benchmark)
    ==================  =========  =======
    Function            Time (ns)  Speedup
    ==================  =========  =======
    ostringstream        1,346.30    1.00x
    ostrstream           1,195.74    1.13x
    sprintf                995.08    1.35x
    doubleconv              99.10   13.59x
    fmt                     88.34   15.24x
    ==================  =========  =======
  * {fmt} no longer converts ``float`` arguments to ``double``.
    In particular this improves the default (shortest)
    representation of floats and makes
    ``fmt::format`` consistent with ``std::format`` specs
    (#1336, #1353, #1360, #1361)
    .. code:: c++
    fmt::print("{}", 0.1f);
    prints ``0.1`` instead of ``0.10000000149011612``.
  * Made floating-point formatting output consistent with
    ``printf``/iostreams (#1376, #1417)
  * Added support for 128-bit integers (#1287)
    .. code:: c++
    fmt::print("{}", std::numeric_limits&lt;__int128_t&gt;::max());
    prints ``170141183460469231731687303715884105727``.
  * The overload of ``print`` that takes ``text_style`` is now
    atomic, i.e. the output from different threads doesn't
    interleave (#1351)
  * Made compile time in the header-only mode ~20% faster by
    reducing the number of template instantiations. ``wchar_t``
    overload of ``vprint`` was moved from
    ``fmt/core.h`` to ``fmt/format.h``.
  * Added an overload of ``fmt::join`` that works with tuples
    (#1322, #1330)
    .. code:: c++
    [#]include &lt;tuple&gt;
    [#]include &lt;fmt/ranges.h&gt;
    int main() {
    std::tuple&lt;char, int, float&gt; t{'a', 1, 2.0f};
    fmt::print("{}", t);
    }
    prints ``('a', 1, 2.0)``.
  * Changed formatting of octal zero with prefix from "0o0" to
    "0":
    .. code:: c++
    fmt::print("{:#o}", 0);
    prints ``0``.
  * The locale is now passed to ostream insertion (``&lt;&lt;``)
    operators (#1406)
    .. code:: c++
    [#]include &lt;fmt/locale.h&gt;
    [#]include &lt;fmt/ostream.h&gt;
    struct S {
    double value;
    };
    std::ostream&amp; operator&lt;&lt;(std::ostream&amp; os, S s) {
    return os &lt;&lt; s.value;
    }
    int main() {
    auto s = fmt::format(std::locale("fr_FR.UTF-8"), "{}", S{0.42});
    // s == "0,42"
    }
  * Locale-specific number formatting now uses grouping (#1393,
    [#1394])
  * Fixed handling of types with deleted implicit rvalue
    conversion to ``const char**`` (#1421)
    .. code:: c++
    struct mystring {
    operator const char*() const&amp;;
    operator const char*() &amp;;
    operator const char*() const&amp;&amp; = delete;
    operator const char*() &amp;&amp; = delete;
    };
    mystring str;
    fmt::print("{}", str); // now compiles
  * Enums are now mapped to correct underlying types instead of
    ``int`` (#1286)
  * Enum classes are no longer implicitly converted to ``int``
    (#1424)
  * Added ``basic_format_parse_context`` for consistency with
    C++20 ``std::format`` and deprecated ``basic_parse_context``.
  * Fixed handling of UTF-8 in precision (#1389, #1390)
  * Added a CUDA test (#1285, #1317)
  * Improved documentation (#1276, #1291, #1296, #1315, #1332,
    [#1337], #1395, #1418)
  * Various code improvements (#1358, #1407)
  * Fixed compile-time format string checks for user-defined
    types (#1292)
  * Worked around a false positive in
    ``unsigned-integer-overflow`` sanitizer (#1377)
  * Fixed various warnings and compilation issues (#1273, #1278,
    [#1280], #1281, #1288, #1290, #1301, #1305, #1306, #1309,
    [#1312], #1313, #1316, #1319, #1320, #1326, #1328, #1344,
    [#1345], #1347, #1349, #1354, #1362, #1366, #1364, #1370,
    [#1371], #1385, #1388, #1397, #1414, #1416, #1422, #1427,
    [#1431], #1433)
- Dropped fmt-bigendian_1.patch, fmt-bigendian_2.patch,
  fmt-bigendian_3.patch and fmt-bigendian_4.patch (merged
  upstream)</changelog>
  <changelog author="aloisio@gmx.com" date="1575547200">- Update to version 6.1.1
  * Added a missing decimal point in exponent notation with
    trailing zeros.
  * Removed deprecated format_arg_store::TYPES.</changelog>
  <changelog author="aloisio@gmx.com" date="1576065600">- Update to version 6.1.2
  * Fixed ABI compatibility with libfmt.so.6.0.0 (#1471).
  * Fixed handling types convertible to std::string_view (#1451).
    Thanks @denizevrenci (Deniz Evrenci).
  * Made CUDA test an opt-in enabled via the FMT_CUDA_TEST CMake
    option.
  * Fixed sign conversion warnings (#1440). Thanks @0x8000-0000
    (Florin Iucha).</changelog>
  <changelog author="aloisio@gmx.com" date="1586174400">- Update to version 6.2.0
  * Improved error reporting when trying to format an object of
    a non-formattable type:
  * Reduced library size by ~10%.
  * Always print decimal point if # is specified (#1476, #1498):
  * Implemented the 'L' specifier for locale-specific numeric
    formatting to improve compatibility with std::format. The 'n'
    specifier is now deprecated and will be removed in the next
    major release.
  * Moved OS-specific APIs such as windows_error from
    fmt/format.h to fmt/os.h. You can define
    FMT_DEPRECATED_INCLUDE_OS to automatically include fmt/os.h from
    fmt/format.h for compatibility but this will be disabled in the
    next major release.
  * Added precision overflow detection in floating-point
    formatting.
  * Implemented detection of invalid use of fmt::arg.
  * Used type_identity to block unnecessary template argument
    deduction.
  * Improved UTF-8 handling (#1109):
  * Added experimental dynamic argument storage (#1170, #1584):
  * Made fmt::join accept initializer_list (#1591).
  * Fixed handling of empty tuples (#1588).
  * Fixed handling of output iterators in format_to_n (#1506).
  * Fixed formatting of std::chrono::duration types to wide
    output (#1533).
  * Added const begin and end overload to buffers (#1553).
  * Added the ability to disable floating-point formatting via
    FMT_USE_FLOAT, FMT_USE_DOUBLE and FMT_USE_LONG_DOUBLE macros for
    extremely memory-constrained embedded system (#1590).
  * Made FMT_STRING work with constexpr string_view (#1589).
  * Implemented a minor optimization in the format string parser
    (#1560).
  * Improved attribute detection (#1469, #1475, #1576).
  * Improved documentation (#1481, #1523).
  * Fixed symbol visibility on Linux when compiling with
  - fvisibility=hidden (#1535).
  * Implemented various build configuration fixes and
    improvements (#1264, #1460, #1534, #1536, #1545, #1546, #1566,
    [#1582], #1597, #1598).
  * Fixed various warnings and compilation issues
- Dropped Group tag</changelog>
  <changelog author="hpj@urpla.net" date="1586865600">- Apply 7d01859ef16e6b65bc023ad8bebfedecb088bf81.patch
  to fix kodi compilation and probably others:
  https://github.com/fmtlib/fmt/issues/1620</changelog>
  <changelog author="aloisio@gmx.com" date="1589025600">- Update to version 6.2.1
  * Fixed ostream support in ``sprintf``
    (`#1631 &lt;https://github.com/fmtlib/fmt/issues/1631&gt;`_).
  * Fixed type detection when using implicit conversion to
    ``string_view`` and ostream ``operator&lt;&lt;`` inconsistently
    (`#1662 &lt;https://github.com/fmtlib/fmt/issues/1662&gt;`_).
- Drop 7d01859ef16e6b65bc023ad8bebfedecb088bf81.patch (no longer
  necessary)
- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1592913600">- Add fmt-6.2.1-fix_pkgconfig_paths.patch (fix for boo#1173270)</changelog>
  <changelog author="aloisio@gmx.com" date="1594036800">- Update to version 7.0.0
  * Reduced the library size.
  * Added a simpler and more efficient format string compilation
    API. The old fmt::compile API is now deprecated.
  * Optimized integer formatting: format_to with format string
    compilation and a stack-allocated buffer is now faster than
    to_chars on both libc++ and libstdc++.
  * Optimized handling of small format strings.
  * Applied extern templates to improve compile times when using
    the core API and fmt/format.h. It is still recommended to use
    fmt/core.h instead of fmt/format.h but the compile time
    difference is now smaller.
  * Named arguments are now stored on stack (no dynamic memory
    allocations) and the compiled code is more compact and
    efficient.
  * Implemented compile-time checks for dynamic width and
    precision.
  * Added sentinel support to fmt::join.
  * Added support for named args, clear and reserve to
    dynamic_format_arg_store.
  * Added support for the 'c' format specifier to integral types
    for compatibility with std::format.
  * Replaced the 'n' format specifier with 'L' for compatibility
    with std::format. The 'n' specifier can be enabled via the
    FMT_DEPRECATED_N_SPECIFIER macro.
  * The '=' format specifier is now disabled by default for
    compatibility with std::format. It can be enabled via the
    FMT_DEPRECATED_NUMERIC_ALIGN macro.
  * Removed the following deprecated APIs:
    + FMT_STRING_ALIAS and fmt macros - replaced by
    FMT_STRING
    + fmt::basic_string_view::char_type - replaced by
    fmt::basic_string_view::value_type
    + convert_to_int
    + format_arg_store::types
    + *parse_context - replaced by *format_parse_context
    + FMT_DEPRECATED_INCLUDE_OS
    + FMT_DEPRECATED_PERCENT - incompatible with
    std::format
    + *writer - replaced by compiled format API
  * Renamed the internal namespace to detail. The former is
    still provided as an alias if the FMT_USE_INTERNAL macro is
    defined.
  * Improved compatibility between fmt::printf with the standard
    specs.
  * Fixed handling of operator&lt;&lt; overloads that use copyfmt.
  * Added the FMT_OS CMake option to control inclusion of
    OS-specific APIs in the fmt target. This can be useful for
    embedded platforms.
  * Replaced FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION with the
    FMT_FUZZ macro to prevent interferring with fuzzing of
    projects using {fmt}.
  * Fixed compatibility with emscripten.
  * Improved documentation.
  * Implemented various build configuration fixes and
    improvements.
  * Fixed various warnings and compilation issues.
- Drop fmt-6.2.1-fix_pkgconfig_paths.patch
- Bump sover to 7</changelog>
  <changelog author="aloisio@gmx.com" date="1594123200">- Update to version 7.0.1
  * Updated the inline version namespace name.
  * Worked around a gcc bug in mangling of alias templates
  * Fixed minor issues with the documentation.</changelog>
  <changelog author="aloisio@gmx.com" date="1596024000">- Update to version 7.0.2
  * Worked around broken ``numeric_limits`` for 128-bit integers
  * Fixed compatibility with CMake 3.4
  * Fixed handling of digit separators in locale-specific
    formatting</changelog>
  <changelog author="aloisio@gmx.com" date="1596801600">- Update to version 7.0.3
  * Worked around broken ``numeric_limits`` for 128-bit integers
  * Added error reporting on missing named arguments
  * Stopped using 128-bit integers with clang-cl
  * Fixed issues in locale-specific integer formatting</changelog>
  <changelog author="aloisio@gmx.com" date="1603713600">- Update to version 7.1.0
  * Switched from Grisu3 to Dragonbox for the default
    floating-point formatting which gives the shortest decimal
    representation with round-trip guarantee and correct rounding.
    This makes {fmt} up to 20-30x faster than common
    implementations of std::ostringstream and sprintf on
    dtoa-benchmark and faster than double-conversion and Ry?. It
    is possible to get even better performance at the cost of
    larger binary size by compiling with the
    FMT_USE_FULL_CACHE_DRAGONBOX macro set to 1.
  * Added an experimental unsynchronized file output API which,
    together with format string compilation can give 5-9 times
    speed up compared to fprintf on common platforms.
  * Added a formatter for std::chrono::time_point&lt;system_clock&gt;
  * Added support for ranges with non-const begin/end to fmt::join
  * Added a memory_buffer::append overload that takes a range.
  * Improved handling of single code units in FMT_COMPILE.
  * Added dynamic width support to format string compilation.
  * Improved error reporting for unformattable types: now you'll
    get the type name directly in the error message instead of
    the note.
  * Added the make_args_checked function template that allows
    you to write formatting functions with compile-time format
    string checks and avoid binary code bloat.
  * Replaced snprintf fallback with a faster internal IEEE 754
    float and double formatter for arbitrary precision.
  * Made format_to_n and formatted_size part of the core API.
  * Added fmt::format_to_n overload with format string
    compilation.
  * Added fmt::format_to overload that take text_style.
  * Made the # specifier emit trailing zeros in addition to the
    decimal point.
  * Changed the default floating point format to not include .0
    for consistency with std::format and std::to_chars. It is
    possible to get the decimal point and trailing zero with the
    [#] specifier.
  * Fixed an issue with floating-point formatting that could
    result in addition of a non-significant trailing zero in
    rare cases e.g. 1.00e-34 instead of 1.0e-34.
  * Made fmt::to_string fallback on ostream insertion operator
    if the formatter specialization is not provided.
  * Added support for the append mode to the experimental file
    API and improved fcntl.h detection.
  * Fixed handling of types that have both an implicit
    conversion operator and an overloaded ostream insertion
    operator.
  * Fixed a slicing issue in an internal iterator type.
  * Fixed an issue in locale-specific integer formatting.
  * Fixed handling of exotic code unit types.
  * Improved FMT_ALWAYS_INLINE.
  * Improved documentation.
  * Added the FMT_REDUCE_INT_INSTANTIATIONS CMake option that
    reduces the binary code size at the cost of some integer
    formatting performance. This can be useful for extremely
    memory-constrained embedded systems.
  * Added the FMT_USE_INLINE_NAMESPACES macro to control usage
    of inline namespaces.
  * Improved build configuration.
  * Fixed various warnings and compilation issues.
- Add fmt-7.1.0-LTO.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1604318400">- Update to version 7.1.1
  * Fixed ABI compatibility with 7.0.x
  * Added the FMT_ARM_ABI_COMPATIBILITY macro to work around
    ABI incompatibility between GCC and Clang on ARM
  * Worked around a SFINAE bug in GCC 8
  * Fixed linkage errors when building with GCC's LTO
  * Fixed a compilation error when building without
    __builtin_clz or equivalent
  * Fixed a sign conversion warning
- Dropped fmt-7.1.0-LTO.patch (merged upstream)</changelog>
  <changelog author="aloisio@gmx.com" date="1604491200">- Update to version 7.1.2
  * Fixed floating point formatting with large precision</changelog>
  <changelog author="aloisio@gmx.com" date="1606305600">- Update to version 7.1.3
  * Fixed handling of buffer boundaries in format_to_n
  * Fixed linkage errors when linking with a shared library
  * Reintroduced ostream support to range formatters
  * Worked around an issue with mixing std versions in gcc</changelog>
  <changelog author="aloisio@gmx.com" date="1624276800">- Update to version 8.0.0
  * Enabled compile-time format string check by default.
  * Added compile-time formatting.
  * Optimized handling of format specifiers during format string
    compilation.
  * Added the ``_cf`` user-defined literal to represent a
    compiled format string. It can be used instead of the
    ``FMT_COMPILE`` macro.
  * Format string compilation now requires ``format`` functions
    of ``formatter`` specializations for user-defined types to
    be ``const``.
  * Added UDL-based named argument support to format string
    compilation.
  * Added format string compilation support to ``fmt::print``.
  * Added initial support for compiling {fmt} as a C++20 module.
  * Made symbols private by default reducing shared library size
  * Optimized includes making the result of preprocessing
    ``fmt/format.h``.
  * Added support of ranges with non-const ``begin`` / ``end``
  * Added support of ``std::byte`` and other formattable types
    to ``fmt::join``.
  * Implemented the default format for
    ``std::chrono::system_clock``.
  * Made more chrono specifiers locale independent by default.
    Use the ``'L'`` specifier to get localized formatting.
  * Improved locale handling in chrono formatting.
  * Deprecated ``fmt/locale.h`` moving the formatting functions
    that take a locale to ``fmt/format.h`` (``char``) and
    ``fmt/xchar`` (other overloads). This doesn't introduce a
    dependency on ``&lt;locale&gt;`` so there is virtually no compile
    time effect.
  * Made parameter order in ``vformat_to`` consistent with
    ``format_to``.
  * Added support for time points with arbitrary durations.
  * Formatting floating-point numbers no longer produces
    trailing zeros by default.
    for consistency with ``std::format``.
  * Dropped a limit on the number of elements in a range and
    replaced ``{}`` with ``[]`` as range delimiters for
    consistency with Python's ``str.format``.
  * The ``'L'`` specifier for locale-specific numeric formatting
    can now be combined with presentation specifiers as in
    ``std::format``.
  * Made the ``0`` specifier ignored for infinity and NaN.
  * Made the hexfloat formatting use the right alignment by
    default.
  * Removed the deprecated numeric alignment (``'='``). Use the
    ``'0'`` specifier instead.
  * Removed the deprecated ``fmt/posix.h`` header that has been
    replaced with ``fmt/os.h``.
  * Removed the deprecated ``format_to_n_context``,
    ``format_to_n_args`` and ``make_format_to_n_args``. They
    have been replaced with ``format_context``, ``format_args`
    and ``make_format_args`` respectively.
  * Moved ``wchar_t``-specific functions and types to
    ``fmt/wchar.h``. You can define
    ``FMT_DEPRECATED_INCLUDE_WCHAR`` to automatically include
    ``fmt/wchar.h`` from ``fmt/format.h`` but this will be
    disabled in the next major release.
  * Fixed handling of the ``'+'`` specifier in localized
    formatting.
  * Added support for the ``'s'`` format specifier that gives
    textual representation of ``bool``.
  * Made ``fmt::ptr`` work with function pointers.
  * Fixed ``fmt::formatted_size`` with format string compilation
  * Fixed handling of empty format strings during format string
    compilation.
  * Fixed handling of enums in ``fmt::to_string``.
  * Improved width computation.
  * The experimental fast output stream (``fmt::ostream``) is
    now truncated by default for consistency with ``fopen``.
  * Fixed moving of ``fmt::ostream`` that holds buffered data
  * Replaced the ``fmt::system_error`` exception with a function
    of the same name that constructs ``std::system_error``.
  * Replaced the ``fmt::windows_error`` exception with a
    function of the same name that constructs
    ``std::system_error`` with the category returned by
    ``fmt::system_category()``.
  * Replaced ``fmt::error_code`` with ``std::error_code`` and
    made it formattable.
  * Added speech synthesis support.
  * Made ``format_to`` work with a memory buffer that has a
    custom allocator.
  * Added ``Allocator::max_size`` support to
    ``basic_memory_buffer``.
  * Added wide string support to ``fmt::join``
  * Made iterators passed to ``formatter`` specializations via a
    format context satisfy C++20 ``std::output_iterator``
    requirements.
  * Optimized the ``printf`` implementation.
  * Improved detection of ``constexpr`` ``char_traits``.
  * Fixed exception propagation from iterators.
  * Improved ``strftime`` error handling.
  * Stopped using deprecated GCC UDL template extension.
  * Added ``fmt/args.h`` to the install target.
  * Error messages are now passed to assert when exceptions are
    disabled.
  * Added the ``FMT_MASTER_PROJECT`` CMake option to control
    build and install targets when {fmt} is included via
    ``add_subdirectory``.
  * Improved build configuration.
  * Fixed various warnings and compilation issues.
  * Improved documentation.
  * Continuous integration and test improvements.
- Bump soversion to 8</changelog>
  <changelog author="aloisio@gmx.com" date="1625313600">- Update to version 8.0.1
  * Fixed the version number in the inline namespace.
  * Added a missing presentation type check for std::string.
  * Fixed a linkage error when mixing code built with clang and
    gcc.
  * Fixed documentation issues.
  * Removed dead code in FP formatter.
  * Fixed various warnings and compilation issues.</changelog>
</package>
<package pkgid="58723af7b792a4e85404e401359f0588df3679cc103a1b4cbbf7b6baa413a4e3" name="libfmt8" arch="x86_64">
  <version epoch="0" ver="8.0.1" rel="150300.7.5.1"/>
  <changelog author="olaf@aepfle.de" date="1553515200">- Install fmt.pc into libdir with
  0001-install-pkg-config-file-into-libdir.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1575028800">- Update to version 6.0.0
  (too many changes to list, see ChangeLog.rst)
- Dropped 0001-install-pkg-config-file-into-libdir.patch (no
  longer necessary)
- Switched to MIT license
- Increased SOVERSION to 6</changelog>
  <changelog author="aloisio@gmx.com" date="1575201600">- Added fmt-bigendian_1.patch, fmt-bigendian_2.patch,
  fmt-bigendian_3.patch and fmt-bigendian_4.patch to fix tests
  on big endian targets</changelog>
  <changelog author="aloisio@gmx.com" date="1575460800">- Update to version 6.1.0
  * {fmt} now formats IEEE 754 ``float`` and ``double`` using
    the shortest decimal representation with correct rounding by
    default:
    .. code:: c++
    [#]include &lt;cmath&gt;
    [#]include &lt;fmt/core.h&gt;
    int main() {
    fmt::print("{}", M_PI);
    }
    prints ``3.141592653589793``.
  * Made the fast binary to decimal floating-point formatter the
    default, simplified it and improved performance. {fmt} is now
    15 times faster than libc++'s ``std::ostringstream``, 11
    times faster than ``printf`` and 10% faster than
    double-conversion on `dtoa-benchmark
    (https://github.com/fmtlib/dtoa-benchmark)
    ==================  =========  =======
    Function            Time (ns)  Speedup
    ==================  =========  =======
    ostringstream        1,346.30    1.00x
    ostrstream           1,195.74    1.13x
    sprintf                995.08    1.35x
    doubleconv              99.10   13.59x
    fmt                     88.34   15.24x
    ==================  =========  =======
  * {fmt} no longer converts ``float`` arguments to ``double``.
    In particular this improves the default (shortest)
    representation of floats and makes
    ``fmt::format`` consistent with ``std::format`` specs
    (#1336, #1353, #1360, #1361)
    .. code:: c++
    fmt::print("{}", 0.1f);
    prints ``0.1`` instead of ``0.10000000149011612``.
  * Made floating-point formatting output consistent with
    ``printf``/iostreams (#1376, #1417)
  * Added support for 128-bit integers (#1287)
    .. code:: c++
    fmt::print("{}", std::numeric_limits&lt;__int128_t&gt;::max());
    prints ``170141183460469231731687303715884105727``.
  * The overload of ``print`` that takes ``text_style`` is now
    atomic, i.e. the output from different threads doesn't
    interleave (#1351)
  * Made compile time in the header-only mode ~20% faster by
    reducing the number of template instantiations. ``wchar_t``
    overload of ``vprint`` was moved from
    ``fmt/core.h`` to ``fmt/format.h``.
  * Added an overload of ``fmt::join`` that works with tuples
    (#1322, #1330)
    .. code:: c++
    [#]include &lt;tuple&gt;
    [#]include &lt;fmt/ranges.h&gt;
    int main() {
    std::tuple&lt;char, int, float&gt; t{'a', 1, 2.0f};
    fmt::print("{}", t);
    }
    prints ``('a', 1, 2.0)``.
  * Changed formatting of octal zero with prefix from "0o0" to
    "0":
    .. code:: c++
    fmt::print("{:#o}", 0);
    prints ``0``.
  * The locale is now passed to ostream insertion (``&lt;&lt;``)
    operators (#1406)
    .. code:: c++
    [#]include &lt;fmt/locale.h&gt;
    [#]include &lt;fmt/ostream.h&gt;
    struct S {
    double value;
    };
    std::ostream&amp; operator&lt;&lt;(std::ostream&amp; os, S s) {
    return os &lt;&lt; s.value;
    }
    int main() {
    auto s = fmt::format(std::locale("fr_FR.UTF-8"), "{}", S{0.42});
    // s == "0,42"
    }
  * Locale-specific number formatting now uses grouping (#1393,
    [#1394])
  * Fixed handling of types with deleted implicit rvalue
    conversion to ``const char**`` (#1421)
    .. code:: c++
    struct mystring {
    operator const char*() const&amp;;
    operator const char*() &amp;;
    operator const char*() const&amp;&amp; = delete;
    operator const char*() &amp;&amp; = delete;
    };
    mystring str;
    fmt::print("{}", str); // now compiles
  * Enums are now mapped to correct underlying types instead of
    ``int`` (#1286)
  * Enum classes are no longer implicitly converted to ``int``
    (#1424)
  * Added ``basic_format_parse_context`` for consistency with
    C++20 ``std::format`` and deprecated ``basic_parse_context``.
  * Fixed handling of UTF-8 in precision (#1389, #1390)
  * Added a CUDA test (#1285, #1317)
  * Improved documentation (#1276, #1291, #1296, #1315, #1332,
    [#1337], #1395, #1418)
  * Various code improvements (#1358, #1407)
  * Fixed compile-time format string checks for user-defined
    types (#1292)
  * Worked around a false positive in
    ``unsigned-integer-overflow`` sanitizer (#1377)
  * Fixed various warnings and compilation issues (#1273, #1278,
    [#1280], #1281, #1288, #1290, #1301, #1305, #1306, #1309,
    [#1312], #1313, #1316, #1319, #1320, #1326, #1328, #1344,
    [#1345], #1347, #1349, #1354, #1362, #1366, #1364, #1370,
    [#1371], #1385, #1388, #1397, #1414, #1416, #1422, #1427,
    [#1431], #1433)
- Dropped fmt-bigendian_1.patch, fmt-bigendian_2.patch,
  fmt-bigendian_3.patch and fmt-bigendian_4.patch (merged
  upstream)</changelog>
  <changelog author="aloisio@gmx.com" date="1575547200">- Update to version 6.1.1
  * Added a missing decimal point in exponent notation with
    trailing zeros.
  * Removed deprecated format_arg_store::TYPES.</changelog>
  <changelog author="aloisio@gmx.com" date="1576065600">- Update to version 6.1.2
  * Fixed ABI compatibility with libfmt.so.6.0.0 (#1471).
  * Fixed handling types convertible to std::string_view (#1451).
    Thanks @denizevrenci (Deniz Evrenci).
  * Made CUDA test an opt-in enabled via the FMT_CUDA_TEST CMake
    option.
  * Fixed sign conversion warnings (#1440). Thanks @0x8000-0000
    (Florin Iucha).</changelog>
  <changelog author="aloisio@gmx.com" date="1586174400">- Update to version 6.2.0
  * Improved error reporting when trying to format an object of
    a non-formattable type:
  * Reduced library size by ~10%.
  * Always print decimal point if # is specified (#1476, #1498):
  * Implemented the 'L' specifier for locale-specific numeric
    formatting to improve compatibility with std::format. The 'n'
    specifier is now deprecated and will be removed in the next
    major release.
  * Moved OS-specific APIs such as windows_error from
    fmt/format.h to fmt/os.h. You can define
    FMT_DEPRECATED_INCLUDE_OS to automatically include fmt/os.h from
    fmt/format.h for compatibility but this will be disabled in the
    next major release.
  * Added precision overflow detection in floating-point
    formatting.
  * Implemented detection of invalid use of fmt::arg.
  * Used type_identity to block unnecessary template argument
    deduction.
  * Improved UTF-8 handling (#1109):
  * Added experimental dynamic argument storage (#1170, #1584):
  * Made fmt::join accept initializer_list (#1591).
  * Fixed handling of empty tuples (#1588).
  * Fixed handling of output iterators in format_to_n (#1506).
  * Fixed formatting of std::chrono::duration types to wide
    output (#1533).
  * Added const begin and end overload to buffers (#1553).
  * Added the ability to disable floating-point formatting via
    FMT_USE_FLOAT, FMT_USE_DOUBLE and FMT_USE_LONG_DOUBLE macros for
    extremely memory-constrained embedded system (#1590).
  * Made FMT_STRING work with constexpr string_view (#1589).
  * Implemented a minor optimization in the format string parser
    (#1560).
  * Improved attribute detection (#1469, #1475, #1576).
  * Improved documentation (#1481, #1523).
  * Fixed symbol visibility on Linux when compiling with
  - fvisibility=hidden (#1535).
  * Implemented various build configuration fixes and
    improvements (#1264, #1460, #1534, #1536, #1545, #1546, #1566,
    [#1582], #1597, #1598).
  * Fixed various warnings and compilation issues
- Dropped Group tag</changelog>
  <changelog author="hpj@urpla.net" date="1586865600">- Apply 7d01859ef16e6b65bc023ad8bebfedecb088bf81.patch
  to fix kodi compilation and probably others:
  https://github.com/fmtlib/fmt/issues/1620</changelog>
  <changelog author="aloisio@gmx.com" date="1589025600">- Update to version 6.2.1
  * Fixed ostream support in ``sprintf``
    (`#1631 &lt;https://github.com/fmtlib/fmt/issues/1631&gt;`_).
  * Fixed type detection when using implicit conversion to
    ``string_view`` and ostream ``operator&lt;&lt;`` inconsistently
    (`#1662 &lt;https://github.com/fmtlib/fmt/issues/1662&gt;`_).
- Drop 7d01859ef16e6b65bc023ad8bebfedecb088bf81.patch (no longer
  necessary)
- Spec cleanup</changelog>
  <changelog author="aloisio@gmx.com" date="1592913600">- Add fmt-6.2.1-fix_pkgconfig_paths.patch (fix for boo#1173270)</changelog>
  <changelog author="aloisio@gmx.com" date="1594036800">- Update to version 7.0.0
  * Reduced the library size.
  * Added a simpler and more efficient format string compilation
    API. The old fmt::compile API is now deprecated.
  * Optimized integer formatting: format_to with format string
    compilation and a stack-allocated buffer is now faster than
    to_chars on both libc++ and libstdc++.
  * Optimized handling of small format strings.
  * Applied extern templates to improve compile times when using
    the core API and fmt/format.h. It is still recommended to use
    fmt/core.h instead of fmt/format.h but the compile time
    difference is now smaller.
  * Named arguments are now stored on stack (no dynamic memory
    allocations) and the compiled code is more compact and
    efficient.
  * Implemented compile-time checks for dynamic width and
    precision.
  * Added sentinel support to fmt::join.
  * Added support for named args, clear and reserve to
    dynamic_format_arg_store.
  * Added support for the 'c' format specifier to integral types
    for compatibility with std::format.
  * Replaced the 'n' format specifier with 'L' for compatibility
    with std::format. The 'n' specifier can be enabled via the
    FMT_DEPRECATED_N_SPECIFIER macro.
  * The '=' format specifier is now disabled by default for
    compatibility with std::format. It can be enabled via the
    FMT_DEPRECATED_NUMERIC_ALIGN macro.
  * Removed the following deprecated APIs:
    + FMT_STRING_ALIAS and fmt macros - replaced by
    FMT_STRING
    + fmt::basic_string_view::char_type - replaced by
    fmt::basic_string_view::value_type
    + convert_to_int
    + format_arg_store::types
    + *parse_context - replaced by *format_parse_context
    + FMT_DEPRECATED_INCLUDE_OS
    + FMT_DEPRECATED_PERCENT - incompatible with
    std::format
    + *writer - replaced by compiled format API
  * Renamed the internal namespace to detail. The former is
    still provided as an alias if the FMT_USE_INTERNAL macro is
    defined.
  * Improved compatibility between fmt::printf with the standard
    specs.
  * Fixed handling of operator&lt;&lt; overloads that use copyfmt.
  * Added the FMT_OS CMake option to control inclusion of
    OS-specific APIs in the fmt target. This can be useful for
    embedded platforms.
  * Replaced FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION with the
    FMT_FUZZ macro to prevent interferring with fuzzing of
    projects using {fmt}.
  * Fixed compatibility with emscripten.
  * Improved documentation.
  * Implemented various build configuration fixes and
    improvements.
  * Fixed various warnings and compilation issues.
- Drop fmt-6.2.1-fix_pkgconfig_paths.patch
- Bump sover to 7</changelog>
  <changelog author="aloisio@gmx.com" date="1594123200">- Update to version 7.0.1
  * Updated the inline version namespace name.
  * Worked around a gcc bug in mangling of alias templates
  * Fixed minor issues with the documentation.</changelog>
  <changelog author="aloisio@gmx.com" date="1596024000">- Update to version 7.0.2
  * Worked around broken ``numeric_limits`` for 128-bit integers
  * Fixed compatibility with CMake 3.4
  * Fixed handling of digit separators in locale-specific
    formatting</changelog>
  <changelog author="aloisio@gmx.com" date="1596801600">- Update to version 7.0.3
  * Worked around broken ``numeric_limits`` for 128-bit integers
  * Added error reporting on missing named arguments
  * Stopped using 128-bit integers with clang-cl
  * Fixed issues in locale-specific integer formatting</changelog>
  <changelog author="aloisio@gmx.com" date="1603713600">- Update to version 7.1.0
  * Switched from Grisu3 to Dragonbox for the default
    floating-point formatting which gives the shortest decimal
    representation with round-trip guarantee and correct rounding.
    This makes {fmt} up to 20-30x faster than common
    implementations of std::ostringstream and sprintf on
    dtoa-benchmark and faster than double-conversion and Ry?. It
    is possible to get even better performance at the cost of
    larger binary size by compiling with the
    FMT_USE_FULL_CACHE_DRAGONBOX macro set to 1.
  * Added an experimental unsynchronized file output API which,
    together with format string compilation can give 5-9 times
    speed up compared to fprintf on common platforms.
  * Added a formatter for std::chrono::time_point&lt;system_clock&gt;
  * Added support for ranges with non-const begin/end to fmt::join
  * Added a memory_buffer::append overload that takes a range.
  * Improved handling of single code units in FMT_COMPILE.
  * Added dynamic width support to format string compilation.
  * Improved error reporting for unformattable types: now you'll
    get the type name directly in the error message instead of
    the note.
  * Added the make_args_checked function template that allows
    you to write formatting functions with compile-time format
    string checks and avoid binary code bloat.
  * Replaced snprintf fallback with a faster internal IEEE 754
    float and double formatter for arbitrary precision.
  * Made format_to_n and formatted_size part of the core API.
  * Added fmt::format_to_n overload with format string
    compilation.
  * Added fmt::format_to overload that take text_style.
  * Made the # specifier emit trailing zeros in addition to the
    decimal point.
  * Changed the default floating point format to not include .0
    for consistency with std::format and std::to_chars. It is
    possible to get the decimal point and trailing zero with the
    [#] specifier.
  * Fixed an issue with floating-point formatting that could
    result in addition of a non-significant trailing zero in
    rare cases e.g. 1.00e-34 instead of 1.0e-34.
  * Made fmt::to_string fallback on ostream insertion operator
    if the formatter specialization is not provided.
  * Added support for the append mode to the experimental file
    API and improved fcntl.h detection.
  * Fixed handling of types that have both an implicit
    conversion operator and an overloaded ostream insertion
    operator.
  * Fixed a slicing issue in an internal iterator type.
  * Fixed an issue in locale-specific integer formatting.
  * Fixed handling of exotic code unit types.
  * Improved FMT_ALWAYS_INLINE.
  * Improved documentation.
  * Added the FMT_REDUCE_INT_INSTANTIATIONS CMake option that
    reduces the binary code size at the cost of some integer
    formatting performance. This can be useful for extremely
    memory-constrained embedded systems.
  * Added the FMT_USE_INLINE_NAMESPACES macro to control usage
    of inline namespaces.
  * Improved build configuration.
  * Fixed various warnings and compilation issues.
- Add fmt-7.1.0-LTO.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1604318400">- Update to version 7.1.1
  * Fixed ABI compatibility with 7.0.x
  * Added the FMT_ARM_ABI_COMPATIBILITY macro to work around
    ABI incompatibility between GCC and Clang on ARM
  * Worked around a SFINAE bug in GCC 8
  * Fixed linkage errors when building with GCC's LTO
  * Fixed a compilation error when building without
    __builtin_clz or equivalent
  * Fixed a sign conversion warning
- Dropped fmt-7.1.0-LTO.patch (merged upstream)</changelog>
  <changelog author="aloisio@gmx.com" date="1604491200">- Update to version 7.1.2
  * Fixed floating point formatting with large precision</changelog>
  <changelog author="aloisio@gmx.com" date="1606305600">- Update to version 7.1.3
  * Fixed handling of buffer boundaries in format_to_n
  * Fixed linkage errors when linking with a shared library
  * Reintroduced ostream support to range formatters
  * Worked around an issue with mixing std versions in gcc</changelog>
  <changelog author="aloisio@gmx.com" date="1624276800">- Update to version 8.0.0
  * Enabled compile-time format string check by default.
  * Added compile-time formatting.
  * Optimized handling of format specifiers during format string
    compilation.
  * Added the ``_cf`` user-defined literal to represent a
    compiled format string. It can be used instead of the
    ``FMT_COMPILE`` macro.
  * Format string compilation now requires ``format`` functions
    of ``formatter`` specializations for user-defined types to
    be ``const``.
  * Added UDL-based named argument support to format string
    compilation.
  * Added format string compilation support to ``fmt::print``.
  * Added initial support for compiling {fmt} as a C++20 module.
  * Made symbols private by default reducing shared library size
  * Optimized includes making the result of preprocessing
    ``fmt/format.h``.
  * Added support of ranges with non-const ``begin`` / ``end``
  * Added support of ``std::byte`` and other formattable types
    to ``fmt::join``.
  * Implemented the default format for
    ``std::chrono::system_clock``.
  * Made more chrono specifiers locale independent by default.
    Use the ``'L'`` specifier to get localized formatting.
  * Improved locale handling in chrono formatting.
  * Deprecated ``fmt/locale.h`` moving the formatting functions
    that take a locale to ``fmt/format.h`` (``char``) and
    ``fmt/xchar`` (other overloads). This doesn't introduce a
    dependency on ``&lt;locale&gt;`` so there is virtually no compile
    time effect.
  * Made parameter order in ``vformat_to`` consistent with
    ``format_to``.
  * Added support for time points with arbitrary durations.
  * Formatting floating-point numbers no longer produces
    trailing zeros by default.
    for consistency with ``std::format``.
  * Dropped a limit on the number of elements in a range and
    replaced ``{}`` with ``[]`` as range delimiters for
    consistency with Python's ``str.format``.
  * The ``'L'`` specifier for locale-specific numeric formatting
    can now be combined with presentation specifiers as in
    ``std::format``.
  * Made the ``0`` specifier ignored for infinity and NaN.
  * Made the hexfloat formatting use the right alignment by
    default.
  * Removed the deprecated numeric alignment (``'='``). Use the
    ``'0'`` specifier instead.
  * Removed the deprecated ``fmt/posix.h`` header that has been
    replaced with ``fmt/os.h``.
  * Removed the deprecated ``format_to_n_context``,
    ``format_to_n_args`` and ``make_format_to_n_args``. They
    have been replaced with ``format_context``, ``format_args`
    and ``make_format_args`` respectively.
  * Moved ``wchar_t``-specific functions and types to
    ``fmt/wchar.h``. You can define
    ``FMT_DEPRECATED_INCLUDE_WCHAR`` to automatically include
    ``fmt/wchar.h`` from ``fmt/format.h`` but this will be
    disabled in the next major release.
  * Fixed handling of the ``'+'`` specifier in localized
    formatting.
  * Added support for the ``'s'`` format specifier that gives
    textual representation of ``bool``.
  * Made ``fmt::ptr`` work with function pointers.
  * Fixed ``fmt::formatted_size`` with format string compilation
  * Fixed handling of empty format strings during format string
    compilation.
  * Fixed handling of enums in ``fmt::to_string``.
  * Improved width computation.
  * The experimental fast output stream (``fmt::ostream``) is
    now truncated by default for consistency with ``fopen``.
  * Fixed moving of ``fmt::ostream`` that holds buffered data
  * Replaced the ``fmt::system_error`` exception with a function
    of the same name that constructs ``std::system_error``.
  * Replaced the ``fmt::windows_error`` exception with a
    function of the same name that constructs
    ``std::system_error`` with the category returned by
    ``fmt::system_category()``.
  * Replaced ``fmt::error_code`` with ``std::error_code`` and
    made it formattable.
  * Added speech synthesis support.
  * Made ``format_to`` work with a memory buffer that has a
    custom allocator.
  * Added ``Allocator::max_size`` support to
    ``basic_memory_buffer``.
  * Added wide string support to ``fmt::join``
  * Made iterators passed to ``formatter`` specializations via a
    format context satisfy C++20 ``std::output_iterator``
    requirements.
  * Optimized the ``printf`` implementation.
  * Improved detection of ``constexpr`` ``char_traits``.
  * Fixed exception propagation from iterators.
  * Improved ``strftime`` error handling.
  * Stopped using deprecated GCC UDL template extension.
  * Added ``fmt/args.h`` to the install target.
  * Error messages are now passed to assert when exceptions are
    disabled.
  * Added the ``FMT_MASTER_PROJECT`` CMake option to control
    build and install targets when {fmt} is included via
    ``add_subdirectory``.
  * Improved build configuration.
  * Fixed various warnings and compilation issues.
  * Improved documentation.
  * Continuous integration and test improvements.
- Bump soversion to 8</changelog>
  <changelog author="aloisio@gmx.com" date="1625313600">- Update to version 8.0.1
  * Fixed the version number in the inline namespace.
  * Added a missing presentation type check for std::string.
  * Fixed a linkage error when mixing code built with clang and
    gcc.
  * Fixed documentation issues.
  * Removed dead code in FP formatter.
  * Fixed various warnings and compilation issues.</changelog>
</package>
<package pkgid="9173e31cfd5802322c54dd29b156a7655283a1daa8e904dc30911eac09614a7e" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="662e21c0f74abcd5337f27a42b487b730d7693b74693b60c3ece52c56af9ccb4" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="f44864069ec185937d46544f47fc0f3940432caa0fb95c767300fb1b12bb6cdd" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="46d1a5bd7ddf492b5d3922df3880705e32218fceb669c086d30bbc13abc0c065" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="822d83ddc485b3b70e29e6a6f0938cc9230e8b5f457bb70878f03a022ce2469e" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="2d38f9de5a21fe03101b0a6939a7c4562d49a297e47626aff09ef822805fcb58" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="4e81f49b562ac42ec357b93b3a49c4fe495441c5e9f6f14d20adf50691c108c0" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="6b60da0b75697665ec4c652721109cd6db3b334c7c1942ead3dd8eb19f56f769" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="b4152cd1c92681c54cfdcf20b41cfa536faaae51a4e4f1215839fbbc602341f7" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="a4cb018d75ecefe55e4da266b86b89c28612992e63dc82962151b08ca37a589a" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="b9935dc9d85cadcc53b8393a17c092cd1ce58fa637f83d4213443d2f8902e19b" name="libfreebl3" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="a9204ce71621199c522198eb649847919828c822414e51777da45a0d80c9a853" name="libfreebl3" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="25269ee45edf8050996fbabe0a982be69f6a7c22e1396fb7e06c410e29574d16" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="51c4a81ecd4ad23012fbd911291f2274811e5ff97d03d6dc4055645a275f3758" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="a63a7939ea2fa6a8c6531cf7144600ca54c07c85452c13a4771b42206a0d6355" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="3a119d9bf72575e2f923a3d912a3c6c5eb9ee252311f6ea28f49d285760294e2" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="376db5d1cbcbd9fefbf2e7394bd22007a7642335be4c7e0c9307e001dbea7b7c" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="4556e050b40035df5f8046bbe9e9eb8348c54f68be9c5465ec1e35b1efda25e1" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="ad855385e6e42289300c1f450f2d93d7934b5dfd7871ebfdbe108d3851b021d4" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="73e3c16160927ad24106b983dbd4b6ddabd92a3e0eb489765392b8d9c8dce7a5" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="544424e21046fcf8f214e3a5464473b8f752ca87588818177488785fec8555fa" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="bf5e861bfbe7bb27fae4f7961f22490b2ccccd6cefef7698eaf79661f293389a" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="1040b8b8182ab41bba1a2b67fe96038e3558cd3e6f88d49743230ebc81a9a663" name="libfreebl3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="9f59790a9a292b0ed119419f0432d94a09262b4924a11cbcbfe9ea41cabba8f3" name="libfreebl3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="ab716db0784d998449e4b69445b5f55ce887d702cc2f85e819c1289f780c0dbd" name="libfreetype6" arch="aarch64">
  <version epoch="0" ver="2.10.4" rel="150000.4.12.1"/>
  <changelog author="develop7@develop7.info" date="1473422400">- update to version 2.7:
  * IMPORTANT CHANGES
    + As announced earlier, the 2.7.x series now uses the new subpixel
    hinting  mode as  the  default, emulating  a  modern version  of
    ClearType.
    This change inevitably leads to different rendering results, and
    you   might   change   the   `TT_CONFIG_OPTION_SUBPIXEL_HINTING'
    configuration option to  adapt it to your taste (or  use the new
    `FREETYPE_PROPERTIES'    environment    variable).    See    the
    corresponding entry  below for  version 2.6.4, which  gives more
    information.
    + A new option  `FT_CONFIG_OPTION_ENVIRONMENT_PROPERTIES' has been
    introduced.   If  set (which  is  the  default), an  environment
    variable  `FREETYPE_PROPERTIES' can  be used  to control  driver
    properties.  Example:
    FREETYPE_PROPERTIES=truetype:interpreter-version=35 \
    cff:no-stem-darkening=1 \
    autofitter:warping=1
    This allows to select, say, the subpixel hinting mode at runtime
    for a given application.  See file `ftoption.h' for more.
  * IMPORTANT BUG FIXES
    + After  loading a  named instance  of  a GX  variation font,  the
    `face_index'  value  in  the returned  `FT_Face'  structure  now
    correctly holds the named instance  index in the upper 16bits as
    documented.
  * MISCELLANEOUS
    + A new macro `FT_IS_NAMED_INSTANCE' to  test whether a given face
    is a named instance.
    + More fixes to GX font handling.
    + Apple's   `GETVARIATION'  bytecode   operator  (needed   for  GX
    variation font support) has been implemented.
    + Another round  of fuzzer fixes,  mainly to reject  invalid fonts
    faster.
    + Handling of raw CID fonts  was broken (bug introduced in version
    2.6.4).
    + The smooth rasterizer has been streamlined  to make it faster by
    approx. 20%.
    + The `ftgrid'  demo program now  understands command  line option
    `-d' to give start-up design coordinates.
    + The `ftdump' demo program has  a new command line option `-p' to
    dump TrueType bytecode instructions.
- removed freetype2-subpixel.patch in favor of above
  FREETYPE_PROPERTIES environment variable</changelog>
  <changelog author="idonmez@suse.com" date="1483272000">- Update to version 2.7.1:
  * IMPORTANT CHANGES
    + Support for the new CFF2 font format as introduced with
    OpenType 1.8 has been contributed by Dave Arnolds from Adobe.
    + Preliminary support for variation fonts as specified in
    OpenType 1.8 (in addition to the already existing support for
    Adobe's MM and Apple's GX formats). Dave Arnolds contributed
    handling of advance width change variation; more will come in
    the next version.
  * IMPORTANT BUG FIXES
    + Handling of raw CID fonts was partially broken (bug introduced
    in 2.6.4).
  * MISCELLANEOUS
    + Some limits for TrueType bytecode execution have been tightened
    to speed up FreeType's handling of malformed fonts, in
    particular to quickly abort endless loops.
    + The number of twilight points can no longer be set to an
    arbitrarily large value.
    + The total number of jump opcode instructions (like JMPR) with
    negative arguments is dynamically restricted; the same holds
    for the total number of iterations in LOOPCALL opcodes.
    + The dynamic limits are based on the number of points in a glyph
    and the number of CVT entries. Please report if you encounter a
    font where the selected values are not adequate.
    + PCF family names are made more `colourful'; they now include the
    foundry and information whether they contain wide characters.
    For example, you no longer get `Fixed' but rather `Sony Fixed'
    or `Misc Fixed Wide'.
    + A new function `FT_Get_Var_Blend_Coordinates' (with its alias
    name `FT_Get_MM_Blend_Coordinates') to retrieve the normalized
    blend coordinates of the currently selected variation instance
    has been added to the Multiple Masters interface.
    + A new function `FT_Get_Var_Design_Coordinates' to retrieve the
    design coordinates of the currently selected variation instance
    has been added to the Multiple Masters interface.
    + A new load flag `FT_LOAD_BITMAP_METRICS_ONLY' to retrieve bitmap
    information without loading the (embedded) bitmap itself.
    + Retrieving advance widths from bitmap strikes (using
    `FT_Get_Advance' and `FT_Get_Advances') have been sped up.
    + The usual round of fuzzer fixes to better reject malformed
    fonts.
- Drop freetype2-bitmap-foundry.patch, merged upstream.</changelog>
  <changelog author="idoenmez@suse.de" date="1494849600">- Update to version 2.8
  * Support for OpenType Variation Fonts is now complete. The last
    missing part was handling the `VVAR' and `MVAR' tables, which is
    available with this release.
  * A new  function `FT_Face_Properties' allows the  control of some
    module  and   library  properties  per  font.    Currently,  the
    following properties can be  handled: stem darkening, LCD filter
    weights, and the random seed for the `random' CFF operator.
  * The PCF change to show more `colourful' family names (introduced
    in version 2.7.1) was too radical; it can now be configured with
    PCF_CONFIG_OPTION_LONG_FAMILY_NAMES   at   compile   time.    If
    activated, it can  be switched off at run time  with the new pcf
    property  `no-long-family-names'.  If  the `FREETYPE_PROPERTIES'
    environment variable is available, you can say
    FREETYPE_PROPERTIES=pcf:no-long-family-names=1
  * Support  for  the  following  scripts  has  been  added  to  the
    auto-hinter.
    Adlam, Avestan, Bamum, Buhid, Carian, Chakma, Coptic, Cypriot,
    Deseret, Glagolitic, Gothic, Kayah, Lisu, N'Ko, Ol Chiki, Old
    Turkic, Osage, Osmanya, Saurashtra, Shavian, Sundanese, Tai
    Viet, Tifinagh, Unified Canadian Syllabics, Vai
  * `Light' auto-hinting  mode no  longer uses TrueType  metrics for
    TrueType  fonts.   This bug  was  introduced  in version  2.4.6,
    causing   horizontal  scaling   also.    Almost  all   GNU/Linux
    distributions (with Fedora as  a notable exception) disabled the
    corresponding patch for good reasons; chances are thus high that
    you won't notice a difference.
  * If a TrueType font gets loaded with FT_LOAD_NO_HINTING, FreeType
    now scales  the font linearly  again (bug introduced  in version
    2.4.6).
  * Fixed CVE-2017-8105,  CVE-2017-8287:  Older   FreeType  versions
    have out-of-bounds  writes  caused  by  heap-based  buffer  overflows
    related to Type 1 fonts. (boo#1035807, boo#1036457)
- See https://sourceforge.net/projects/freetype/files/freetype2/2.8/ for
  the complete changelog.</changelog>
  <changelog author="idonmez@suse.com" date="1505736000">- Update to version 2.8.1
  * B/W  hinting   of  TrueType   fonts  didn't  work   properly  if
    interpreter version 38 or 40 was selected.
  * Some severe  problems within the handling  of TrueType Variation
    Fonts were found and fixed.
  * Function `FT_Set_Var_Design_Coordinates' didn't correctly handle
    the case with less input coordinates than axes.
  * By default,  FreeType  now offers  high  quality  LCD-optimized
    output  without resorting to ClearType techniques of resolution
    tripling and filtering.  In this method,  called Harmony,  each
    color channel is generated separately  after shifting the glyph
    outline,  capitalizing on the fact  that the color grids on LCD
    panels  are  shifted  by  a third  of  a pixel.  This output is
    indistinguishable from ClearType with a light 3-tap filter.
  * Using the  new function `FT_Get_Var_Axis_Flags',  an application
    can access the `flags' field  of a variation axis (introduced in
    OpenType version 1.8.2)
  * FreeType  now synthesizes  a  missing Unicode  cmap for  (older)
    TrueType fonts also if glyph names are available.
  * The warping option  has moved  from `light'  to `normal' hinting
    where  it replaces  the original hinting algorithm.  The `light'
    mode is now always void of any hinting in x-direction.</changelog>
  <changelog author="idonmez@suse.com" date="1515499200">- Update to version 2.9
  * Advance width values of variation fonts were often wrong.
  * More fixes for variation font support; you should update to
    this version if you want to support them.
  * As a GSoC project, Ewald Hew extended the new (Adobe) CFF
    engine to handle Type 1 fonts also, thus greatly improving
    the rendering of this format. This is the new default.
  * A new function, `FT_Set_Named_Instance', can be used to set
    or change the current named instance.
  * Starting with this FreeType version, resetting variation
    coordinates will return to the currently selected named
    instance. Previously, FreeType returned to the base font
    (i.e., no instance set).
  * Some fuzzer fixes to better reject malformed fonts.</changelog>
  <changelog author="idonmez@suse.com" date="1515585600">- Add psaux-flex.patch to fix a regression in Type1 rendering</changelog>
  <changelog author="fstrba@suse.com" date="1518004800">- Added patches:
  * 0001-src-truetype-ttinterp.c-Ins_GETVARIATION-Avoid-NULL-.patch
    + Upstream fix for bsc#1079603: Avoid NULL reference in
    src/truetype/ttinterp.c
  * 0001-truetype-Better-protection-against-invalid-VF-data.patch
    + Upstream fix for bsc#1079601: Protection against invalid VF
    data</changelog>
  <changelog author="fstrba@suse.com" date="1518177600">- Added patch:
  * enable-long-family-names-by-default.patch
    + Define PCF_CONFIG_OPTION_LONG_FAMILY_NAMES to obtain 2.7.1
    behaviour</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1520337600">- Refresh spec-file via spec-cleaner.
- Add shell script freetype2.sh in separate package
  freetype2-profile-tti35 in order to be able to set TrueType
  interpreter version 35 (boo#1084085).</changelog>
  <changelog author="kbabioch@suse.com" date="1520510400">- Add bnc1079600.patch: Fix several integer overflow issues in
  truetype/ttinterp.c (bsc#1079600)</changelog>
  <changelog author="idonmez@suse.com" date="1525262400">- Update to version 2.9.1
  * Type 1 fonts containing flex features were not rendered
    correctly (bug introduced in version 2.9).
  * CVE-2018-6942: Older FreeType versions can crash with certain
    malformed variation fonts.
  * Bug fix: Multiple calls to `FT_Get_MM_Var' returned garbage.
  * Emboldening of bitmaps didn't work correctly sometimes, showing
    various artifacts (bug introduced in version 2.8.1).
  * The auto-hinter script ranges have  been updated for Unicode 11.
    No support for new scripts have been added, however,  with the
    exception of Georgian Mtavruli.
- freetype-config is now deprecated by upstream and not enabled
  by default.
- Drop upstreamed patches:
  * bnc1079600.patch
  * psaux-flex.patch
  * 0001-src-truetype-ttinterp.c-Ins_GETVARIATION-Avoid-NULL-.patch
  * 0001-truetype-Better-protection-against-invalid-VF-data.patch</changelog>
  <changelog author="idonmez@suse.com" date="1526299200">- Re-enable freetype-config, there is just too many fallouts.</changelog>
  <changelog author="idonmez@suse.com" date="1540641600">- Remove old ppc64 parts in spec file
- Refresh patches:
  + bugzilla-308961-cmex-workaround.patch
  + don-t-mark-libpng-as-required-library.patch
  + enable-long-family-names-by-default.patch
- Enable subpixel rendering with infinality config:
  + enable-subpixel-rendering.patch
  + enable-infinality-subpixel-hinting.patch</changelog>
  <changelog author="idonmez@suse.com" date="1561377600">- Update to version 2.10.0
  * A bunch of new functions has been added to access and process
    COLR/CPAL data of OpenType fonts with color-layered glyphs.
  * As a GSoC 2018 project, Nikhil Ramakrishnan completely
    overhauled and modernized the API reference.
  * The logic for computing the global ascender, descender, and
    height of OpenType fonts has been slightly adjusted for
    consistency.
  * `TT_Set_MM_Blend' could fail if called repeatedly with the same
    arguments.
  * The precision of handling deltas in Variation Fonts has been
    increased.The problem did only show up with multidimensional
    designspaces.
  * New function `FT_Library_SetLcdGeometry' to set up the geometry
    of LCD subpixels.
  * FreeType now uses the `defaultChar' property of PCF fonts to set
    the  glyph for  the undefined  character  at glyph  index 0  (as
    FreeType already does for all other supported font formats).  As
    a consequence, the order of glyphs of a PCF font if accessed
    with  FreeType can be different now compared to previous
    versions.
    This change doesn't affect PCF font access with cmaps.
  * `FT_Select_Charmap' has been changed to allow  parameter value
    `FT_ENCODING_NONE', which is valid for BDF, PCF, and Windows FNT
    formats to access built-in cmaps that don't have a predefined
    `FT_Encoding' value.
  * A previously reserved field in the `FT_GlyphSlotRec' structure
    now holds the glyph index.
  * The usual round of fuzzer bug fixes to better reject malformed
    fonts.
  * `FT_Outline_New_Internal' and `FT_Outline_Done_Internal' have
    been removed.These two functions were public by oversight only
    and were never documented.
  * A new function `FT_Error_String' returns descriptions of error
    codes if configuration macro FT_CONFIG_OPTION_ERROR_STRINGS is
    defined.
  * `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector' are new
    functions limited to Adobe MultiMaster fonts to directly set and
    get the weight vector.</changelog>
  <changelog author="idonmez@suse.com" date="1562068800">- Update to version 2.10.1
  * The bytecode hinting of OpenType variation fonts was flawed, since
    the data in the `CVAR' table wasn't correctly applied.
  * Auto-hinter support for Mongolian.
  * The handling of  the default character in PCF fonts as  introduced
    in version 2.10.0 was partially broken, causing premature abortion
    of charmap iteration for many fonts.
  * If  `FT_Set_Named_Instance' was  called  with  the same  arguments
    twice in a row, the function  returned an incorrect error code the
    second time.
  * Direct   rendering   using  FT_RASTER_FLAG_DIRECT   crashed   (bug
    introduced in version 2.10.0).
  * Increased  precision  while  computing  OpenType  font   variation
    instances.
  * The  flattening  algorithm of  cubic  Bezier  curves was  slightly
    changed to make  it faster.  This can cause  very subtle rendering
    changes, which aren't noticeable by the eye, however.
  * The  auto-hinter  now  disables hinting  if there  are blue  zones
    defined for a `style' (i.e., a certain combination of a script and
    its related typographic features) but the font doesn't contain any
    characters needed to set up at least one blue zone.
- Add tarball signatures and freetype2.keyring</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1570622400">- Use the compiler default C std, since 2012 gcc defaults
  have changed, we now only need to get rid of ANSIFLAGS, override
  that variable instead.</changelog>
  <changelog author="idonmez@suse.com" date="1589025600">- Update to version 2.10.2
  * Support for WOFF2 fonts, add BR on pkgconfig(libbrotlidec)
  * Function `FT_Get_Var_Axis_Flags' returned random data for Type 1
    MM fonts.
  * Type 1 fonts with non-integer metrics are now supported by the new
    (CFF) engine introduced in FreeType 2.9.
  * Drop support for Python 2 in Freetype's API reference generator
  * Auto-hinter support for Hanifi Rohingya
  * Document the `FT2_KEEP_ALIVE' debugging environment variable.</changelog>
  <changelog author="idonmez@suse.com" date="1603195200">- Update to version 2.10.4
  * Fix a heap buffer overflow has been found  in the handling of
    embedded PNG bitmaps, introduced in FreeType version 2.6
    (CVE-2020-15999 bsc#1177914)
  * Minor improvements to the B/W rasterizer.
  * Auto-hinter support for Medefaidrin script.
  * Fix various  memory leaks (mainly  for CFF) and other  issues that
    might cause crashes in rare circumstances.</changelog>
  <changelog author="fstrba@suse.com" date="1661256000">- Added patches:
  * CVE-2022-27404.patch
    + fixes bsc#1198830, CVE-2022-27404: Buffer Overflow
  * CVE-2022-27405.patch
    + fixes bsc#1198832, CVE-2022-27405: Segmentation Fault
  * CVE-2022-27406.patch
    + fixes bsc#1198823, CVE-2022-27406: Segmentation violation</changelog>
  <changelog author="meissner@suse.com" date="1661947200">- disable brotli linkage / WOFF2 support for now to keep dependencies
  as before.</changelog>
</package>
<package pkgid="d8f9f0d0ebcac901fec06c865924b6bd3ae002ba588e87a745c5228dc021844c" name="libfreetype6" arch="x86_64">
  <version epoch="0" ver="2.10.4" rel="150000.4.12.1"/>
  <changelog author="develop7@develop7.info" date="1473422400">- update to version 2.7:
  * IMPORTANT CHANGES
    + As announced earlier, the 2.7.x series now uses the new subpixel
    hinting  mode as  the  default, emulating  a  modern version  of
    ClearType.
    This change inevitably leads to different rendering results, and
    you   might   change   the   `TT_CONFIG_OPTION_SUBPIXEL_HINTING'
    configuration option to  adapt it to your taste (or  use the new
    `FREETYPE_PROPERTIES'    environment    variable).    See    the
    corresponding entry  below for  version 2.6.4, which  gives more
    information.
    + A new option  `FT_CONFIG_OPTION_ENVIRONMENT_PROPERTIES' has been
    introduced.   If  set (which  is  the  default), an  environment
    variable  `FREETYPE_PROPERTIES' can  be used  to control  driver
    properties.  Example:
    FREETYPE_PROPERTIES=truetype:interpreter-version=35 \
    cff:no-stem-darkening=1 \
    autofitter:warping=1
    This allows to select, say, the subpixel hinting mode at runtime
    for a given application.  See file `ftoption.h' for more.
  * IMPORTANT BUG FIXES
    + After  loading a  named instance  of  a GX  variation font,  the
    `face_index'  value  in  the returned  `FT_Face'  structure  now
    correctly holds the named instance  index in the upper 16bits as
    documented.
  * MISCELLANEOUS
    + A new macro `FT_IS_NAMED_INSTANCE' to  test whether a given face
    is a named instance.
    + More fixes to GX font handling.
    + Apple's   `GETVARIATION'  bytecode   operator  (needed   for  GX
    variation font support) has been implemented.
    + Another round  of fuzzer fixes,  mainly to reject  invalid fonts
    faster.
    + Handling of raw CID fonts  was broken (bug introduced in version
    2.6.4).
    + The smooth rasterizer has been streamlined  to make it faster by
    approx. 20%.
    + The `ftgrid'  demo program now  understands command  line option
    `-d' to give start-up design coordinates.
    + The `ftdump' demo program has  a new command line option `-p' to
    dump TrueType bytecode instructions.
- removed freetype2-subpixel.patch in favor of above
  FREETYPE_PROPERTIES environment variable</changelog>
  <changelog author="idonmez@suse.com" date="1483272000">- Update to version 2.7.1:
  * IMPORTANT CHANGES
    + Support for the new CFF2 font format as introduced with
    OpenType 1.8 has been contributed by Dave Arnolds from Adobe.
    + Preliminary support for variation fonts as specified in
    OpenType 1.8 (in addition to the already existing support for
    Adobe's MM and Apple's GX formats). Dave Arnolds contributed
    handling of advance width change variation; more will come in
    the next version.
  * IMPORTANT BUG FIXES
    + Handling of raw CID fonts was partially broken (bug introduced
    in 2.6.4).
  * MISCELLANEOUS
    + Some limits for TrueType bytecode execution have been tightened
    to speed up FreeType's handling of malformed fonts, in
    particular to quickly abort endless loops.
    + The number of twilight points can no longer be set to an
    arbitrarily large value.
    + The total number of jump opcode instructions (like JMPR) with
    negative arguments is dynamically restricted; the same holds
    for the total number of iterations in LOOPCALL opcodes.
    + The dynamic limits are based on the number of points in a glyph
    and the number of CVT entries. Please report if you encounter a
    font where the selected values are not adequate.
    + PCF family names are made more `colourful'; they now include the
    foundry and information whether they contain wide characters.
    For example, you no longer get `Fixed' but rather `Sony Fixed'
    or `Misc Fixed Wide'.
    + A new function `FT_Get_Var_Blend_Coordinates' (with its alias
    name `FT_Get_MM_Blend_Coordinates') to retrieve the normalized
    blend coordinates of the currently selected variation instance
    has been added to the Multiple Masters interface.
    + A new function `FT_Get_Var_Design_Coordinates' to retrieve the
    design coordinates of the currently selected variation instance
    has been added to the Multiple Masters interface.
    + A new load flag `FT_LOAD_BITMAP_METRICS_ONLY' to retrieve bitmap
    information without loading the (embedded) bitmap itself.
    + Retrieving advance widths from bitmap strikes (using
    `FT_Get_Advance' and `FT_Get_Advances') have been sped up.
    + The usual round of fuzzer fixes to better reject malformed
    fonts.
- Drop freetype2-bitmap-foundry.patch, merged upstream.</changelog>
  <changelog author="idoenmez@suse.de" date="1494849600">- Update to version 2.8
  * Support for OpenType Variation Fonts is now complete. The last
    missing part was handling the `VVAR' and `MVAR' tables, which is
    available with this release.
  * A new  function `FT_Face_Properties' allows the  control of some
    module  and   library  properties  per  font.    Currently,  the
    following properties can be  handled: stem darkening, LCD filter
    weights, and the random seed for the `random' CFF operator.
  * The PCF change to show more `colourful' family names (introduced
    in version 2.7.1) was too radical; it can now be configured with
    PCF_CONFIG_OPTION_LONG_FAMILY_NAMES   at   compile   time.    If
    activated, it can  be switched off at run time  with the new pcf
    property  `no-long-family-names'.  If  the `FREETYPE_PROPERTIES'
    environment variable is available, you can say
    FREETYPE_PROPERTIES=pcf:no-long-family-names=1
  * Support  for  the  following  scripts  has  been  added  to  the
    auto-hinter.
    Adlam, Avestan, Bamum, Buhid, Carian, Chakma, Coptic, Cypriot,
    Deseret, Glagolitic, Gothic, Kayah, Lisu, N'Ko, Ol Chiki, Old
    Turkic, Osage, Osmanya, Saurashtra, Shavian, Sundanese, Tai
    Viet, Tifinagh, Unified Canadian Syllabics, Vai
  * `Light' auto-hinting  mode no  longer uses TrueType  metrics for
    TrueType  fonts.   This bug  was  introduced  in version  2.4.6,
    causing   horizontal  scaling   also.    Almost  all   GNU/Linux
    distributions (with Fedora as  a notable exception) disabled the
    corresponding patch for good reasons; chances are thus high that
    you won't notice a difference.
  * If a TrueType font gets loaded with FT_LOAD_NO_HINTING, FreeType
    now scales  the font linearly  again (bug introduced  in version
    2.4.6).
  * Fixed CVE-2017-8105,  CVE-2017-8287:  Older   FreeType  versions
    have out-of-bounds  writes  caused  by  heap-based  buffer  overflows
    related to Type 1 fonts. (boo#1035807, boo#1036457)
- See https://sourceforge.net/projects/freetype/files/freetype2/2.8/ for
  the complete changelog.</changelog>
  <changelog author="idonmez@suse.com" date="1505736000">- Update to version 2.8.1
  * B/W  hinting   of  TrueType   fonts  didn't  work   properly  if
    interpreter version 38 or 40 was selected.
  * Some severe  problems within the handling  of TrueType Variation
    Fonts were found and fixed.
  * Function `FT_Set_Var_Design_Coordinates' didn't correctly handle
    the case with less input coordinates than axes.
  * By default,  FreeType  now offers  high  quality  LCD-optimized
    output  without resorting to ClearType techniques of resolution
    tripling and filtering.  In this method,  called Harmony,  each
    color channel is generated separately  after shifting the glyph
    outline,  capitalizing on the fact  that the color grids on LCD
    panels  are  shifted  by  a third  of  a pixel.  This output is
    indistinguishable from ClearType with a light 3-tap filter.
  * Using the  new function `FT_Get_Var_Axis_Flags',  an application
    can access the `flags' field  of a variation axis (introduced in
    OpenType version 1.8.2)
  * FreeType  now synthesizes  a  missing Unicode  cmap for  (older)
    TrueType fonts also if glyph names are available.
  * The warping option  has moved  from `light'  to `normal' hinting
    where  it replaces  the original hinting algorithm.  The `light'
    mode is now always void of any hinting in x-direction.</changelog>
  <changelog author="idonmez@suse.com" date="1515499200">- Update to version 2.9
  * Advance width values of variation fonts were often wrong.
  * More fixes for variation font support; you should update to
    this version if you want to support them.
  * As a GSoC project, Ewald Hew extended the new (Adobe) CFF
    engine to handle Type 1 fonts also, thus greatly improving
    the rendering of this format. This is the new default.
  * A new function, `FT_Set_Named_Instance', can be used to set
    or change the current named instance.
  * Starting with this FreeType version, resetting variation
    coordinates will return to the currently selected named
    instance. Previously, FreeType returned to the base font
    (i.e., no instance set).
  * Some fuzzer fixes to better reject malformed fonts.</changelog>
  <changelog author="idonmez@suse.com" date="1515585600">- Add psaux-flex.patch to fix a regression in Type1 rendering</changelog>
  <changelog author="fstrba@suse.com" date="1518004800">- Added patches:
  * 0001-src-truetype-ttinterp.c-Ins_GETVARIATION-Avoid-NULL-.patch
    + Upstream fix for bsc#1079603: Avoid NULL reference in
    src/truetype/ttinterp.c
  * 0001-truetype-Better-protection-against-invalid-VF-data.patch
    + Upstream fix for bsc#1079601: Protection against invalid VF
    data</changelog>
  <changelog author="fstrba@suse.com" date="1518177600">- Added patch:
  * enable-long-family-names-by-default.patch
    + Define PCF_CONFIG_OPTION_LONG_FAMILY_NAMES to obtain 2.7.1
    behaviour</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1520337600">- Refresh spec-file via spec-cleaner.
- Add shell script freetype2.sh in separate package
  freetype2-profile-tti35 in order to be able to set TrueType
  interpreter version 35 (boo#1084085).</changelog>
  <changelog author="kbabioch@suse.com" date="1520510400">- Add bnc1079600.patch: Fix several integer overflow issues in
  truetype/ttinterp.c (bsc#1079600)</changelog>
  <changelog author="idonmez@suse.com" date="1525262400">- Update to version 2.9.1
  * Type 1 fonts containing flex features were not rendered
    correctly (bug introduced in version 2.9).
  * CVE-2018-6942: Older FreeType versions can crash with certain
    malformed variation fonts.
  * Bug fix: Multiple calls to `FT_Get_MM_Var' returned garbage.
  * Emboldening of bitmaps didn't work correctly sometimes, showing
    various artifacts (bug introduced in version 2.8.1).
  * The auto-hinter script ranges have  been updated for Unicode 11.
    No support for new scripts have been added, however,  with the
    exception of Georgian Mtavruli.
- freetype-config is now deprecated by upstream and not enabled
  by default.
- Drop upstreamed patches:
  * bnc1079600.patch
  * psaux-flex.patch
  * 0001-src-truetype-ttinterp.c-Ins_GETVARIATION-Avoid-NULL-.patch
  * 0001-truetype-Better-protection-against-invalid-VF-data.patch</changelog>
  <changelog author="idonmez@suse.com" date="1526299200">- Re-enable freetype-config, there is just too many fallouts.</changelog>
  <changelog author="idonmez@suse.com" date="1540641600">- Remove old ppc64 parts in spec file
- Refresh patches:
  + bugzilla-308961-cmex-workaround.patch
  + don-t-mark-libpng-as-required-library.patch
  + enable-long-family-names-by-default.patch
- Enable subpixel rendering with infinality config:
  + enable-subpixel-rendering.patch
  + enable-infinality-subpixel-hinting.patch</changelog>
  <changelog author="idonmez@suse.com" date="1561377600">- Update to version 2.10.0
  * A bunch of new functions has been added to access and process
    COLR/CPAL data of OpenType fonts with color-layered glyphs.
  * As a GSoC 2018 project, Nikhil Ramakrishnan completely
    overhauled and modernized the API reference.
  * The logic for computing the global ascender, descender, and
    height of OpenType fonts has been slightly adjusted for
    consistency.
  * `TT_Set_MM_Blend' could fail if called repeatedly with the same
    arguments.
  * The precision of handling deltas in Variation Fonts has been
    increased.The problem did only show up with multidimensional
    designspaces.
  * New function `FT_Library_SetLcdGeometry' to set up the geometry
    of LCD subpixels.
  * FreeType now uses the `defaultChar' property of PCF fonts to set
    the  glyph for  the undefined  character  at glyph  index 0  (as
    FreeType already does for all other supported font formats).  As
    a consequence, the order of glyphs of a PCF font if accessed
    with  FreeType can be different now compared to previous
    versions.
    This change doesn't affect PCF font access with cmaps.
  * `FT_Select_Charmap' has been changed to allow  parameter value
    `FT_ENCODING_NONE', which is valid for BDF, PCF, and Windows FNT
    formats to access built-in cmaps that don't have a predefined
    `FT_Encoding' value.
  * A previously reserved field in the `FT_GlyphSlotRec' structure
    now holds the glyph index.
  * The usual round of fuzzer bug fixes to better reject malformed
    fonts.
  * `FT_Outline_New_Internal' and `FT_Outline_Done_Internal' have
    been removed.These two functions were public by oversight only
    and were never documented.
  * A new function `FT_Error_String' returns descriptions of error
    codes if configuration macro FT_CONFIG_OPTION_ERROR_STRINGS is
    defined.
  * `FT_Set_MM_WeightVector' and `FT_Get_MM_WeightVector' are new
    functions limited to Adobe MultiMaster fonts to directly set and
    get the weight vector.</changelog>
  <changelog author="idonmez@suse.com" date="1562068800">- Update to version 2.10.1
  * The bytecode hinting of OpenType variation fonts was flawed, since
    the data in the `CVAR' table wasn't correctly applied.
  * Auto-hinter support for Mongolian.
  * The handling of  the default character in PCF fonts as  introduced
    in version 2.10.0 was partially broken, causing premature abortion
    of charmap iteration for many fonts.
  * If  `FT_Set_Named_Instance' was  called  with  the same  arguments
    twice in a row, the function  returned an incorrect error code the
    second time.
  * Direct   rendering   using  FT_RASTER_FLAG_DIRECT   crashed   (bug
    introduced in version 2.10.0).
  * Increased  precision  while  computing  OpenType  font   variation
    instances.
  * The  flattening  algorithm of  cubic  Bezier  curves was  slightly
    changed to make  it faster.  This can cause  very subtle rendering
    changes, which aren't noticeable by the eye, however.
  * The  auto-hinter  now  disables hinting  if there  are blue  zones
    defined for a `style' (i.e., a certain combination of a script and
    its related typographic features) but the font doesn't contain any
    characters needed to set up at least one blue zone.
- Add tarball signatures and freetype2.keyring</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1570622400">- Use the compiler default C std, since 2012 gcc defaults
  have changed, we now only need to get rid of ANSIFLAGS, override
  that variable instead.</changelog>
  <changelog author="idonmez@suse.com" date="1589025600">- Update to version 2.10.2
  * Support for WOFF2 fonts, add BR on pkgconfig(libbrotlidec)
  * Function `FT_Get_Var_Axis_Flags' returned random data for Type 1
    MM fonts.
  * Type 1 fonts with non-integer metrics are now supported by the new
    (CFF) engine introduced in FreeType 2.9.
  * Drop support for Python 2 in Freetype's API reference generator
  * Auto-hinter support for Hanifi Rohingya
  * Document the `FT2_KEEP_ALIVE' debugging environment variable.</changelog>
  <changelog author="idonmez@suse.com" date="1603195200">- Update to version 2.10.4
  * Fix a heap buffer overflow has been found  in the handling of
    embedded PNG bitmaps, introduced in FreeType version 2.6
    (CVE-2020-15999 bsc#1177914)
  * Minor improvements to the B/W rasterizer.
  * Auto-hinter support for Medefaidrin script.
  * Fix various  memory leaks (mainly  for CFF) and other  issues that
    might cause crashes in rare circumstances.</changelog>
  <changelog author="fstrba@suse.com" date="1661256000">- Added patches:
  * CVE-2022-27404.patch
    + fixes bsc#1198830, CVE-2022-27404: Buffer Overflow
  * CVE-2022-27405.patch
    + fixes bsc#1198832, CVE-2022-27405: Segmentation Fault
  * CVE-2022-27406.patch
    + fixes bsc#1198823, CVE-2022-27406: Segmentation violation</changelog>
  <changelog author="meissner@suse.com" date="1661947200">- disable brotli linkage / WOFF2 support for now to keep dependencies
  as before.</changelog>
</package>
<package pkgid="990c02875dbeefa5a00d12b3bb85d8621e96def58b4fb1785f3e79bf922c4926" name="libgbm1" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="6c242d94e378b333c208e1acbc6dafa911e9e15fda11d450bad0bc675f766c29" name="libgbm1" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.3.1"/>
  <changelog author="aaron.zakhrov@gmail.com" date="1598356800">- Add vulkan device selection layer and vulkan overlay layer</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
</package>
<package pkgid="e241809f77456cf3f13263206a6a322daca24ea0c03a0f217b80190e52429543" name="libgbm1" arch="aarch64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="0dd0a094c97798802963131c1e6b2e08eca52593f7c57edaaba5cef5a2830fc6" name="libgbm1" arch="x86_64">
  <version epoch="0" ver="20.2.4" rel="150300.59.6.1"/>
  <changelog author="callumjfarmer13@gmail.com" date="1598443200">- Add vulkan device selection layer and vulkan overlay layer to
  baselibs for 32bit versions on 64bit architectures.</changelog>
  <changelog author="sndirsch@suse.com" date="1598875200">- use again /etc/OpenCL/vendors for openSUSE Leap, i.e. use
  /usr/etc/OpenCL/vendors only for Tumbleweed</changelog>
  <changelog author="sndirsch@suse.com" date="1598875201">- version 20.1.6 needed for jira#SLE/SLE-12880, jira#SLE/SLE-12882</changelog>
  <changelog author="sndirsch@suse.com" date="1599048000">- switched to llvm9 usage for Leap/SLE15 since llvm10 is not (yet)
  in Leap/SLE15</changelog>
  <changelog author="sndirsch@suse.com" date="1599134400">- update to 20.1.7
  * seventh bugfix release for the 20.1 branch</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- update to 20.1.8:
  * mainly bugfixes, highlights:
  - Crash in ruvd_end_frame when calling vaBeginPicture/vaEndPicture without rendering anything
  - khr_debug-push-pop-group_gl: ../src/util/simple_mtx.h:86: simple_mtx_lock: Assertion `c != _SIMPLE_MTX_INVALID_VALUE&amp;#x27; failed.
  - Amber test opt_peel_loop_initial_if: Assertion failed
  - Dirt Rally: Flickering glitches on certain foliage since Mesa 20.1.0 caused by MSAA
  - [BRW] WRC 5 asserts with gallium nine and iris.</changelog>
  <changelog author="sndirsch@suse.com" date="1600430400">- buildfix-ppc64le.patch
  * buildfix for ppc64le (boo#1176562)</changelog>
  <changelog author="wbauer@tmo.at" date="1600948800">- Add U_fix-mpeg1_2-decode.patch (boo#1173185)
  * fixes colors in kaffeine on Radeon (r600 VAAPI driver)</changelog>
  <changelog author="sndirsch@suse.com" date="1601380800">- update to 20.2.0
  * includes Intel Rocket Lake Platform Support
    (jsc#SLE/SLE-12880, jsc#SLE/SLE-12882)
- adjusted/refreshed patches:
  * n_add-Mesa-headers-again.patch
  * n_drirc-disable-rgb10-for-chromium-on-amd.patch
  * u_dep_xcb.patch
- docs now available in .rst format (html before)</changelog>
  <changelog author="sndirsch@suse.com" date="1601467200">- U_fix-mpeg1_2-decode-mesa-20.2.patch
  * additional patch currently needed for Mesa 20.2 (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602676800">- update to 20.2.1
  * first bugfix release for the 20.2 branch
- supersedes U_fix-mpeg1_2-decode.patch
- disabled U_fix-mpeg1_2-decode-mesa-20.2.patch; likely no longer
  needed (boo#1173185)</changelog>
  <changelog author="sndirsch@suse.com" date="1602763200">- reenabled U_fix-mpeg1_2-decode-mesa-20.2.patch due to regression
  reported in boo#1173185</changelog>
  <changelog author="sndirsch@suse.com" date="1604750400">- update to 20.2.2
  * second bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606132800">- update to 20.2.3
  * third bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1606651200">- enabled build of radeonsi DRI and VDPAU driver on aarch64
  (boo#1179376)</changelog>
  <changelog author="sndirsch@suse.com" date="1606737600">- use llvm11 on factory/TW and sle15-sp3/Leap 15.3</changelog>
  <changelog author="sndirsch@suse.com" date="1606824000">- require llvm-devel *without* any explicit version number for
  factory/TW to imply 'distro default llvm version', which we
  usually bump up when a new stable llvm comes out</changelog>
  <changelog author="sndirsch@suse.com" date="1607342400">- update to 20.2.4
  * fourth (second to last) bugfix release for the 20.2 branch</changelog>
  <changelog author="sndirsch@suse.com" date="1656936000">- change default driver from 'iris' back to 'i965' for Intel
  Gen8-11 hardware; that way we also use the same driver used by X
  and Mesa (boo#1200965); related bugs: boo#1197045, boo#1197046</changelog>
  <changelog author="sndirsch@suse.com" date="1661860800">- previous change didn't have any effect; default driver for Intel
  Gen8-11 hardware was already "i965" since Mesa 20.x still checked
  for option 'prefer-iris' and gallium iris driver build to make it
  default - which is only true in Mesa-drivers, but not in Mesa
  build; let's just remove this confusing "-Dprefer-iris=false"
  option (boo#1202850, comment#29)</changelog>
</package>
<package pkgid="c381e522217179fe9fbad04e97b22b9686f1f31d72ffc0bb68bbb193d66c7a2b" name="libgcc_s1" arch="aarch64">
  <version epoch="0" ver="11.3.0+git1637" rel="150000.1.11.2"/>
  <changelog author="rguenther@suse.com" date="1625832000">- Add BuildRequires on netcfg for the testsuite when testing Go.</changelog>
  <changelog author="schwab@suse.de" date="1626696000">- Remove bits/unistd_ext.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1626868800">- Properly adjust GPL-3.0 WITH GCC-exception-3.1 to
  GPL-3.0-or-later WITH GCC-exception-3.1</changelog>
  <changelog author="rguenther@suse.com" date="1626868801">- Update to gcc-11 branch head (076930b9690ac3564638636f6b), git536
  * Includes GCC 11.2 RC1.
- Refresh gcc10-foffload-default.patch</changelog>
  <changelog author="rguenther@suse.com" date="1629115200">- Update to gcc-11 branch head (056e324ce46a7924b5cf10f610), git610
  * Includes GCC 11.2 release
  * Includes fix for opie build with glibc 2.34  [boo#1188623]</changelog>
  <changelog author="schwab@suse.de" date="1629288000">- Require libgccjit%{libgccjit_sover}%{libgccjit_suffix} from
  libgccjit%{libgccjit_sover}-devel%{libdevel_suffix}.</changelog>
  <changelog author="matz@suse.com" date="1632139200">- Enable the full cross compiler, cross-aarch64-gcc11 and
  cross-riscv64-gcc11 now provide a fully hosted C (and C++)
  cross compiler, not just a freestanding one.  I.e. with a cross
  glibc.  They don't yet support the sanitizer libraries.
  Part of [jsc#OBS-124].</changelog>
  <changelog author="rguenther@suse.com" date="1634731200">- Remove spurious exit from change_spec.</changelog>
  <changelog author="rguenther@suse.com" date="1637755200">- Update to gcc-11 branch head (7510c23c1ec53aa4a62705f03), git1018
  * fixes issue with debug dumping together with -o /dev/null
  * fixes libgccjit issue showing up in emacs build  [boo#1192951]
- Package mwaitintrin.h</changelog>
  <changelog author="matz@suse.com" date="1637928000">- Enable the cross compilers also on i586
- Enable some cross compilers also in rings
- Remove cross compilers for i386 target</changelog>
  <changelog author="mliska@suse.cz" date="1639569600">- Update to gcc-11 branch head (d4a1d3c4b377f1d4acb), git1173
  * Fix D memory corruption in -M output.
  * Fix ICE in is_this_parameter with coroutines.  [boo#1193659]</changelog>
  <changelog author="schwab@suse.de" date="1642507200">- Remove sys/rseq.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1644408000">- Put libstdc++6-pp Requires on the shared library and drop
  to Recoomends.</changelog>
  <changelog author="rguenther@suse.com" date="1644494400">- Add gcc11-PIE, similar to gcc-PIE but affecting gcc11 [bsc#1195628]</changelog>
  <changelog author="rguenther@suse.com" date="1646222400">- Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
  packages provided by older GCC work.  Add a requires from that
  package to the corresponding libstc++6 package to keep those
  at the same version.  [bsc#1196107]</changelog>
  <changelog author="dmueller@suse.com" date="1646654400">- drop armv5tel, merge arm and armv6hl
- use --with-cpu rather than specifying --with-arch/--with-tune</changelog>
  <changelog author="rguenther@suse.com" date="1647432000">- Update to gcc-11 branch head (6a1150d1524aeda3381b21717), git1406
  * includes change to adjust gnats idea of the target, fixing
    the build of gprbuild.  [bsc#1196861]
- Add gcc11-pr104931.patch to fix miscompile of embedded premake
  in 0ad on i586.  [bsc#1197065]</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit.</changelog>
  <changelog author="rguenther@suse.com" date="1650456000">- Update to gcc-11 branch head (691af15031e00227ba6d5935c), git1635
  * includes gcc11-pr104931.patch
  * includes fix for Firefox ICE  [gcc#105256]</changelog>
  <changelog author="rguenther@suse.com" date="1650542400">- Update to the GCC 11.3.0 release.
  * includes SLS hardening backport on x86_64.  [bsc#1195283]</changelog>
</package>
<package pkgid="c7e826b9aa4264d613e70b52049a0698b3419369d31ea815872d3fc115b26a8c" name="libgcc_s1" arch="x86_64">
  <version epoch="0" ver="11.3.0+git1637" rel="150000.1.11.2"/>
  <changelog author="rguenther@suse.com" date="1625832000">- Add BuildRequires on netcfg for the testsuite when testing Go.</changelog>
  <changelog author="schwab@suse.de" date="1626696000">- Remove bits/unistd_ext.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1626868800">- Properly adjust GPL-3.0 WITH GCC-exception-3.1 to
  GPL-3.0-or-later WITH GCC-exception-3.1</changelog>
  <changelog author="rguenther@suse.com" date="1626868801">- Update to gcc-11 branch head (076930b9690ac3564638636f6b), git536
  * Includes GCC 11.2 RC1.
- Refresh gcc10-foffload-default.patch</changelog>
  <changelog author="rguenther@suse.com" date="1629115200">- Update to gcc-11 branch head (056e324ce46a7924b5cf10f610), git610
  * Includes GCC 11.2 release
  * Includes fix for opie build with glibc 2.34  [boo#1188623]</changelog>
  <changelog author="schwab@suse.de" date="1629288000">- Require libgccjit%{libgccjit_sover}%{libgccjit_suffix} from
  libgccjit%{libgccjit_sover}-devel%{libdevel_suffix}.</changelog>
  <changelog author="matz@suse.com" date="1632139200">- Enable the full cross compiler, cross-aarch64-gcc11 and
  cross-riscv64-gcc11 now provide a fully hosted C (and C++)
  cross compiler, not just a freestanding one.  I.e. with a cross
  glibc.  They don't yet support the sanitizer libraries.
  Part of [jsc#OBS-124].</changelog>
  <changelog author="rguenther@suse.com" date="1634731200">- Remove spurious exit from change_spec.</changelog>
  <changelog author="rguenther@suse.com" date="1637755200">- Update to gcc-11 branch head (7510c23c1ec53aa4a62705f03), git1018
  * fixes issue with debug dumping together with -o /dev/null
  * fixes libgccjit issue showing up in emacs build  [boo#1192951]
- Package mwaitintrin.h</changelog>
  <changelog author="matz@suse.com" date="1637928000">- Enable the cross compilers also on i586
- Enable some cross compilers also in rings
- Remove cross compilers for i386 target</changelog>
  <changelog author="mliska@suse.cz" date="1639569600">- Update to gcc-11 branch head (d4a1d3c4b377f1d4acb), git1173
  * Fix D memory corruption in -M output.
  * Fix ICE in is_this_parameter with coroutines.  [boo#1193659]</changelog>
  <changelog author="schwab@suse.de" date="1642507200">- Remove sys/rseq.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1644408000">- Put libstdc++6-pp Requires on the shared library and drop
  to Recoomends.</changelog>
  <changelog author="rguenther@suse.com" date="1644494400">- Add gcc11-PIE, similar to gcc-PIE but affecting gcc11 [bsc#1195628]</changelog>
  <changelog author="rguenther@suse.com" date="1646222400">- Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
  packages provided by older GCC work.  Add a requires from that
  package to the corresponding libstc++6 package to keep those
  at the same version.  [bsc#1196107]</changelog>
  <changelog author="dmueller@suse.com" date="1646654400">- drop armv5tel, merge arm and armv6hl
- use --with-cpu rather than specifying --with-arch/--with-tune</changelog>
  <changelog author="rguenther@suse.com" date="1647432000">- Update to gcc-11 branch head (6a1150d1524aeda3381b21717), git1406
  * includes change to adjust gnats idea of the target, fixing
    the build of gprbuild.  [bsc#1196861]
- Add gcc11-pr104931.patch to fix miscompile of embedded premake
  in 0ad on i586.  [bsc#1197065]</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit.</changelog>
  <changelog author="rguenther@suse.com" date="1650456000">- Update to gcc-11 branch head (691af15031e00227ba6d5935c), git1635
  * includes gcc11-pr104931.patch
  * includes fix for Firefox ICE  [gcc#105256]</changelog>
  <changelog author="rguenther@suse.com" date="1650542400">- Update to the GCC 11.3.0 release.
  * includes SLS hardening backport on x86_64.  [bsc#1195283]</changelog>
</package>
<package pkgid="73e6dac3ac8dfa163a8b4a3c283fd7e28c824cdbe7d8011f046fbe3e72d19405" name="libgcc_s1" arch="aarch64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="1263d90280698c7d15339543715c564b6cff3af739533dcb4991ca48815f18e3" name="libgcc_s1" arch="x86_64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="d6a363f4e2507ff63cbcc6acb38f6567d97adb8378be4508a965dbe34e5a5c6a" name="libgdk_pixbuf-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.40.0" rel="150200.3.6.1"/>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Update to version 2.36.10:
  + build: meson build improvements.
  + build: win32 build fixes.
  + tests: show error before failing (bgo#786259).
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
</package>
<package pkgid="7596ae3ed50180124eb55c05c7d91aeea961f0031829134c4142fa7b4fee8f27" name="libgdk_pixbuf-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.40.0" rel="150200.3.6.1"/>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Update to version 2.36.10:
  + build: meson build improvements.
  + build: win32 build fixes.
  + tests: show error before failing (bgo#786259).
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
</package>
<package pkgid="d24458fbef98673b07e4cb14b75806aa5d1776f67d78bc641234c1728a836d07" name="libgdk_pixbuf-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.40.0" rel="150200.3.9.1"/>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
  <changelog author="mgorse@suse.com" date="1661860800">- Add gdk-pixbuf-CVE_2021-44648.patch: check for maximum LZW code
  size (boo#1194633 CVE-2021-44648). Also add
  gdk_pixbuf_new_tests.tar.xz for some new gif tests.</changelog>
</package>
<package pkgid="555d520730ce4cec924f23158e38389fa991eb74737f3e56833e6323c97fe5fd" name="libgdk_pixbuf-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.40.0" rel="150200.3.9.1"/>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
  <changelog author="mgorse@suse.com" date="1661860800">- Add gdk-pixbuf-CVE_2021-44648.patch: check for maximum LZW code
  size (boo#1194633 CVE-2021-44648). Also add
  gdk_pixbuf_new_tests.tar.xz for some new gif tests.</changelog>
</package>
<package pkgid="25a71f19c2bdb26ca9fac58265b002cfeaeddd00a6097e14890f4378032e15ef" name="libgio-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="4a71984f0ef47a123179051ffb0930eb955d8eca8ba70c3e46322d77651c6929" name="libgio-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="6e9302ace061a74e4a2d8b2d5132473b78e485dba383b519c3d7fba57bec92fa" name="libglib-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="7fe871e183ffb5d402e274dd772a90d76b309a3b1529737d631e42576bf5ed28" name="libglib-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="7625d69c06b1cfb9b713d533e9de14221cd4381ea55ca2066374cd624c8c1015" name="libgmodule-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="3368e9e46b669583448d1d859f2cb252593d3a0f0b9bb8603409d8bc23e2b7f5" name="libgmodule-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="0325dd92acef3bd177bcbba6276e84c15f5bc96b8c74688c35f97ca14c5ac8c7" name="libgnutls30" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.19.2"/>
  <changelog author="vcizek@suse.com" date="1558008000">- Explicitly require libnettle 3.4.1 (bsc#1134856)
  * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order
    to fix CVE-2018-16868, the new implementation makes use of a new
    rsa_sec_decrypt() function introduced in libnettle 3.4.1
  * libnettle was recently updated to the 3.4.1 version but we need
    to add explicit dependency on it to prevent missing symbol errors
    with the older versions</changelog>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
</package>
<package pkgid="0e9088d6ba4c48c9a32314ec159ebe309d12835ee89a8f4b0b7b1c8f58e48d3f" name="libgnutls30" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.19.2"/>
  <changelog author="vcizek@suse.com" date="1558008000">- Explicitly require libnettle 3.4.1 (bsc#1134856)
  * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order
    to fix CVE-2018-16868, the new implementation makes use of a new
    rsa_sec_decrypt() function introduced in libnettle 3.4.1
  * libnettle was recently updated to the 3.4.1 version but we need
    to add explicit dependency on it to prevent missing symbol errors
    with the older versions</changelog>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
</package>
<package pkgid="a804f8d493b177342e9a3623ae32fc57dd4c1e173b7526538741f7a86d2bb3fe" name="libgnutls30" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.22.1"/>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
</package>
<package pkgid="8858adea859539325350cc4c7634976c7b4dc0be7736485d7d478a325d1a7ad3" name="libgnutls30" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.22.1"/>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
</package>
<package pkgid="89c5674c651ed3d03f4a6341aa24be3a9f352b664224fec767a795d0c0b8c7b6" name="libgnutls30" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.25.2"/>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676548800">- Security Fix: [bsc#1208143, CVE-2023-0361]
  * Bleichenbacher oracle in TLS RSA key exchange
  * Add gnutls-CVE-2023-0361.patch</changelog>
</package>
<package pkgid="b4c89ac17f61e85a6f984341579316613c2d3caab36a1d06392bd4ce958ec047" name="libgnutls30" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.25.2"/>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676548800">- Security Fix: [bsc#1208143, CVE-2023-0361]
  * Bleichenbacher oracle in TLS RSA key exchange
  * Add gnutls-CVE-2023-0361.patch</changelog>
</package>
<package pkgid="5dc65022bbad44ee7b40407b1742666f19b90453853ea4d23fab8c302437560f" name="libgnutls30-hmac" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.19.2"/>
  <changelog author="vcizek@suse.com" date="1558008000">- Explicitly require libnettle 3.4.1 (bsc#1134856)
  * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order
    to fix CVE-2018-16868, the new implementation makes use of a new
    rsa_sec_decrypt() function introduced in libnettle 3.4.1
  * libnettle was recently updated to the 3.4.1 version but we need
    to add explicit dependency on it to prevent missing symbol errors
    with the older versions</changelog>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
</package>
<package pkgid="604e2a5be0be53484f6c80256f5c62a866df14d338c9bc95c7c0b0819b653a65" name="libgnutls30-hmac" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.19.2"/>
  <changelog author="vcizek@suse.com" date="1558008000">- Explicitly require libnettle 3.4.1 (bsc#1134856)
  * The RSA decryption code was rewritten in GnuTLS 3.6.5 in order
    to fix CVE-2018-16868, the new implementation makes use of a new
    rsa_sec_decrypt() function introduced in libnettle 3.4.1
  * libnettle was recently updated to the 3.4.1 version but we need
    to add explicit dependency on it to prevent missing symbol errors
    with the older versions</changelog>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
</package>
<package pkgid="24d1bd5df2f1dcc60369ca0345d794938d849d93c19c3b820ac0675f002bfb1d" name="libgnutls30-hmac" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.22.1"/>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
</package>
<package pkgid="8231d291674f1096323af4d2130c64967b04f2ba5d1f9de238fbe1f4d44d88de" name="libgnutls30-hmac" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.22.1"/>
  <changelog author="vcizek@suse.com" date="1569326400">- Install checksums for binary integrity verification which are
  required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)</changelog>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
</package>
<package pkgid="f8a7c8189238a0a407dde7b2b90ea020cb2a0afd1de91085584b9ac2df5cb380" name="libgnutls30-hmac" arch="aarch64">
  <version epoch="0" ver="3.6.7" rel="150200.14.25.2"/>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676548800">- Security Fix: [bsc#1208143, CVE-2023-0361]
  * Bleichenbacher oracle in TLS RSA key exchange
  * Add gnutls-CVE-2023-0361.patch</changelog>
</package>
<package pkgid="ddc075329d2e9912c47d2ae89a528551742df1f1995cb23466f4be0e8ba1e29f" name="libgnutls30-hmac" arch="x86_64">
  <version epoch="0" ver="3.6.7" rel="150200.14.25.2"/>
  <changelog author="jsikes@suse.com" date="1584964800">- bsc#1155327 jira#SLE-9518 - FIPS: add DH key test
  * Added Diffie Hellman public key verification test.
  * gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1584964801">- bsc#1166881 - FIPS: gnutls: cfb8 decryption issue
  * No longer truncate output IV if input is shorter than block size.
  * Added gnutls-3.6.7-fips-backport_dont_truncate_output_IV.patch</changelog>
  <changelog author="vcizek@suse.com" date="1585569600">- Split off FIPS checksums into a separate libgnutls30-hmac
  subpackage (bsc#1152692)
  * update baselibs.conf</changelog>
  <changelog author="vcizek@suse.com" date="1585828800">- Fix zero random value in DTLS client hello
  (CVE-2020-11501, bsc#1168345)
  * add gnutls-CVE-2020-11501.patch</changelog>
  <changelog author="vcizek@suse.com" date="1586260800">- Backport AES XTS support (bsc#1168835)
  * add 0001-Vendor-in-XTS-functionality-from-Nettle.patch
  * add gnutls-fips_XTS_key_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1587470400">- Don't check for /etc/system-fips which we don't have (bsc#1169992)
  * add gnutls-fips_mode_enabled.patch</changelog>
  <changelog author="abergmann@suse.com" date="1589198400">- Add RSA 4096 key generation support in FIPS mode (bsc#1171422)
  * add gnutls-3.6.7-fips-rsa-4096.patch</changelog>
  <changelog author="vcizek@suse.com" date="1591272000">- GNUTLS-SA-2020-06-03 (Fixed insecure session ticket key construction)
  The TLS server would not bind the session ticket encryption key with a
  value supplied by the application until the initial key rotation, allowing
  attacker to bypass authentication in TLS 1.3 and recover previous
  conversations in TLS 1.2 (#1011). (bsc#1172506, CVE-2020-13777)
  * add patches:
    + gnutls-CVE-2020-13777.patch
- Fixed handling of certificate chain with cross-signed intermediate
  CA certificates (#1008). (bsc#1172461)
  * add patches:
    +  0001-_gnutls_verify_crt_status-apply-algorithm-checks-to-.patch
    +  0002-_gnutls_pkcs11_verify_crt_status-check-validity-agai.patch
    +  0003-x509-trigger-fallback-verification-path-when-cert-is.patch
    +  0004-tests-add-test-case-for-certificate-chain-supersedin.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084800">- FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
- add patches
  * 0001-Add-Full-Public-Key-Check-for-DH.patch
  * 0001-Add-test-to-ensure-DH-exchange-behaves-correctly.patch
  * 0002-Add-test-to-ensure-ECDH-exchange-behaves-correctly.patch
  * 0003-Add-plumbing-to-handle-Q-parameter-in-DH-exchanges.patch
  * 0004-Always-pass-in-and-check-Q-in-TLS-1.3.patch
  * 0005-Check-Q-for-FFDHE-primes-in-prime-check.patch
  * 0006-Pass-down-Q-for-FFDHE-in-al-pre-TLS1.3-as-well.patch
  * 0001-dh-primes-add-MODP-primes-from-RFC-3526.patch
  * 0002-dhe-check-if-DH-params-in-SKE-match-the-FIPS-approve.patch
  * 0001-dh-check-validity-of-Z-before-export.patch
  * 0002-ecdh-check-validity-of-P-before-export.patch
  * 0003-dh-primes-make-the-FIPS-approved-check-return-Q-valu.patch
  * 0004-dh-perform-SP800-56A-rev3-full-pubkey-validation-on-.patch
  * 0005-ecdh-perform-SP800-56A-rev3-full-pubkey-validation-o.patch
- drop obsolete gnutls-3.6.7-fips_DH_ECDH_key_tests.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600084801">- Fix heap buffer overflow in handshake with no_renegotiation alert sent
  * CVE-2020-24659 (bsc#1176181)
- add gnutls-CVE-2020-24659.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600344000">- FIPS: Add TLS KDF selftest (bsc#1176671)
  * add gnutls-FIPS-TLS_KDF_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1600430400">- FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
  * add gnutls-FIPS-use_2048_bit_prime_in_DH_selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1605873600">- Avoid spurious audit messages about incompatible signature algorithms
  (bsc#1172695)
  * add 0001-pubkey-avoid-spurious-audit-messages-from-_gnutls_pu.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809600">- Security fix: [bsc#1183457, CVE-2021-20231]
  * A use after free issue in client sending key_share extension
    may lead to memory corruption and other consequences.
- Add gnutls-CVE-2021-20231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1615809601">- Security fix: [bsc#1183456, CVE-2021-20232]
  * A use after free issue in client_send_params
    in lib/ext/pre_shared_key.c may lead to memory
    corruption and other potential consequences.
- Add gnutls-CVE-2021-20232.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1621944000">- Add gnutls-3.6.7-fix-FTBFS-2024.patch to let tests pass after 2024 (boo#1186579)
- Add gnutls-3.6.7-reproducible-date.patch to override build date (boo#1047218)</changelog>
  <changelog author="pmonreal@suse.com" date="1645444800">- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1659441600">- Security fix: [bsc#1202020, CVE-2022-2509]
  * Fixed double free during verification of pkcs7 signatures
  * Add gnutls-CVE-2022-2509.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668168000">- Validate input when calling fmemopen() [bsc#1204511]
  * Add gnutls-check-system_priority_buf-input.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676548800">- Security Fix: [bsc#1208143, CVE-2023-0361]
  * Bleichenbacher oracle in TLS RSA key exchange
  * Add gnutls-CVE-2023-0361.patch</changelog>
</package>
<package pkgid="304d54885b7cae0b21a7acb8331a0d07139165b5312fc2c5f16d6d8bc6362be4" name="libgobject-2_0-0" arch="aarch64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="002ad700e816e7a8891e116c7ba4285662af3f00d368ddcce4d531e4d0564aa9" name="libgobject-2_0-0" arch="x86_64">
  <version epoch="0" ver="2.62.6" rel="150200.3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1560254400">- Update to version 2.60.4:
  + Fixes to improved network status detection with NetworkManager.
  + Leak fixes to some `glib-genmarshal` generated code.
  + Further fixes to the Happy Eyeballs (RFC 8305) implementation.
  + File system permissions fix to clamp down permissions in a
    small time window when copying files (CVE-2019-12450).
  + Bugs fixed: glgo#GNOME/GLib#1755, glgo#GNOME/GLib#1788,
    glgo#GNOME/GLib#1792, glgo#GNOME/GLib#1793,
    glgo#GNOME/GLib#1795, glgo#GNOME/GLib!865, glgo#GNOME/GLib!878.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562673600">- Update to version 2.60.5:
  + Fix implicit use of the `GKeyfileSettingsBackend`.
  + Fix opening a URI using the ?Open URI? portal.
  + Bugs fixed: glgo#GNOME/GLib!910, glgo#GNOME/GLib!949,
    glgo#GNOME/GLib!956, glgo#GNOME/GLib!958, glgo#GNOME/GLib!969,
    glgo#GNOME/GLib!977.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Add glib2-keyfile-handle-filename-being-null.patch: key file:
  Handle filename being NULL (glgo#GNOME/GLib!1825,
  glgo#GNOME/GLib#984).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563969600">- Update to version 2.60.6:
  + Fix various bugs with use of the `GKeyfileSettingsBackend`
    within flatpaks (glgo#GNOME/GLib!984, glgo#GNOME/GLib!985,
    glgo#GNOME/GLib#1825).
  + Bugs fixed: glgo#GNOME/GLib!993, glgo#GNOME/GLib!984,
    glgo#GNOME/GLib!985.
- Drop glib2-keyfile-handle-filename-being-null.patch: Fixed
  upstream.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Update to version 2.60.7:
  + Bugs fixed: glgo#GNOME/GLib#1819, glgo#GNOME/GLib#1847,
    glgo#GNOME/GLib!1012, glgo#GNOME/GLib!1013,
    glgo#GNOME/GLib!1061, glgo#GNOME/GLib!1065,
    glgo#GNOME/GLib!1081.</changelog>
  <changelog author="dimstar@opensuse.org" date="1567425601">- Update to version 2.61.2:
  + Add various new array functions (#236, #269, #373).
  + Rework how D-Bus connections are closed/unreffed when
    `g_test_dbus_down()` is called. Tests which leak a
    `GDBusConnection` may now time out and abort, rather than
    silently leaking. (#787)
  + Add a deprecation macro for GLib macros, and use it;
    third-party uses of long-deprecated GLib macros may now start
    causing warnings. (#1060).
  + Deprecate `GTime` and `GTimeVal`, and various functions which
    use them. Use `GDateTime` and `guint64` UNIX timestamps
    instead.
  + Stop using `G_DISABLE_DEPRECATED` to allow disabling
    deprecation warnings; third-party code should now be using
    `GLIB_VERSION_{MIN_REQUIRED, MAX_ALLOWED}` to control symbol
    usage.
  + Improve `GNetworkMonitor` detection of offline states (#1788).
  + Fix CVE-2019-12450, wide permissions of files when copying
    using GIO.
- Changes from version 2.61.1:
  + Upgrade to Unicode Character Database v12.1.
  + Improve network availability detection with NetworkManager to
    treat lower levels of connectivity as having reduced
    availability.
- Changes from version 2.61.0:
  + Add coloured output support to `gdbus introspect.
  + Updated translations.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 2.61.3:
  + Support setting thread name on BSD systems.
  + Install previously-uninstalled headers for public
    `GNativeSocketAddress` object.
  + Very initial support for Windows apps (UWP).
  + Add various new valgrind suppressions to `glib.supp`.
  + Bugs fixed: glgo#GNOME/GLib!83, glgo#GNOME/GLib!512,
    glgo#GNOME/GLib!873, glgo#GNOME/GLib!905, glgo#GNOME/GLib!1057,
    glgo#GNOME/GLib!1309, glgo#GNOME/GLib!1620,
    glgo#GNOME/GLib!1761, glgo#GNOME/GLib!1803,
    glgo#GNOME/GLib!1819, glgo#GNOME/GLib!1852,
    glgo#GNOME/GLib!1854, glgo#GNOME/GLib!1860,
    glgo#GNOME/GLib!1863, glgo#GNOME/GLib!1867,
    glgo#GNOME/GLib!1870, glgo#GNOME/GLib!1879,
    glgo#GNOME/GLib!1880, glgo#GNOME/GLib!1881,
    glgo#GNOME/GLib!1002, glgo#GNOME/GLib!1011,
    glgo#GNOME/GLib!1015, glgo#GNOME/GLib!1016,
    glgo#GNOME/GLib!1017, glgo#GNOME/GLib!1023,
    glgo#GNOME/GLib!1026, glgo#GNOME/GLib!1027,
    glgo#GNOME/GLib!1031, glgo#GNOME/GLib!1032,
    glgo#GNOME/GLib!1033, glgo#GNOME/GLib!1034,
    glgo#GNOME/GLib!1036, glgo#GNOME/GLib!1037,
    glgo#GNOME/GLib!1044, glgo#GNOME/GLib!1049,
    glgo#GNOME/GLib!1050, glgo#GNOME/GLib!1054,
    glgo#GNOME/GLib!1057, glgo#GNOME/GLib!1059,
    glgo#GNOME/GLib!1066, glgo#GNOME/GLib!1068,
    glgo#GNOME/GLib!1071, glgo#GNOME/GLib!1074,
    glgo#GNOME/GLib!1075.</changelog>
  <changelog author="luke@ljones.dev" date="1567684801">- Update to version 2.62.0:
  + Fix new `GFileInfo` APIs to work when
    `G_FILE_ATTRIBUTE_TIME_MODIFIED_USEC` was not queried.
  + Bugs fixed: glgo#GNOME/GLib#487, glgo#GNOME/GLib!1084,
    glgo#GNOME/GLib!1086,glgo#GNOME/GLib!1087.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 2.62.1:
  + Fix regression in g_file_copy() when passing
    `G_FILE_COPY_TARGET_DEFAULT_PERMS` flag; the destination
    permissions would be private rather than following the process?
    umask.
  + Several `GDateTime` parsing fixes.
  + Always build the tests if installed-tests are enabled, so that
    the tests can actually be installed.
  + Bugs fixed: glgo#GNOME/GLib#174, glgo#GNOME/GLib#1865,
    glgo#GNOME/GLib#1875, glgo#GNOME/GLib#1887,
    glgo#GNOME/GLib#1888, glgo#GNOME/GLib!1021,
    glgo#GNOME/GLib!1094, glgo#GNOME/GLib!1101,
    glgo#GNOME/GLib!1102, glgo#GNOME/GLib!1103,
    glgo#GNOME/GLib!1127, glgo#GNOME/GLib!1128,
    glgo#GNOME/GLib!1140, glgo#GNOME/GLib!1141,
    glgo#GNOME/GLib!1142.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571659200">- Update to version 2.62.2:
  + Bugs fixed:
  - glgo#GNOME/GLib#1896: Use after free when calling
    g_dbus_connection_flush_sync() in a dedicated thread.
  - glgo#GNOME/GLib!1154: Backport glgo#GNOME/GLib!1152
    ?gwinhttpvfs: Handle g_get_prgname() returning NULL? to
    glib-2-62.
  - glgo#GNOME/GLib!1156: Backport glgo#GNOME/GLib!1146 Solaris
    fixes to glib-2-62.</changelog>
  <changelog author="mgorse@suse.com" date="1572955200">- Re-enable systemtap, and require systemtap-headers and
  systemtap-dtrace, rather than systemtap-sdt-devel, to avoid build
  cycle (boo#1145438).
- Own /usr/share/systemtap{|tapset} directories, since we no
  longer have systemtap-sdt-devel in BuildRequires.
- Disable lto if systemtap is enabled: build fails otherwise.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574164800">- Update to version 2.62.3:
  + Use `poll()` in `g_spawn_sync()` rather than `select()`, which
    is subject to FD limits.
  + Fix undefined behaviour with `g_utf8_find_prev_char()`.
  + Bugs fixed: glgo#GNOME/GLib#954, glgo#GNOME/GLib#1318,
    glgo#GNOME/GLib#1897, glgo#GNOME/GLib#1903,
    glgo#GNOME/GLib#1916, glgo#GNOME/GLib#1917,
    glgo#GNOME/GLib!1174, glgo#GNOME/GLib!1184,
    glgo#GNOME/GLib!1194, glgo#GNOME/GLib!1203,
    glgo#GNOME/GLib!1207, glgo#GNOME/GLib!1215,
    glgo#GNOME/GLib!1219, glgo#GNOME/GLib!1222,
    glgo#GNOME/GLib!1228.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576756800">- Update to version 2.62.4:
  + Apply recursion depth limits to variants in D-Bus messages.
  + Bugs fixed: glgo#GNOME/GLib#1938, glgo#GNOME/GLib!1240,
    glgo#GNOME/GLib!1257, glgo#GNOME/GLib!1266,
    glgo#GNOME/GLib!1276, glgo#GNOME/GLib!1290.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 2.62.5:
  + Fix potential relative read when calling g_printerr(), which
    could lead to a denial of service from a setuid-root process
    being used to block access to the TTY for another user.
  + Fix SOCKS proxy resolver sometimes not being used when
    resolving addresses via Happy Eyeballs (CVE-2020-6750).
  + Several other Happy Eyeballs fixes for address resolution.
  + Fix parsing of full Julian day range from `$TZ` environment
    variable.
  + Several race condition/crash fixes.
  + Bugs fixed: glgo#GNOME/GLib#1919, glgo#GNOME/GLib#1995,
    glgo#GNOME/GLib#1999, glgo#GNOME/GLib!1323,
    glgo#GNOME/GLib!1331, glgo#GNOME/GLib!1352,
    glgo#GNOME/GLib!1361, glgo#GNOME/GLib!1365,
    glgo#GNOME/GLib!1370, glgo#GNOME/GLib!1371.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584532800">- Update to version 2.62.6:
  + This is expected to be the final release in the 2.62.x stable
    series; maintenance effort will shift to the newer 2.64.x
    stable series now.
  + Fix SOCKS5 username/password authentication.
  + Exception handling fixes on Windows.
  + Bugs fixed: glgo#GNOME/GLib#1986, glgo#GNOME/GLib#1988,
    glgo#GNOME/GLib#2049, glgo#GNOME/GLib!1378,
    glgo#GNOME/GLib!1380, glgo#GNOME/GLib!1393,
    glgo#GNOME/GLib!1394, glgo#GNOME/GLib!1411.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1604664000">- Add patches to support for slim format of timezone (bsc#1178346):
  + glib2-add-support-for-slim-timezone-format.patch: basic support
    for slim format (glgo#GNOME/glib!1533).
  + glib2-fix-6-days-until-the-end-of-the-month.patch: fix DST
    incorrect end day when using slim format
    (glgo#GNOME/glib!1683).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614772800">- Add glib2-CVE-2021-27219-add-g_memdup2.patch: g_memdup takes a
  guint as parameter and sometimes leads into an integer overflow,
  so add a g_memdup2 function which uses gsize to replace it.
  (bsc#1182362, glgo#GNOME/glib!1927, glgo#GNOME/glib!1933,
  glgo#GNOME/glib!1943)</changelog>
  <changelog author="alynx.zhou@suse.com" date="1614859200">- Add glib2-CVE-2021-27218.patch: g_byte_array_new_take takes a
  gsize as length but stores in a guint, this patch will refuse if
  the length is larger than guint. (bsc#1182328,
  glgo#GNOME/glib!1944)</changelog>
  <changelog author="mgorse@suse.com" date="1649851200">- Add glib2-CVE-2021-28153.patch: fix CREATE_REPLACE_DESTINATION
  with symlinks (boo#1183533 glgo#GNOME/glib#2325 CVE-2021-28153).</changelog>
</package>
<package pkgid="682ba381b787a343e92809941d2e9a4f9ca6ad6c7df92dc42a001ba3633de7bb" name="libgpg-error" arch="src">
  <version epoch="0" ver="1.42" rel="150300.9.3.1"/>
  <changelog author="kbabioch@suse.com" date="1520942400">- update to 1.28:
  * The formerly internal yat2m tool is now installed for a native build.
  * The new files gpgrt.m4 and gpgrt-config are now installed. They can
    be used instead of gpg-error.m4 and gpg-error-config.
  * New logging functions similar to those used by GnuPG.
  * New helper functions for platform abstraction.
  * Interface changes</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1521720000">- Backport upstream patch to fix AArch64 build:
  * fix_aarch64.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1523448000">- Update to 1.29:
  * The yat2m tool is during cross-compile now also installed on the
  host platform.
  * New option parser and associated functions similar to the one used
  by GnuPG.
  * New Base-64 encoder.
  * Fixes regression in 1.28 for arm64 and w64 builds.
- Dropped fix_aarch64.patch (included upstream now)</changelog>
  <changelog author="kbabioch@suse.com" date="1523448001">- Cleaned up spec file with spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1524139200">- update signature files as more signatures got added
- refresh package signing keyring from upstream</changelog>
  <changelog author="astieger@suse.com" date="1525089600">- update to 1.30:
  * fixes for platforms other than GNU/Linux
  * Use %license (boo#1082318)</changelog>
  <changelog author="astieger@suse.com" date="1525262400">- update to 1.31:
  * Fixes for platforms other than GNU/Linux
  * New translation for Spanish</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1526126400">- Fix %install_info_delete usage:
  * It has to be performed in %preun not in %postun.
  * See https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#.25install_info_delete.</changelog>
  <changelog author="kbabioch@suse.com" date="1531396800">- Update to 1.32:
  * Fixes a problem with gpgrt_fflush and gpgrt_fopencookie
  * Fixes a problem with the C11 header stdnoreturn.h</changelog>
  <changelog author="astieger@suse.com" date="1544270400">- update to 1.33:
  * New unified config script gpgrt-config
  * The log functions now sanitize strings printed with the "%s"
    format specifier
  * New fprintf style function to apply a custom filter for string
    arguments
  * New function to compare version strings</changelog>
  <changelog author="kbabioch@suse.de" date="1547640000">- update to 1.34:
  * Support for riscv32
  * New API to allow emergency cleanup after internal fatal errors
  * Minor bug and portability fixes</changelog>
  <changelog author="kbabioch@suse.de" date="1548676800">- Update to 1.35:
  * Distribute the correct gpgrt-config</changelog>
  <changelog author="kbabioch@suse.de" date="1552996800">- Update to 1.36:
  * Two new error codes to better support PIV cards
  * Support armv7a-unknown-linux-gnueabihf</changelog>
  <changelog author="tchvatal@suse.com" date="1565956800">- Add patch to fix buidling with gawk 5.0 and newer:
  * gawk5.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1581940800">- Update to 1.37
  Release-info: https://dev.gnupg.org/T4772
  * Fixes a build problems when using Gawk 5.0  [#4459]
  * Improves cross-compiling support.  [#4643]
  * New error codes to map SQLite primary error codes.
  * Now uses poll(2) instead of select(2) in gpgrt_poll if possible.
  * Fixes a bug in gpgrt_close.  [#4698]
  * Fixes a few minor portability bugs.
  * New interfaces in this release:
    GPG_ERR_NO_KEYBOXD    GPG_ERR_KEYBOXD       GPG_ERR_NO_SERVICE
    GPG_ERR_SERVICE       GPG_ERR_SQL_OK        GPG_ERR_SQL_ERROR
    GPG_ERR_SQL_INTERNAL  GPG_ERR_SQL_PERM      GPG_ERR_SQL_ABORT
    GPG_ERR_SQL_BUSY      GPG_ERR_SQL_LOCKED    GPG_ERR_SQL_NOMEM
    GPG_ERR_SQL_READONLY  GPG_ERR_SQL_INTERRUPT GPG_ERR_SQL_IOERR
    GPG_ERR_SQL_CORRUPT   GPG_ERR_SQL_NOTFOUND  GPG_ERR_SQL_FULL
    GPG_ERR_SQL_CANTOPEN  GPG_ERR_SQL_PROTOCOL  GPG_ERR_SQL_EMPTY
    GPG_ERR_SQL_SCHEMA    GPG_ERR_SQL_TOOBIG    GPG_ERR_SQL_CONSTRAINT
    GPG_ERR_SQL_MISMATCH  GPG_ERR_SQL_MISUSE    GPG_ERR_SQL_NOLFS
    GPG_ERR_SQL_AUTH      GPG_ERR_SQL_FORMAT    GPG_ERR_SQL_RANGE
    GPG_ERR_SQL_NOTADB    GPG_ERR_SQL_NOTICE    GPG_ERR_SQL_WARNING
    GPG_ERR_SQL_ROW       GPG_ERR_SQL_DONE
- Remove patch fixed upstream.
  * gawk5.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1590926400">- Update to 1.38:
  * New option parser features to implement system wide
    configuration files
  * New functions to build file names
  * New function to help reallocating arrays
  * Protect gpgrt_inc_errorcount against counter overflow
- drop needless autotools build dependencies that were added for
  gawk5.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Update to 1.39:
  * "gpg-error --lib-version" works again.
  * New function gpgrt_fcancel as alternative to gpgrt_close. This
    function avoid flushing out buffered data and also tries to delete
    a newly created file.
  * Update the gnupg project keyring
  * Interface changes relative to the 1.38 release:
  - gpgrt_fcancel: NEW.</changelog>
  <changelog author="dmueller@suse.com" date="1611576000">- update to 1.41:
  * Fixes another glitch in the "ignore" meta command.
  * Fixes two typos in the German translation.
  * New function gpgrt_access.
  * Make "ignore" meta command work correctly in the option parser.
  * Interface changes relative to the 1.39 release:
  gpgrt_access                     NEW.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1616760000">- update to 1.42:
  * Improve cross-compiling support
  * Improve $libdir determination by gpgrt-config
  * Support --disable-thread by gen-lock-obj.sh
  * Interface changes relative to the 1.40 release
    GPG_ERR_SOURCE_TPM2D</changelog>
  <changelog author="jengelh@inai.de" date="1624017600">- Drop --with-pic (no effect with --disable-static).</changelog>
</package>
<package pkgid="20048a2ff7def9eb2510ece17bf700f1205929bdddc9c60409615e2f41fdefa4" name="libgpg-error0" arch="aarch64">
  <version epoch="0" ver="1.42" rel="150300.9.3.1"/>
  <changelog author="kbabioch@suse.com" date="1520942400">- update to 1.28:
  * The formerly internal yat2m tool is now installed for a native build.
  * The new files gpgrt.m4 and gpgrt-config are now installed. They can
    be used instead of gpg-error.m4 and gpg-error-config.
  * New logging functions similar to those used by GnuPG.
  * New helper functions for platform abstraction.
  * Interface changes</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1521720000">- Backport upstream patch to fix AArch64 build:
  * fix_aarch64.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1523448000">- Update to 1.29:
  * The yat2m tool is during cross-compile now also installed on the
  host platform.
  * New option parser and associated functions similar to the one used
  by GnuPG.
  * New Base-64 encoder.
  * Fixes regression in 1.28 for arm64 and w64 builds.
- Dropped fix_aarch64.patch (included upstream now)</changelog>
  <changelog author="kbabioch@suse.com" date="1523448001">- Cleaned up spec file with spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1524139200">- update signature files as more signatures got added
- refresh package signing keyring from upstream</changelog>
  <changelog author="astieger@suse.com" date="1525089600">- update to 1.30:
  * fixes for platforms other than GNU/Linux
  * Use %license (boo#1082318)</changelog>
  <changelog author="astieger@suse.com" date="1525262400">- update to 1.31:
  * Fixes for platforms other than GNU/Linux
  * New translation for Spanish</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1526126400">- Fix %install_info_delete usage:
  * It has to be performed in %preun not in %postun.
  * See https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#.25install_info_delete.</changelog>
  <changelog author="kbabioch@suse.com" date="1531396800">- Update to 1.32:
  * Fixes a problem with gpgrt_fflush and gpgrt_fopencookie
  * Fixes a problem with the C11 header stdnoreturn.h</changelog>
  <changelog author="astieger@suse.com" date="1544270400">- update to 1.33:
  * New unified config script gpgrt-config
  * The log functions now sanitize strings printed with the "%s"
    format specifier
  * New fprintf style function to apply a custom filter for string
    arguments
  * New function to compare version strings</changelog>
  <changelog author="kbabioch@suse.de" date="1547640000">- update to 1.34:
  * Support for riscv32
  * New API to allow emergency cleanup after internal fatal errors
  * Minor bug and portability fixes</changelog>
  <changelog author="kbabioch@suse.de" date="1548676800">- Update to 1.35:
  * Distribute the correct gpgrt-config</changelog>
  <changelog author="kbabioch@suse.de" date="1552996800">- Update to 1.36:
  * Two new error codes to better support PIV cards
  * Support armv7a-unknown-linux-gnueabihf</changelog>
  <changelog author="tchvatal@suse.com" date="1565956800">- Add patch to fix buidling with gawk 5.0 and newer:
  * gawk5.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1581940800">- Update to 1.37
  Release-info: https://dev.gnupg.org/T4772
  * Fixes a build problems when using Gawk 5.0  [#4459]
  * Improves cross-compiling support.  [#4643]
  * New error codes to map SQLite primary error codes.
  * Now uses poll(2) instead of select(2) in gpgrt_poll if possible.
  * Fixes a bug in gpgrt_close.  [#4698]
  * Fixes a few minor portability bugs.
  * New interfaces in this release:
    GPG_ERR_NO_KEYBOXD    GPG_ERR_KEYBOXD       GPG_ERR_NO_SERVICE
    GPG_ERR_SERVICE       GPG_ERR_SQL_OK        GPG_ERR_SQL_ERROR
    GPG_ERR_SQL_INTERNAL  GPG_ERR_SQL_PERM      GPG_ERR_SQL_ABORT
    GPG_ERR_SQL_BUSY      GPG_ERR_SQL_LOCKED    GPG_ERR_SQL_NOMEM
    GPG_ERR_SQL_READONLY  GPG_ERR_SQL_INTERRUPT GPG_ERR_SQL_IOERR
    GPG_ERR_SQL_CORRUPT   GPG_ERR_SQL_NOTFOUND  GPG_ERR_SQL_FULL
    GPG_ERR_SQL_CANTOPEN  GPG_ERR_SQL_PROTOCOL  GPG_ERR_SQL_EMPTY
    GPG_ERR_SQL_SCHEMA    GPG_ERR_SQL_TOOBIG    GPG_ERR_SQL_CONSTRAINT
    GPG_ERR_SQL_MISMATCH  GPG_ERR_SQL_MISUSE    GPG_ERR_SQL_NOLFS
    GPG_ERR_SQL_AUTH      GPG_ERR_SQL_FORMAT    GPG_ERR_SQL_RANGE
    GPG_ERR_SQL_NOTADB    GPG_ERR_SQL_NOTICE    GPG_ERR_SQL_WARNING
    GPG_ERR_SQL_ROW       GPG_ERR_SQL_DONE
- Remove patch fixed upstream.
  * gawk5.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1590926400">- Update to 1.38:
  * New option parser features to implement system wide
    configuration files
  * New functions to build file names
  * New function to help reallocating arrays
  * Protect gpgrt_inc_errorcount against counter overflow
- drop needless autotools build dependencies that were added for
  gawk5.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Update to 1.39:
  * "gpg-error --lib-version" works again.
  * New function gpgrt_fcancel as alternative to gpgrt_close. This
    function avoid flushing out buffered data and also tries to delete
    a newly created file.
  * Update the gnupg project keyring
  * Interface changes relative to the 1.38 release:
  - gpgrt_fcancel: NEW.</changelog>
  <changelog author="dmueller@suse.com" date="1611576000">- update to 1.41:
  * Fixes another glitch in the "ignore" meta command.
  * Fixes two typos in the German translation.
  * New function gpgrt_access.
  * Make "ignore" meta command work correctly in the option parser.
  * Interface changes relative to the 1.39 release:
  gpgrt_access                     NEW.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1616760000">- update to 1.42:
  * Improve cross-compiling support
  * Improve $libdir determination by gpgrt-config
  * Support --disable-thread by gen-lock-obj.sh
  * Interface changes relative to the 1.40 release
    GPG_ERR_SOURCE_TPM2D</changelog>
  <changelog author="jengelh@inai.de" date="1624017600">- Drop --with-pic (no effect with --disable-static).</changelog>
</package>
<package pkgid="56d87a2991fa895d58112f6a8290a9dbdfab842376152baa8ab246c1f318190e" name="libgpg-error0" arch="x86_64">
  <version epoch="0" ver="1.42" rel="150300.9.3.1"/>
  <changelog author="kbabioch@suse.com" date="1520942400">- update to 1.28:
  * The formerly internal yat2m tool is now installed for a native build.
  * The new files gpgrt.m4 and gpgrt-config are now installed. They can
    be used instead of gpg-error.m4 and gpg-error-config.
  * New logging functions similar to those used by GnuPG.
  * New helper functions for platform abstraction.
  * Interface changes</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1521720000">- Backport upstream patch to fix AArch64 build:
  * fix_aarch64.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1523448000">- Update to 1.29:
  * The yat2m tool is during cross-compile now also installed on the
  host platform.
  * New option parser and associated functions similar to the one used
  by GnuPG.
  * New Base-64 encoder.
  * Fixes regression in 1.28 for arm64 and w64 builds.
- Dropped fix_aarch64.patch (included upstream now)</changelog>
  <changelog author="kbabioch@suse.com" date="1523448001">- Cleaned up spec file with spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1524139200">- update signature files as more signatures got added
- refresh package signing keyring from upstream</changelog>
  <changelog author="astieger@suse.com" date="1525089600">- update to 1.30:
  * fixes for platforms other than GNU/Linux
  * Use %license (boo#1082318)</changelog>
  <changelog author="astieger@suse.com" date="1525262400">- update to 1.31:
  * Fixes for platforms other than GNU/Linux
  * New translation for Spanish</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1526126400">- Fix %install_info_delete usage:
  * It has to be performed in %preun not in %postun.
  * See https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#.25install_info_delete.</changelog>
  <changelog author="kbabioch@suse.com" date="1531396800">- Update to 1.32:
  * Fixes a problem with gpgrt_fflush and gpgrt_fopencookie
  * Fixes a problem with the C11 header stdnoreturn.h</changelog>
  <changelog author="astieger@suse.com" date="1544270400">- update to 1.33:
  * New unified config script gpgrt-config
  * The log functions now sanitize strings printed with the "%s"
    format specifier
  * New fprintf style function to apply a custom filter for string
    arguments
  * New function to compare version strings</changelog>
  <changelog author="kbabioch@suse.de" date="1547640000">- update to 1.34:
  * Support for riscv32
  * New API to allow emergency cleanup after internal fatal errors
  * Minor bug and portability fixes</changelog>
  <changelog author="kbabioch@suse.de" date="1548676800">- Update to 1.35:
  * Distribute the correct gpgrt-config</changelog>
  <changelog author="kbabioch@suse.de" date="1552996800">- Update to 1.36:
  * Two new error codes to better support PIV cards
  * Support armv7a-unknown-linux-gnueabihf</changelog>
  <changelog author="tchvatal@suse.com" date="1565956800">- Add patch to fix buidling with gawk 5.0 and newer:
  * gawk5.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1581940800">- Update to 1.37
  Release-info: https://dev.gnupg.org/T4772
  * Fixes a build problems when using Gawk 5.0  [#4459]
  * Improves cross-compiling support.  [#4643]
  * New error codes to map SQLite primary error codes.
  * Now uses poll(2) instead of select(2) in gpgrt_poll if possible.
  * Fixes a bug in gpgrt_close.  [#4698]
  * Fixes a few minor portability bugs.
  * New interfaces in this release:
    GPG_ERR_NO_KEYBOXD    GPG_ERR_KEYBOXD       GPG_ERR_NO_SERVICE
    GPG_ERR_SERVICE       GPG_ERR_SQL_OK        GPG_ERR_SQL_ERROR
    GPG_ERR_SQL_INTERNAL  GPG_ERR_SQL_PERM      GPG_ERR_SQL_ABORT
    GPG_ERR_SQL_BUSY      GPG_ERR_SQL_LOCKED    GPG_ERR_SQL_NOMEM
    GPG_ERR_SQL_READONLY  GPG_ERR_SQL_INTERRUPT GPG_ERR_SQL_IOERR
    GPG_ERR_SQL_CORRUPT   GPG_ERR_SQL_NOTFOUND  GPG_ERR_SQL_FULL
    GPG_ERR_SQL_CANTOPEN  GPG_ERR_SQL_PROTOCOL  GPG_ERR_SQL_EMPTY
    GPG_ERR_SQL_SCHEMA    GPG_ERR_SQL_TOOBIG    GPG_ERR_SQL_CONSTRAINT
    GPG_ERR_SQL_MISMATCH  GPG_ERR_SQL_MISUSE    GPG_ERR_SQL_NOLFS
    GPG_ERR_SQL_AUTH      GPG_ERR_SQL_FORMAT    GPG_ERR_SQL_RANGE
    GPG_ERR_SQL_NOTADB    GPG_ERR_SQL_NOTICE    GPG_ERR_SQL_WARNING
    GPG_ERR_SQL_ROW       GPG_ERR_SQL_DONE
- Remove patch fixed upstream.
  * gawk5.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1590926400">- Update to 1.38:
  * New option parser features to implement system wide
    configuration files
  * New functions to build file names
  * New function to help reallocating arrays
  * Protect gpgrt_inc_errorcount against counter overflow
- drop needless autotools build dependencies that were added for
  gawk5.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599048000">- Update to 1.39:
  * "gpg-error --lib-version" works again.
  * New function gpgrt_fcancel as alternative to gpgrt_close. This
    function avoid flushing out buffered data and also tries to delete
    a newly created file.
  * Update the gnupg project keyring
  * Interface changes relative to the 1.38 release:
  - gpgrt_fcancel: NEW.</changelog>
  <changelog author="dmueller@suse.com" date="1611576000">- update to 1.41:
  * Fixes another glitch in the "ignore" meta command.
  * Fixes two typos in the German translation.
  * New function gpgrt_access.
  * Make "ignore" meta command work correctly in the option parser.
  * Interface changes relative to the 1.39 release:
  gpgrt_access                     NEW.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1616760000">- update to 1.42:
  * Improve cross-compiling support
  * Improve $libdir determination by gpgrt-config
  * Support --disable-thread by gen-lock-obj.sh
  * Interface changes relative to the 1.40 release
    GPG_ERR_SOURCE_TPM2D</changelog>
  <changelog author="jengelh@inai.de" date="1624017600">- Drop --with-pic (no effect with --disable-static).</changelog>
</package>
<package pkgid="09312218abb67f65db4b27cb69747d17c5ff8b6f1a22c1cc656dd810b5f5a10f" name="libgraphite2-3" arch="aarch64">
  <version epoch="0" ver="1.3.11" rel="150000.4.3.1"/>
  <changelog author="dmueller@suse.com" date="1413892800">- add link-gcc-shared.diff: link -lgcc_s to fix undefined symbols
  on various ARM architectures</changelog>
  <changelog author="fstrba@suse.com" date="1432036800">- Remove unnecessary utf-8  characters from the spec file</changelog>
  <changelog author="tchvatal@suse.com" date="1438948800">- Version bump to 1.3.0:
  * Various tweaks for the arabic fonts
- Added patches:
  * graphite-nonvoid-return.patch
  * graphite2-1.2.0-cmakepath.patch
- Removed patches:
  * no-specific-nunit-version.diff
  * soname.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Version bump to 1.3.1:
  * Deprecation warning: Full bidi support is about to be deprecated. Make
    contact if this impacts you.
  * Change compression block format slightly to conform to LZ4
  * Handle mono direction text with diacritics consistently. Fonts
    now see the direction they expect consistently and bidi now
    gives expected results.
  * Fixed lots of fuzz bugs
  * Coverity cleanups
  * Build now works for clang and/or asan and/or afl etc.</changelog>
  <changelog author="tchvatal@suse.com" date="1441886400">- Version bump top 1.3.2:
  * Remove full bidi. All segments are assumed to be single directioned.
  * Bug fixes:
    + Decompressor corner cases
    + Various fuzz bugs</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- updated to 1.3.3
  * Slight speed up in Collision Avoidance
  * Remove dead bidi code
  * Bug fixes
    . Between pass bidi reorderings and at the end
    . Decompressor fuzz bugs
    . Other fuzz bugs</changelog>
  <changelog author="tchvatal@suse.com" date="1450699200">- Version update to 1.3.4:
  * Fix Collision Kerning ignoring some diacritics
  * Handle pass bits 16-31 to speed up fonts with &gt; 16 passes
  * Various minor fuzz bug fixes
  * Make Coverity happy
  * Add GR_FALLTHROUGH macro for clang c++11
- Upstream moved to github</changelog>
  <changelog author="pgajdos@suse.com" date="1455278400">- updated to 1.3.5 bnc#965803 CVE-2016-1521:
  * Security bug fix
  * Fix ARM misalignment problem
  * Track latest cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1456747200">- Update to 1.3.6
  * This fixes a number of security related bugs. There are no feature
    improvements or bug fixes in this release.</changelog>
  <changelog author="tchvatal@suse.com" date="1464868800">- Version update to 1.3.8:
  * Various bugfixes found by fuzzers</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- Version update to 1.3.9: fixes some bugs in the collision
  avoidance and may give slightly improved results in some cases.</changelog>
  <changelog author="pgajdos@suse.com" date="1493035200">- security update:
  * CVE-2017-5436 [bsc#1035204]
    + graphite2-CVE-2017-5436.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498046400">- Use %ctest macro
- Update license string to lgpl2.1+ and mpl2.0+
- Remove patch graphite2-CVE-2017-5436.patch
- Update to 1.3.10:
  * Upstream marks this as contianing various bugfixes without
    any specific mentions</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Add patches to fix tests when using python3:
  * graphite2-python3_tests.patch
  * graphite2-python3_tests_cornercases.patch
- Refresh all other patches
- Use fancy name for downloaded tarball
- Run spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1512475200">- Make sure we switch to python3 only on SLE15+ and not on SLE12</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Do not BR asciidoc as we do not install the generated html page</changelog>
  <changelog author="schwab@suse.de" date="1518696000">- gcc8.patch: return correct value from stream operator</changelog>
  <changelog author="pgajdos@suse.com" date="1520856000">- Update to 1.3.11:
- removed patches (upstreamed or not needed)
  * gcc8.patch (code commeted out)
  * graphite-nonvoid-return.patch (code commented out)
  * graphite2-python3_tests.patch (upstreamed)
  * graphite2-python3_tests_cornercases.patch (upstreamed
- refreshed patch
  * link-gcc-shared.diff
- fixes security issue: CVE-2018-7999 [bsc#1084850]
  + graphite2-CVE-2018-7999.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1521201600">- Use python3 everywhere
- Drop fonttools test dep as it pulls TON of py3 packages</changelog>
  <changelog author="pgajdos@suse.com" date="1675425600">- fixed license string [bsc#1207676]:
  LGPL-2.1-or-later OR MPL-2.0 OR GPL-2.0-or-later</changelog>
</package>
<package pkgid="1018226950c3f27ffe3fb182658ee2241ebb3d1447aae95854f2df2203f09c20" name="libgraphite2-3" arch="x86_64">
  <version epoch="0" ver="1.3.11" rel="150000.4.3.1"/>
  <changelog author="dmueller@suse.com" date="1413892800">- add link-gcc-shared.diff: link -lgcc_s to fix undefined symbols
  on various ARM architectures</changelog>
  <changelog author="fstrba@suse.com" date="1432036800">- Remove unnecessary utf-8  characters from the spec file</changelog>
  <changelog author="tchvatal@suse.com" date="1438948800">- Version bump to 1.3.0:
  * Various tweaks for the arabic fonts
- Added patches:
  * graphite-nonvoid-return.patch
  * graphite2-1.2.0-cmakepath.patch
- Removed patches:
  * no-specific-nunit-version.diff
  * soname.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Version bump to 1.3.1:
  * Deprecation warning: Full bidi support is about to be deprecated. Make
    contact if this impacts you.
  * Change compression block format slightly to conform to LZ4
  * Handle mono direction text with diacritics consistently. Fonts
    now see the direction they expect consistently and bidi now
    gives expected results.
  * Fixed lots of fuzz bugs
  * Coverity cleanups
  * Build now works for clang and/or asan and/or afl etc.</changelog>
  <changelog author="tchvatal@suse.com" date="1441886400">- Version bump top 1.3.2:
  * Remove full bidi. All segments are assumed to be single directioned.
  * Bug fixes:
    + Decompressor corner cases
    + Various fuzz bugs</changelog>
  <changelog author="pgajdos@suse.com" date="1450267200">- updated to 1.3.3
  * Slight speed up in Collision Avoidance
  * Remove dead bidi code
  * Bug fixes
    . Between pass bidi reorderings and at the end
    . Decompressor fuzz bugs
    . Other fuzz bugs</changelog>
  <changelog author="tchvatal@suse.com" date="1450699200">- Version update to 1.3.4:
  * Fix Collision Kerning ignoring some diacritics
  * Handle pass bits 16-31 to speed up fonts with &gt; 16 passes
  * Various minor fuzz bug fixes
  * Make Coverity happy
  * Add GR_FALLTHROUGH macro for clang c++11
- Upstream moved to github</changelog>
  <changelog author="pgajdos@suse.com" date="1455278400">- updated to 1.3.5 bnc#965803 CVE-2016-1521:
  * Security bug fix
  * Fix ARM misalignment problem
  * Track latest cmake</changelog>
  <changelog author="tchvatal@suse.com" date="1456747200">- Update to 1.3.6
  * This fixes a number of security related bugs. There are no feature
    improvements or bug fixes in this release.</changelog>
  <changelog author="tchvatal@suse.com" date="1464868800">- Version update to 1.3.8:
  * Various bugfixes found by fuzzers</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- Version update to 1.3.9: fixes some bugs in the collision
  avoidance and may give slightly improved results in some cases.</changelog>
  <changelog author="pgajdos@suse.com" date="1493035200">- security update:
  * CVE-2017-5436 [bsc#1035204]
    + graphite2-CVE-2017-5436.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1498046400">- Use %ctest macro
- Update license string to lgpl2.1+ and mpl2.0+
- Remove patch graphite2-CVE-2017-5436.patch
- Update to 1.3.10:
  * Upstream marks this as contianing various bugfixes without
    any specific mentions</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Add patches to fix tests when using python3:
  * graphite2-python3_tests.patch
  * graphite2-python3_tests_cornercases.patch
- Refresh all other patches
- Use fancy name for downloaded tarball
- Run spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1512475200">- Make sure we switch to python3 only on SLE15+ and not on SLE12</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Do not BR asciidoc as we do not install the generated html page</changelog>
  <changelog author="schwab@suse.de" date="1518696000">- gcc8.patch: return correct value from stream operator</changelog>
  <changelog author="pgajdos@suse.com" date="1520856000">- Update to 1.3.11:
- removed patches (upstreamed or not needed)
  * gcc8.patch (code commeted out)
  * graphite-nonvoid-return.patch (code commented out)
  * graphite2-python3_tests.patch (upstreamed)
  * graphite2-python3_tests_cornercases.patch (upstreamed
- refreshed patch
  * link-gcc-shared.diff
- fixes security issue: CVE-2018-7999 [bsc#1084850]
  + graphite2-CVE-2018-7999.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1521201600">- Use python3 everywhere
- Drop fonttools test dep as it pulls TON of py3 packages</changelog>
  <changelog author="pgajdos@suse.com" date="1675425600">- fixed license string [bsc#1207676]:
  LGPL-2.1-or-later OR MPL-2.0 OR GPL-2.0-or-later</changelog>
</package>
<package pkgid="6e3a343f31cd9b7ab4e297ec596b34ec4f56ca577db647fb839dfd0359cfdd6c" name="libgstallocators-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="f19b4779c46d28bcad933cad860ee0319482c2babb5ec515a57722b856abd84e" name="libgstallocators-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="c2e71d669dec482f664da69b64a43507bb2e235caf5ad11ecb16fdc029a7bfb2" name="libgstapp-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="295656ab7d2a752c2550bf5efb52b310f69cf908982b21de9fb39a3a14257a5f" name="libgstapp-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="c717fafd2bd669613e6d166cbb89fdc929eb8714a22c49b427c351f550b2cd1e" name="libgstaudio-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="c7a596ec9c5e0bd150224924603c7d0c7962004c28717a7e1f6b06dfdd220796" name="libgstaudio-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="6f0af5f0e048577444424e76f92152dc36305bc8837c94476c1adadd7c96d00a" name="libgstgl-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="5b66d0260311dfac706f2769d1d51f7f4743fbf7077934b2a9e30a6fe23944b3" name="libgstgl-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="a690f06d098d563e0a0a472c58ce01cb6be5d3d698deed46b0cdab5cd2c70716" name="libgstpbutils-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="bdaceae04eb3e876d87a0f1f0630f8d6af740c7cd103c4f248be254ae1c6e90c" name="libgstpbutils-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="6ed2578c0aa74982569d2b4d14e49043d341c38ca4f01593bf5e7f99606402cd" name="libgstriff-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="0c2f80e0d8c90a4f5d8dc6e8e81fe2120760bb3ad3ce4a4bafd45e0c1a8e8bcd" name="libgstriff-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="f1ddf4defd3f3c0ba5dc6758f20de630c8ac3d38f5086f1b5fc15572590eb4b7" name="libgsttag-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="ce435e05987022db4ebf2dc663595e259c57a5fe3d2ea0f65ad792246aa2dd7a" name="libgsttag-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="daa2d2e31674c2aa65934c0125651e86b606cae6562d0a44de72d82dd687ee44" name="libgstvideo-1_0-0" arch="aarch64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="b4e1b1843f2c3b87dfac0b45928b4ab72c985d75042e950f8866218a91f7b86a" name="libgstvideo-1_0-0" arch="x86_64">
  <version epoch="0" ver="1.16.3" rel="150200.4.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1529755200">- Conditionalize orc and pkgconfig(wayland-egl) BuildRequires and
  enable-orc call, fix build for SLE 12 SP3.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532088000">- Update to version 1.14.2:
  + Update docs.
  + xvimage: Fix symbol redefine build error.
  + glcolorbalance: Support OES textures for input/passthrough.
  + meson: gl: fix backported patch.
  + gl/build: fixed failed compilation due to missing EGLuint64KHR
    typedef.
  + parsebin: Don't try to continue autoplugging a parser if we got
    raw caps.
  + audiobasesrc: Round down segsize to an integer number of
    samples.
  + discoverer: Don't crash when running with -v if channel-mask==0
    and &gt;7 channels.
  + gldownloadelement: fix build with msvc.
  + subparse: Don't read beyond array.
  + ogg: Avoid undefined granule shift.
  + libs: g-ir-scanner: do not hardcode libtool path.
  + rawvideoparse: fix typo in 'plane-offsets' description.
  + video: fix some GIR array annotations.
  + audio: fix some GIR array annotations.
  + meson: gl: remove non-headers from gl_prototype_headers.
  + meson: install the man pages for the command line tools.
  + meson: Fix detection of glib-mkenums under MSYS2.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 1.14.3:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1538568000">- Update to version 1.14.4:
  + Bugfix release, please see .changes in gstreamer main package.</changelog>
  <changelog author="davejplater@gmail.com" date="1556280000">- Added:
  0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch
  which fixes:
  https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384
  "Segfault since 1.16" which also occurs in 1.14.4.</changelog>
  <changelog author="mgorse@suse.com" date="1558008000">- Add CVE-2019-9928.patch: fix a heap overflow in the rtsp
  connection parser (boo#1133375 CVE-2019-9928).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1559304000">- Update to version 1.14.5:
  + audioconvert: fix endianness conversion for unpacked formats
    (e.g. S24_32BE).
  + audioringbuffer: Fix wrong memcpy address when reordering
    channels.
  + decodebin2: Make sure to remove pad probes when freeing
    GstDecodeGroup.
  + glviewconvert: fix output when a transformation matrix is used.
  + glupload:
  - Prevent segfault when updating caps.
  - dmabuf: be explicit about gl formats used.
  + gl/egl: Determine correct format on dmabuf import.
  + id3tag: validate the year from v1 tags before passing to
    GstDateTime.
  + rtpbasepayload: Fix sequence numbers when using buffer lists.
  + rtspconnection:
  - Fix security issue, potential heap overflow (CVE-2019-9928).
  - Fix GError set over the top of a previous GError.
  - Do not duplicate authentication headers.
  + subparse: don?t assert when failing to parse subrip timestamp.
  + video: various convert sample frame fixes.
  + video-converter: fix conversion from I420_10LE/BE, I420_12LE/BE,
    A420_10LE/BE to BGRA/RGBA which created corrupted output.
  + video-format: Fix GBRA_10/12 alpha channel pixel strides.
- Drop upstream fixed patches:
  + CVE-2019-9928.patch
  + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch</changelog>
  <changelog author="mgorse@suse.com" date="1560859200">- Update to version 1.16.0:
  + Highlights
  - GStreamer WebRTC stack gained support for data channels for
    peer-to-peer communication based on SCTP, BUNDLE support, as
    well as support for multiple TURN servers.
  - AV1 video codec support for Matroska and QuickTime/MP4
    containers and more configuration options and supported
    input formats for the AOMedia AV1 encoder
  - Support for Closed Captions and other Ancillary Data in video
  - Support for planar (non-interleaved) raw audio
  - GstVideoAggregator, compositor and OpenGL mixer elements are
    now in -base
  - New alternate fields interlace mode where each buffer carries
    a single field
  - WebM and Matroska ContentEncryption support in the Matroska
    demuxer
  - new WebKit WPE-based web browser source element
  - Video4Linux: HEVC encoding and decoding, JPEG encoding, and
    improved dmabuf import/export
  - Hardware-accelerated Nvidia video decoder gained support for
    VP8/VP9 decoding, whilst the encoder gained support for
    H.265/HEVC encoding.
  - Many improvements to the Intel Media SDK based
    hardware-accelerated video decoder and encoder plugin (msdk):
    dmabuf import/export for zero-copy integration with other
    components; VP9 decoding; 10-bit HEVC encoding; video
    post-processing (vpp) support including deinterlacing; and
    the video decoder now handles dynamic resolution changes.
  - The ASS/SSA subtitle overlay renderer can now handle multiple
    subtitles that overlap in time and will show them on screen
    simultaneously
  - The Meson build is now feature-complete (*) and it is now the
    recommended build system on all platforms. The Autotools
    build is scheduled to be removed in the next cycle.
  - The GStreamer Rust bindings and Rust plugins module are now
    officially part of upstream GStreamer.
  - The GStreamer Editing Services gained a gesdemux element that
    allows directly playing back serialized edit list with
    playbin or (uri)decodebin
  - Many performance improvements
- Switch to meson for Tumbleweed.
- Adjust line to get the minimum required gstreamer version.
- Disable tremor (needs libvorbisidec)
- Disable examples.
- Package libgstcompositor.so and libgstoverlaycomposition.so.
- Adjust documentation directory.
- Add gst-plugins-base-doc-build-fix.patch: fix build with
  automake.
- Up gstreamer-plugins-bad Conflicts.
- Now requires glib2 &gt;= 2.40.
- Obsolete libgstbadvideo-1_0-0: now part of -base.</changelog>
  <changelog author="mliska@suse.cz" date="1563969600">- Add gstreamer-plugins-base-arm-neon-configuration.patch
  as an upstream backport of:
  https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/commit/d8d4904e
- Use %make_build.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1566216000">- Drop pkgconfig(gdk-pixbuf-2.0), pkgconfig(gtk+-3.0) and
  pkgconfig(gtk+-x11-3.0) BuildRequires and pass --disable-examples
  to configure (we already do in meson conditional): Only needed to
  build the examples.
- Add explicit pkgconfig(wayland-protocols) BuildRequires:
  Previously pulled in by gtk3 dependency.
- Add explicit conditional pkgconfig(cairo) BuildRequires for
  openSUSE versions older than current Tumbleweed, workaround bug
  in pangocairo dependencies in those releases. Also previously
  pulled in by gtk3 dependency.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1569326400">- Update to version 1.16.1:
  + See main gstreamer package for changelog.
- Drop upstream fixed patches:
  + gst-plugins-base-doc-build-fix.patch.
  + gstreamer-plugins-base-arm-neon-configuration.patch.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1575460800">- Update to version 1.16.2:
  + xvimagepool: Update size, stride, and offset with allocated
    XvImage
  + video-converter: Fix RGB-XYZ-RGB conversion
  + audiorate: Update next_offset on rate change
  + audioringbuffer: Reset reorder flag before check
  + audio-buffer: Don't fail to map buffers with zero samples
  + videorate: Fix max-duplication-time handling
  + gl/gbm: ensure we call the resize callback before attempting to
    draw
  + video-converter: Various fixes for interlaced scaling
  + gstrtspconnection: messages_bytes not decreased
  + check: Don't use real audio devices for tests
  + riff: add CineForm mapping
  + glfilters: Don't use static variables for storing per-element
    state
  + glupload: Add VideoMetas and GLSyncMeta to the raw uploaded
    buffers
  + streamsynchronizer: avoid pad release race during logging.</changelog>
  <changelog author="fcrozat@suse.com" date="1576238400">- Enable orc / wayland-egl on SLE15.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578312000">- Add upstream bugfix patches:
  + gst-base-playbin-handle-error.patch: playbin: Handle error
    message with redirection indication.
  + gst-base-audioencoder-fix-leak.patch: audioencoder: fix segment
    event leak.
  + gst-base-fft-update-kiss-version.patch: fft: Update our kiss
    fft version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582718400">- Enable meson build conditionally for Tumbleweed.</changelog>
  <changelog author="dimstar@opensuse.org" date="1583496000">- Add gstreamer-plugins-base-gl-deps.patch: Workaround incomplete
  gstreamer-gl.pc file, which is missing the (dynamic) dependency
  on wayland.</changelog>
  <changelog author="mgorse@suse.com" date="1588334400">- Remove is_opensuse conditionals / really enable orc on SLE 15
  (jsc#SLE-12265).</changelog>
  <changelog author="zcjia@suse.com" date="1621425600">- Update to version 1.16.3 (bsc#1181255):
  - audioaggregator: Check all downstream allowed caps structures if they support the upstream rate
  - audioaggregator: Fix negotiation with downstream if there is no peer yet
  - audioencoder: fix segment event leak
  - discoverer: Fix caps handling in `pad-added` signal handler
  - discoverer: Start discovering next URI from right thread
  - fft: Update our kiss fft version, fixes thread-safety and concurrency issues and misc other things
  - gl: numerous memory fixes (use-after-free, leaks, missing NULL-ify)
  - gl/display/egl: ensure debug category is initialized
  - gstglwindow_x11: fix resize
  - pbutils: Add latest H.264 level values
  - rtpbuffer: fix header extension length validation
  - video: Fix NV12_64Z32 number of component
  - video-format: RGB16/15 are not 16 bit per component but only 5.333 and 5
  - video: fix top/bottom field flags
  - videodecoder: don't copy interlace-mode from reference state
  - appsrc/appsink: Make setting/replacing callbacks thread-safe
  - compositor: Fix checkerboard filling for BGRx/RGBx and UYVY/YUY2/YVYU
  - decodebin3: only force streams-selected seqnum after a select-streams
  - glupload: Fix fallback from direct dmabuf to dmabuf upload method
  - glvideomixer: perform `_get_highest_precision()` on the GL thread
  - libvisual: use `gst_element_class_set_metadata()` when passing dynamic strings
  - oggstream: Workaround for broken PAR in VP8 BOS
  - subparse: accept WebVTT timestamps without an hour component
  - playbin: Handle error message with redirection indication
  - textrender: Fix AYUV output.
  - typefind: Consider MPEG-PS PSM to be a PES type
  - uridecodebin3: default to non-0 buffer-size and buffer-duration, otherwise it could potentially cause big memory allocations over time
  - videoaggregator: Don't configure NULL chroma-site/colorimetry
  - videorate/videoscale/audioresample: Ensure that the caps returned from...
  - build: Replace bashisms in configure for Wayland and GLES3
- Drop upstream fixed patches:
  gst-base-playbin-handle-error.patch
  gst-base-audioencoder-fix-leak.patch
  gst-base-fft-update-kiss-version.patch</changelog>
  <changelog author="zcjia@suse.com" date="1660910400">- Add CVE-2021-3522.patch: tag: id3v2: fix frame size check and
  potential invalid reads (bsc#1185448, CVE-2021-3522).</changelog>
</package>
<package pkgid="0282d2f9b0dd2389155f627a83d0129d00f8be586b305c987dee5f56b03645e3" name="libharfbuzz0" arch="aarch64">
  <version epoch="0" ver="2.6.4" rel="150200.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1512907200">- Update to version 1.7.2:
  + Optimize hb_set_add_range().
  + Misc fixes.
  + New API: hb_coretext_font_create().</changelog>
  <changelog author="zaitor@opensuse.org" date="1513771200">- Update to version 1.7.4:
  + Fix collect_glyphs() regression caused by hb_set_t changes.
- Changes from version 1.7.3:
  + hb_set_t performance tuning and optimizations.
  + Speed up collect_glyphs() and reject garbage data.
  + In hb_coretext_font_create() set font point-size (ptem).
  + Misc fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1515499200">- Add pkgconfig(gobject-2.0) and
  pkgconfig(gobject-introspection-1.0) BuildRequires, and pass
  with-gobject=yes to configure, build GObject and Introspection
  support.
- Following this, package the new sub-packages libharfbuzz-gobject0
  and typelib-1_0-HarfBuzz-0_0.
- Clean up spec, use autosetup and make_build macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1515585600">- harfbuzz-devel hb-ft.h requires pkgconfig(freetype2) but it is
  not automatically added by the dependency generator.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1518177600">- Update to version 1.7.5:
  + Separate Khmer shaper from Indic.
  + First stab at AAT morx. Not hooked up.
  + Misc bug fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1520596800">- Fix build on Leap 42.3: don't use make_build.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1520769600">- Fix broken libharbuzz-gobject.so symlink by requiring Harfbuzz's
  Gobject library for the devel package.
- Add missing GI bindings requirement for the devel package.</changelog>
  <changelog author="jengelh@inai.de" date="1520942400">- Update summaries.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942401">- Update to version 1.7.6:
  + Fix to hb_set_t binary operations. Ouch.
  + New experimental harfbuzz-subset library. All of hb-subset.h is
    experimental right now and API WILL change.
  + New API:
  - hb_blob_copy_writable_or_fail().
  - HB_OT_TAG_BASE.
  - hb_set_previous().
  - hb_set_previous_range().
- Split out new sub-package libharfbuzz-subset0.
- Add libharfbuzz-gobject0 and libharfbuzz-subset0 to baselibs.
- Use make_build macro.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529150400">- Update to version 1.8.1:
  + Add correctness bug in hb_set_t operations, introduced in
    1.7.7.
- Changes from version 1.8.0:
  + Update to Unicode 11.0.0.
- Changes from version 1.7.7:
  + All HarfBuzz objects are significantly smaller in size now.
  + Sinhala: Position repha on top of post-consonant, not base.
  + Significant libharfbuzz-subset changes. API subject to change.
  + New API in libharfbuzz: hb_blob_create_from_file() and
    hb_face_count().
- Add missing post(un) ldconfig scriptlets for libharfbuzz-subset
  shared library.</changelog>
  <changelog author="tchvatal@suse.com" date="1538654400">- Update to 1.9.0:
  * Various gcc warning fixes
  * New Face-builder API
  * Internal source header name changes
  * Major Khmer shaper improvements
  * Couple of Indic bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1552910400">- Update to 2.3.1:
  * too many changes to ever iterate, see NEWS for the details</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Update to version 2.5.3:
  + Fix UCD script data for Unicode 10+ scripts. This was broken
    since 2.5.0.
  + More optimizations for HB_TINY.
- Changes from version 2.5.2:
  + More hb-config.hh facilities to shrink library size, namely
    when built as HB_TINY.
  + New documentation of custom configurations in CONFIG.md.
  + Fix build on gcc 4.8. That's supported again.
  + Universal Shaping Engine improvements.
  + API Changes: Undeprecate some horizontal-kerning API and
    re-enable in hb-ft, such that Type1 fonts will continue
    kerning.
- Changes from version 2.5.1:
  + Fix build with various versions of Visual Studio.
  + Improved documentation.
  + Bugfix in subsetting glyf table.
  + Improved scripts for cross-compiling for Windows using mingw.
  + Rename HB_MATH_GLYPH_PART_FLAG_EXTENDER to
    HB_OT_MATH_GLYPH_PART_FLAG_EXTENDER. A deprecated macro is
    added for backwards-compatibility.
- Changes from version 2.5.0:
  + This release does not include much functional changes, but
    includes major internal code-base changes. We now require
    C++11. Support for gcc 4.8 and earlier has been dropped.
  + New hb-config.hh facility for compiling smaller library for
    embedded and web usecases.
  + New Unicode Character Databse implementation that is half the
    size of previously-used UCDN.
  + Subsetter improvements.
  + Improved documentation.
  + isc shaping fixes.
- Changes from version 2.4.0:
  + Unicode 12.
  + Misc fixes.
  + Subsetter improvements.
  + New API: HB_BUFFER_FLAG_DO_NOT_INSERT_DOTTED_CIRCLE and
    hb_directwrite_face_create().</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568376000">- Update to version 2.6.1:
  + Fix regression with hb_font_create_sub_font scaling introduced
    in 2.6.0.
  + Change interpretation of font PTEM size / CoreText font size
    handling.
  + hb-ot-font: Prefer symbol cmap subtable if present.
  + Apply 'dist'/'abvm'/'blwm' features to all scripts.
  + Drop experimental DirectWrite API.
- Changes from version 2.6.0:
  + New OpenType metrics, baseline, and metadata table access APIs.
  + New API to set font variations to a named-instance.
  + New hb-gdi.h header and API for creating hb_face_t from HFONT.
  + Amalgam: Provide a single-file harfbuzz.cc file for easier
    alternate building.
  + More size-reduction configurable options, enabled by HB_TINY.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570104000">- Update to version 2.6.2:
  + Misc small fixes, mostly to build-related issues.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1570363200">- add upstream sigining keyring and verify source signature</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1572350400">- update to 2.6.3:
  + Misc small fixes, mostly to build-related issues
  + New API: hb_font_get_nominal_glyphs()</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1574596800">- update to 2.6.4:
  + small bug fixes and build fixes</changelog>
  <changelog author="mgorse@suse.com" date="1657886400">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
</package>
<package pkgid="2c2bff4a4fe0a7e3f461af777d914c8aa6e51212cb5b857d2f89282666b9a419" name="libharfbuzz0" arch="x86_64">
  <version epoch="0" ver="2.6.4" rel="150200.3.3.1"/>
  <changelog author="zaitor@opensuse.org" date="1512907200">- Update to version 1.7.2:
  + Optimize hb_set_add_range().
  + Misc fixes.
  + New API: hb_coretext_font_create().</changelog>
  <changelog author="zaitor@opensuse.org" date="1513771200">- Update to version 1.7.4:
  + Fix collect_glyphs() regression caused by hb_set_t changes.
- Changes from version 1.7.3:
  + hb_set_t performance tuning and optimizations.
  + Speed up collect_glyphs() and reject garbage data.
  + In hb_coretext_font_create() set font point-size (ptem).
  + Misc fixes.</changelog>
  <changelog author="zaitor@opensuse.org" date="1515499200">- Add pkgconfig(gobject-2.0) and
  pkgconfig(gobject-introspection-1.0) BuildRequires, and pass
  with-gobject=yes to configure, build GObject and Introspection
  support.
- Following this, package the new sub-packages libharfbuzz-gobject0
  and typelib-1_0-HarfBuzz-0_0.
- Clean up spec, use autosetup and make_build macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1515585600">- harfbuzz-devel hb-ft.h requires pkgconfig(freetype2) but it is
  not automatically added by the dependency generator.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1518177600">- Update to version 1.7.5:
  + Separate Khmer shaper from Indic.
  + First stab at AAT morx. Not hooked up.
  + Misc bug fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="astieger@suse.com" date="1520596800">- Fix build on Leap 42.3: don't use make_build.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1520769600">- Fix broken libharbuzz-gobject.so symlink by requiring Harfbuzz's
  Gobject library for the devel package.
- Add missing GI bindings requirement for the devel package.</changelog>
  <changelog author="jengelh@inai.de" date="1520942400">- Update summaries.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1520942401">- Update to version 1.7.6:
  + Fix to hb_set_t binary operations. Ouch.
  + New experimental harfbuzz-subset library. All of hb-subset.h is
    experimental right now and API WILL change.
  + New API:
  - hb_blob_copy_writable_or_fail().
  - HB_OT_TAG_BASE.
  - hb_set_previous().
  - hb_set_previous_range().
- Split out new sub-package libharfbuzz-subset0.
- Add libharfbuzz-gobject0 and libharfbuzz-subset0 to baselibs.
- Use make_build macro.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529150400">- Update to version 1.8.1:
  + Add correctness bug in hb_set_t operations, introduced in
    1.7.7.
- Changes from version 1.8.0:
  + Update to Unicode 11.0.0.
- Changes from version 1.7.7:
  + All HarfBuzz objects are significantly smaller in size now.
  + Sinhala: Position repha on top of post-consonant, not base.
  + Significant libharfbuzz-subset changes. API subject to change.
  + New API in libharfbuzz: hb_blob_create_from_file() and
    hb_face_count().
- Add missing post(un) ldconfig scriptlets for libharfbuzz-subset
  shared library.</changelog>
  <changelog author="tchvatal@suse.com" date="1538654400">- Update to 1.9.0:
  * Various gcc warning fixes
  * New Face-builder API
  * Internal source header name changes
  * Major Khmer shaper improvements
  * Couple of Indic bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1552910400">- Update to 2.3.1:
  * too many changes to ever iterate, see NEWS for the details</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563019200">- Update to version 2.5.3:
  + Fix UCD script data for Unicode 10+ scripts. This was broken
    since 2.5.0.
  + More optimizations for HB_TINY.
- Changes from version 2.5.2:
  + More hb-config.hh facilities to shrink library size, namely
    when built as HB_TINY.
  + New documentation of custom configurations in CONFIG.md.
  + Fix build on gcc 4.8. That's supported again.
  + Universal Shaping Engine improvements.
  + API Changes: Undeprecate some horizontal-kerning API and
    re-enable in hb-ft, such that Type1 fonts will continue
    kerning.
- Changes from version 2.5.1:
  + Fix build with various versions of Visual Studio.
  + Improved documentation.
  + Bugfix in subsetting glyf table.
  + Improved scripts for cross-compiling for Windows using mingw.
  + Rename HB_MATH_GLYPH_PART_FLAG_EXTENDER to
    HB_OT_MATH_GLYPH_PART_FLAG_EXTENDER. A deprecated macro is
    added for backwards-compatibility.
- Changes from version 2.5.0:
  + This release does not include much functional changes, but
    includes major internal code-base changes. We now require
    C++11. Support for gcc 4.8 and earlier has been dropped.
  + New hb-config.hh facility for compiling smaller library for
    embedded and web usecases.
  + New Unicode Character Databse implementation that is half the
    size of previously-used UCDN.
  + Subsetter improvements.
  + Improved documentation.
  + isc shaping fixes.
- Changes from version 2.4.0:
  + Unicode 12.
  + Misc fixes.
  + Subsetter improvements.
  + New API: HB_BUFFER_FLAG_DO_NOT_INSERT_DOTTED_CIRCLE and
    hb_directwrite_face_create().</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568376000">- Update to version 2.6.1:
  + Fix regression with hb_font_create_sub_font scaling introduced
    in 2.6.0.
  + Change interpretation of font PTEM size / CoreText font size
    handling.
  + hb-ot-font: Prefer symbol cmap subtable if present.
  + Apply 'dist'/'abvm'/'blwm' features to all scripts.
  + Drop experimental DirectWrite API.
- Changes from version 2.6.0:
  + New OpenType metrics, baseline, and metadata table access APIs.
  + New API to set font variations to a named-instance.
  + New hb-gdi.h header and API for creating hb_face_t from HFONT.
  + Amalgam: Provide a single-file harfbuzz.cc file for easier
    alternate building.
  + More size-reduction configurable options, enabled by HB_TINY.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570104000">- Update to version 2.6.2:
  + Misc small fixes, mostly to build-related issues.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1570363200">- add upstream sigining keyring and verify source signature</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1572350400">- update to 2.6.3:
  + Misc small fixes, mostly to build-related issues
  + New API: hb_font_get_nominal_glyphs()</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1574596800">- update to 2.6.4:
  + small bug fixes and build fixes</changelog>
  <changelog author="mgorse@suse.com" date="1657886400">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
</package>
<package pkgid="26e9bdc87f8b52c5f05ece3bed7057ab35e726d203951c179444195f08e3accc" name="libicu-suse65_1" arch="aarch64">
  <version epoch="0" ver="65.1" rel="150200.4.5.1"/>
  <changelog author="jengelh@inai.de" date="1458907200">- Update to new upstream release 57.1
  * CLDR 29 support
  * Grapheme/word/line breaking for emoji sequences, based on
  Unicode 9 proposed rules.
  * Four new Unicode emoji properties
  * DateFormat day period formatting of "noon", "at night", etc. via
  new pattern characters b &amp; B, and DateTimePatternGenerator
  support of C for selecting the customary form.
  * RelativeDateTimeFormatter: Simpler formatting API.
  * New simple &amp; fast SimpleFormatter class for a trivial subset of
  MessageFormat as used in CLDR data.</changelog>
  <changelog author="jengelh@inai.de" date="1477051200">- Update to new upstream release 58.1
  * CLDR 30.0.2: For details of the many changes in CLDR, see
  CLDR 30. Some things to note:
  * For some combinations of numbering system (arab, arabext, latn)
  and/or locale (ar, fa, he), there were changes to the
  bidirectional control characters used with certain symbols
  (percent, minus, plus), and changes to number patterns (currency
  and/or percent, including addition of bidirectional control
  characters in some cases).
  * Thhe bidirectional controls used for such purposes include U+061C
  ARABIC LETTER MARK (ALM), which requires use of the bidirectional
  algorithm from Unicode 6.3 or later.
  * The time separator for Norwegian locales (nb, nn) was changed to
  be ':' throughout.
  * Unicode 9.0: Version 9.0 adds exactly 7,500 characters, for a
  total of 128,172 characters. These additions include six new
  scripts, 19 symbols for the new 4K TV standard, and 72 new
  emoji characters.
  * Draft Emoji 4.0 data
  * Emoji updates for word &amp; line breaking
  * UBiDiTransform/BidiTransform API for convenient transformation of
  text between different Bidi layouts.
  * MeasureFormat API for measurement unit display names
  * Most COUNT and LIMIT enum constants have been deprecated
  * SpoofChecker: Handling of "whole script confusables" has been
  removed from ICU, in accordance with its removal from UTS #39
  Version 9.0.0 and the removal of the corresponding Unicode data
  file.
  * Greek uppercasing ("el" locale ID) removes most diacritics.
  * More robust locale data loading across ICU implementation code.
  * Reduced heap memory usage in DateTimePatternGenerator</changelog>
  <changelog author="idonmez@suse.com" date="1481371200">- Update to new upstream release 58.2
  * CLDR 30.0.3:
    + Fix incorrect data for number of Cantonese speakers in China.
    + Hani_Latn transform was not updated with Unihan 9.0 kMandarin
    readings.
  * Time zone database version 2016j
  * #12815 uspoof_getSkeleton sets backwards-incompatible illegal
    argument exception
  * #12825 uspoof_check goes into an "infinite loop" when U+30FB
    is in an input string
  * #12832 GreekUpper::toUpper skips the final character on a
    non-terminated UTF-8 string
  * #12849 u_strToTitle returns incorrect length if destination
    is NULL</changelog>
  <changelog author="jengelh@inai.de" date="1493294400">- Update to new upstream release 59.1
  * Emoji 5.0 data
  * CLDR 31.0.1
  * * GMT and UTC are no longer unified, and CLDR provides
    distinct UTC display names, avoiding confusion with standard
    (winter) time in Britain.
  * New case mapping API (C++ &amp; Java classes CaseMap) supports
    styled text
  * ICU4C now uses and requires C++11 language features and
    libraries.
  * ICU4C has also moved to char16_t as the type for UTF-16. This
    is a breaking change. Please see the detail section below.</changelog>
  <changelog author="rguenther@suse.com" date="1495022400">- Add icu-avoid-x87-excess-precision.diff to avoid
  FixedPrecision::initVisibleDigits failure on i586 with GCC 7.
  (bnc#1030253)</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- xlocale.patch: don't use obsolete &lt;xlocale.h&gt;</changelog>
  <changelog author="jengelh@inai.de" date="1501675200">- refresh icu-avoid-x87-excess-precision.diff with p1</changelog>
  <changelog author="jengelh@inai.de" date="1513252800">- Update to new upstream release 60.2
  * ICU 60 provides full support for the Unicode 10.0 release
    with many new characters and many property improvements.
    Locale data is updated to CLDR 32, which adds several
    languages and data improvements. A new number formatting API
    has been added.</changelog>
  <changelog author="jengelh@inai.de" date="1514289600">- Drop dangling symlinks /usr/lib64/icu/*.inc</changelog>
  <changelog author="jengelh@inai.de" date="1522843200">- Update to new upstream release 61.1
  * ICU 61 upgrades to CLDR 33 locale data.
- Add icu-number-grouping.diff</changelog>
  <changelog author="jengelh@inai.de" date="1528113600">- Add icu-susevers.diff and disable UTF-8 assumption
  [boo#1095425]</changelog>
  <changelog author="jengelh@inai.de" date="1532865600">- Update to new upstream release 62.1
  * Unicode 11: 684 new characters, including 7 new scripts,
    Mtavruli Georgian capital letters, 5 new Han characters, and
    66 new emoji characters.
  * CLDR 33.1
  * Under-the-hood overhaul of number parsing. Behavior is mostly
    compatible with previous versions, but there are some known
    differences.
- Remove xlocale.patch (code to patch is gone),
  icu-number-grouping.diff (merged upstream)</changelog>
  <changelog author="idonmez@suse.com" date="1539777600">- Update to new upstream release 63.1
  * CLDR 34
    + Segmentation rules and emoji sort order adjusted for
    Unicode 11
    + Somali and Javanese data now up to moderate level
    (document content)
    + Tongan, Konkani, Maori, Dzongkha, Tatar, Kurdish (ku),
    and Xhosa data now up to basic level
    + Many data additions and corrections in many other
    languages
    + The following languages have been added to ICU: Sindhi,
    Maori, Turkmen, Javanese, Interlingua, Kurdish (ku), Xhosa
  * New currency: Venezuela's Bolívar Soberano (VES)
  * New Japanese calendar era from 2019: CLDR and ICU include
    data for testing that can be enabled.
    (ICU #12973, CLDR #10750)
  * To enable CLDR new Japanese era placeholder name, set
    environment variable (and Java system property for ICU4J)
    ICU_ENABLE_TENTATIVE_ERA=true.
  * New API for number and currency range formatting
    (class NumberRangeFormatter, #11276)
  * Support for additional Unicode properties:
    Indic_Positional_Category &amp; Indic_Syllabic_Category (#8966)
    and Vertical_Orientation (#12850)
  * New API for code point maps and tries, mapping Unicode
    code points (U+0000..U+10FFFF) to integer values. (#13530)
  * Java classes CodePointMap, CodePointTrie, MutableCodePointTrie
  * C types UCPMap, UCPTrie, UMutableCPTrie
  * New API for getting a UnicodeSet per binary property and a code
    point map per enumerated/int-value property. (#20086)
  * Full conformance with UAX #14 Line Breaking
    (required BreakIterator feature work). (#7270)
  * C++ Locale class
    + Additional functions forLanguageTag()/toLanguageTag(),
    and functions that are easier and safer to use by using
    StringPiece and ByteSink rather than raw buffers. (#13417)
    + Move semantics. (#13645)
  * Various Out-Of-Memory (OOM) issues have been fixed.
- Refresh icu-versioning.diff</changelog>
  <changelog author="jengelh@inai.de" date="1554120000">- Update to new upstream release 64.1
  * Updates to Unicode 12 and to CLDR 35 locale data with many
    additions and corrections, and some new languages. ICU adds a
    data filtering/subsetting mechanism, improved formatting API,
    and a C++ LocaleBuilder.
- New python3 dependency to build intermediate file
  test/testdata/rules.mk.</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Update to new upstream release 64.2
  * This maintenance update for ICU 64 includes draft Unicode
    12.1 update, CLDR 35.1 locale data and support for the new
    Japanese era Reiwa (??). (boo#1112183, bnc#1103893,
    FATE#325570)</changelog>
  <changelog author="idonmez@suse.com" date="1557835200">- Add 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch to fix a
  regression with the C.UTF-8 locale
  https://unicode-org.atlassian.net/browse/ICU-20575</changelog>
  <changelog author="kukuk@suse.de" date="1566388800">- Remove old obsoletes/provides for migration from very old
  products, as they break our shared library policy (bsc#1146907).</changelog>
  <changelog author="jengelh@inai.de" date="1570276800">- Update to release 65.1 (jsc#SLE-11118).
  * Updated to CLDR 36 locale data with many additions and
    corrections, and some new measurement units.
  * The Java LocaleMatcher API is improved, and ported to C++.
- Drop 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch
  (merged)</changelog>
  <changelog author="qzhao@suse.com" date="1590926400">- Add the provides for libicu to Make .Net core can install
  successfully. (bsc#1167603, bsc#1161007)</changelog>
  <changelog author="qzhao@suse.com" date="1660305600">- Backport icu-CVE-2020-21913.patch: backport commit 727505bdd
  from upstream, use LocalMemory for cmd to prevent use after free
  (bsc#1193951 CVE-2020-21913).</changelog>
</package>
<package pkgid="d9558159f71b63712d6d85709a8ab64026edd9daa4f7a9137d96c457a5f824bc" name="libicu-suse65_1" arch="x86_64">
  <version epoch="0" ver="65.1" rel="150200.4.5.1"/>
  <changelog author="jengelh@inai.de" date="1458907200">- Update to new upstream release 57.1
  * CLDR 29 support
  * Grapheme/word/line breaking for emoji sequences, based on
  Unicode 9 proposed rules.
  * Four new Unicode emoji properties
  * DateFormat day period formatting of "noon", "at night", etc. via
  new pattern characters b &amp; B, and DateTimePatternGenerator
  support of C for selecting the customary form.
  * RelativeDateTimeFormatter: Simpler formatting API.
  * New simple &amp; fast SimpleFormatter class for a trivial subset of
  MessageFormat as used in CLDR data.</changelog>
  <changelog author="jengelh@inai.de" date="1477051200">- Update to new upstream release 58.1
  * CLDR 30.0.2: For details of the many changes in CLDR, see
  CLDR 30. Some things to note:
  * For some combinations of numbering system (arab, arabext, latn)
  and/or locale (ar, fa, he), there were changes to the
  bidirectional control characters used with certain symbols
  (percent, minus, plus), and changes to number patterns (currency
  and/or percent, including addition of bidirectional control
  characters in some cases).
  * Thhe bidirectional controls used for such purposes include U+061C
  ARABIC LETTER MARK (ALM), which requires use of the bidirectional
  algorithm from Unicode 6.3 or later.
  * The time separator for Norwegian locales (nb, nn) was changed to
  be ':' throughout.
  * Unicode 9.0: Version 9.0 adds exactly 7,500 characters, for a
  total of 128,172 characters. These additions include six new
  scripts, 19 symbols for the new 4K TV standard, and 72 new
  emoji characters.
  * Draft Emoji 4.0 data
  * Emoji updates for word &amp; line breaking
  * UBiDiTransform/BidiTransform API for convenient transformation of
  text between different Bidi layouts.
  * MeasureFormat API for measurement unit display names
  * Most COUNT and LIMIT enum constants have been deprecated
  * SpoofChecker: Handling of "whole script confusables" has been
  removed from ICU, in accordance with its removal from UTS #39
  Version 9.0.0 and the removal of the corresponding Unicode data
  file.
  * Greek uppercasing ("el" locale ID) removes most diacritics.
  * More robust locale data loading across ICU implementation code.
  * Reduced heap memory usage in DateTimePatternGenerator</changelog>
  <changelog author="idonmez@suse.com" date="1481371200">- Update to new upstream release 58.2
  * CLDR 30.0.3:
    + Fix incorrect data for number of Cantonese speakers in China.
    + Hani_Latn transform was not updated with Unihan 9.0 kMandarin
    readings.
  * Time zone database version 2016j
  * #12815 uspoof_getSkeleton sets backwards-incompatible illegal
    argument exception
  * #12825 uspoof_check goes into an "infinite loop" when U+30FB
    is in an input string
  * #12832 GreekUpper::toUpper skips the final character on a
    non-terminated UTF-8 string
  * #12849 u_strToTitle returns incorrect length if destination
    is NULL</changelog>
  <changelog author="jengelh@inai.de" date="1493294400">- Update to new upstream release 59.1
  * Emoji 5.0 data
  * CLDR 31.0.1
  * * GMT and UTC are no longer unified, and CLDR provides
    distinct UTC display names, avoiding confusion with standard
    (winter) time in Britain.
  * New case mapping API (C++ &amp; Java classes CaseMap) supports
    styled text
  * ICU4C now uses and requires C++11 language features and
    libraries.
  * ICU4C has also moved to char16_t as the type for UTF-16. This
    is a breaking change. Please see the detail section below.</changelog>
  <changelog author="rguenther@suse.com" date="1495022400">- Add icu-avoid-x87-excess-precision.diff to avoid
  FixedPrecision::initVisibleDigits failure on i586 with GCC 7.
  (bnc#1030253)</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- xlocale.patch: don't use obsolete &lt;xlocale.h&gt;</changelog>
  <changelog author="jengelh@inai.de" date="1501675200">- refresh icu-avoid-x87-excess-precision.diff with p1</changelog>
  <changelog author="jengelh@inai.de" date="1513252800">- Update to new upstream release 60.2
  * ICU 60 provides full support for the Unicode 10.0 release
    with many new characters and many property improvements.
    Locale data is updated to CLDR 32, which adds several
    languages and data improvements. A new number formatting API
    has been added.</changelog>
  <changelog author="jengelh@inai.de" date="1514289600">- Drop dangling symlinks /usr/lib64/icu/*.inc</changelog>
  <changelog author="jengelh@inai.de" date="1522843200">- Update to new upstream release 61.1
  * ICU 61 upgrades to CLDR 33 locale data.
- Add icu-number-grouping.diff</changelog>
  <changelog author="jengelh@inai.de" date="1528113600">- Add icu-susevers.diff and disable UTF-8 assumption
  [boo#1095425]</changelog>
  <changelog author="jengelh@inai.de" date="1532865600">- Update to new upstream release 62.1
  * Unicode 11: 684 new characters, including 7 new scripts,
    Mtavruli Georgian capital letters, 5 new Han characters, and
    66 new emoji characters.
  * CLDR 33.1
  * Under-the-hood overhaul of number parsing. Behavior is mostly
    compatible with previous versions, but there are some known
    differences.
- Remove xlocale.patch (code to patch is gone),
  icu-number-grouping.diff (merged upstream)</changelog>
  <changelog author="idonmez@suse.com" date="1539777600">- Update to new upstream release 63.1
  * CLDR 34
    + Segmentation rules and emoji sort order adjusted for
    Unicode 11
    + Somali and Javanese data now up to moderate level
    (document content)
    + Tongan, Konkani, Maori, Dzongkha, Tatar, Kurdish (ku),
    and Xhosa data now up to basic level
    + Many data additions and corrections in many other
    languages
    + The following languages have been added to ICU: Sindhi,
    Maori, Turkmen, Javanese, Interlingua, Kurdish (ku), Xhosa
  * New currency: Venezuela's Bolívar Soberano (VES)
  * New Japanese calendar era from 2019: CLDR and ICU include
    data for testing that can be enabled.
    (ICU #12973, CLDR #10750)
  * To enable CLDR new Japanese era placeholder name, set
    environment variable (and Java system property for ICU4J)
    ICU_ENABLE_TENTATIVE_ERA=true.
  * New API for number and currency range formatting
    (class NumberRangeFormatter, #11276)
  * Support for additional Unicode properties:
    Indic_Positional_Category &amp; Indic_Syllabic_Category (#8966)
    and Vertical_Orientation (#12850)
  * New API for code point maps and tries, mapping Unicode
    code points (U+0000..U+10FFFF) to integer values. (#13530)
  * Java classes CodePointMap, CodePointTrie, MutableCodePointTrie
  * C types UCPMap, UCPTrie, UMutableCPTrie
  * New API for getting a UnicodeSet per binary property and a code
    point map per enumerated/int-value property. (#20086)
  * Full conformance with UAX #14 Line Breaking
    (required BreakIterator feature work). (#7270)
  * C++ Locale class
    + Additional functions forLanguageTag()/toLanguageTag(),
    and functions that are easier and safer to use by using
    StringPiece and ByteSink rather than raw buffers. (#13417)
    + Move semantics. (#13645)
  * Various Out-Of-Memory (OOM) issues have been fixed.
- Refresh icu-versioning.diff</changelog>
  <changelog author="jengelh@inai.de" date="1554120000">- Update to new upstream release 64.1
  * Updates to Unicode 12 and to CLDR 35 locale data with many
    additions and corrections, and some new languages. ICU adds a
    data filtering/subsetting mechanism, improved formatting API,
    and a C++ LocaleBuilder.
- New python3 dependency to build intermediate file
  test/testdata/rules.mk.</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Update to new upstream release 64.2
  * This maintenance update for ICU 64 includes draft Unicode
    12.1 update, CLDR 35.1 locale data and support for the new
    Japanese era Reiwa (??). (boo#1112183, bnc#1103893,
    FATE#325570)</changelog>
  <changelog author="idonmez@suse.com" date="1557835200">- Add 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch to fix a
  regression with the C.UTF-8 locale
  https://unicode-org.atlassian.net/browse/ICU-20575</changelog>
  <changelog author="kukuk@suse.de" date="1566388800">- Remove old obsoletes/provides for migration from very old
  products, as they break our shared library policy (bsc#1146907).</changelog>
  <changelog author="jengelh@inai.de" date="1570276800">- Update to release 65.1 (jsc#SLE-11118).
  * Updated to CLDR 36 locale data with many additions and
    corrections, and some new measurement units.
  * The Java LocaleMatcher API is improved, and ported to C++.
- Drop 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch
  (merged)</changelog>
  <changelog author="qzhao@suse.com" date="1590926400">- Add the provides for libicu to Make .Net core can install
  successfully. (bsc#1167603, bsc#1161007)</changelog>
  <changelog author="qzhao@suse.com" date="1660305600">- Backport icu-CVE-2020-21913.patch: backport commit 727505bdd
  from upstream, use LocalMemory for cmd to prevent use after free
  (bsc#1193951 CVE-2020-21913).</changelog>
</package>
<package pkgid="af31ea5ddbfd6b8dc18cd111d10590bbf634b741c745e7d2001f406b2b254450" name="libicu65_1-ledata" arch="noarch">
  <version epoch="0" ver="65.1" rel="150200.4.5.1"/>
  <changelog author="jengelh@inai.de" date="1458907200">- Update to new upstream release 57.1
  * CLDR 29 support
  * Grapheme/word/line breaking for emoji sequences, based on
  Unicode 9 proposed rules.
  * Four new Unicode emoji properties
  * DateFormat day period formatting of "noon", "at night", etc. via
  new pattern characters b &amp; B, and DateTimePatternGenerator
  support of C for selecting the customary form.
  * RelativeDateTimeFormatter: Simpler formatting API.
  * New simple &amp; fast SimpleFormatter class for a trivial subset of
  MessageFormat as used in CLDR data.</changelog>
  <changelog author="jengelh@inai.de" date="1477051200">- Update to new upstream release 58.1
  * CLDR 30.0.2: For details of the many changes in CLDR, see
  CLDR 30. Some things to note:
  * For some combinations of numbering system (arab, arabext, latn)
  and/or locale (ar, fa, he), there were changes to the
  bidirectional control characters used with certain symbols
  (percent, minus, plus), and changes to number patterns (currency
  and/or percent, including addition of bidirectional control
  characters in some cases).
  * Thhe bidirectional controls used for such purposes include U+061C
  ARABIC LETTER MARK (ALM), which requires use of the bidirectional
  algorithm from Unicode 6.3 or later.
  * The time separator for Norwegian locales (nb, nn) was changed to
  be ':' throughout.
  * Unicode 9.0: Version 9.0 adds exactly 7,500 characters, for a
  total of 128,172 characters. These additions include six new
  scripts, 19 symbols for the new 4K TV standard, and 72 new
  emoji characters.
  * Draft Emoji 4.0 data
  * Emoji updates for word &amp; line breaking
  * UBiDiTransform/BidiTransform API for convenient transformation of
  text between different Bidi layouts.
  * MeasureFormat API for measurement unit display names
  * Most COUNT and LIMIT enum constants have been deprecated
  * SpoofChecker: Handling of "whole script confusables" has been
  removed from ICU, in accordance with its removal from UTS #39
  Version 9.0.0 and the removal of the corresponding Unicode data
  file.
  * Greek uppercasing ("el" locale ID) removes most diacritics.
  * More robust locale data loading across ICU implementation code.
  * Reduced heap memory usage in DateTimePatternGenerator</changelog>
  <changelog author="idonmez@suse.com" date="1481371200">- Update to new upstream release 58.2
  * CLDR 30.0.3:
    + Fix incorrect data for number of Cantonese speakers in China.
    + Hani_Latn transform was not updated with Unihan 9.0 kMandarin
    readings.
  * Time zone database version 2016j
  * #12815 uspoof_getSkeleton sets backwards-incompatible illegal
    argument exception
  * #12825 uspoof_check goes into an "infinite loop" when U+30FB
    is in an input string
  * #12832 GreekUpper::toUpper skips the final character on a
    non-terminated UTF-8 string
  * #12849 u_strToTitle returns incorrect length if destination
    is NULL</changelog>
  <changelog author="jengelh@inai.de" date="1493294400">- Update to new upstream release 59.1
  * Emoji 5.0 data
  * CLDR 31.0.1
  * * GMT and UTC are no longer unified, and CLDR provides
    distinct UTC display names, avoiding confusion with standard
    (winter) time in Britain.
  * New case mapping API (C++ &amp; Java classes CaseMap) supports
    styled text
  * ICU4C now uses and requires C++11 language features and
    libraries.
  * ICU4C has also moved to char16_t as the type for UTF-16. This
    is a breaking change. Please see the detail section below.</changelog>
  <changelog author="rguenther@suse.com" date="1495022400">- Add icu-avoid-x87-excess-precision.diff to avoid
  FixedPrecision::initVisibleDigits failure on i586 with GCC 7.
  (bnc#1030253)</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- xlocale.patch: don't use obsolete &lt;xlocale.h&gt;</changelog>
  <changelog author="jengelh@inai.de" date="1501675200">- refresh icu-avoid-x87-excess-precision.diff with p1</changelog>
  <changelog author="jengelh@inai.de" date="1513252800">- Update to new upstream release 60.2
  * ICU 60 provides full support for the Unicode 10.0 release
    with many new characters and many property improvements.
    Locale data is updated to CLDR 32, which adds several
    languages and data improvements. A new number formatting API
    has been added.</changelog>
  <changelog author="jengelh@inai.de" date="1514289600">- Drop dangling symlinks /usr/lib64/icu/*.inc</changelog>
  <changelog author="jengelh@inai.de" date="1522843200">- Update to new upstream release 61.1
  * ICU 61 upgrades to CLDR 33 locale data.
- Add icu-number-grouping.diff</changelog>
  <changelog author="jengelh@inai.de" date="1528113600">- Add icu-susevers.diff and disable UTF-8 assumption
  [boo#1095425]</changelog>
  <changelog author="jengelh@inai.de" date="1532865600">- Update to new upstream release 62.1
  * Unicode 11: 684 new characters, including 7 new scripts,
    Mtavruli Georgian capital letters, 5 new Han characters, and
    66 new emoji characters.
  * CLDR 33.1
  * Under-the-hood overhaul of number parsing. Behavior is mostly
    compatible with previous versions, but there are some known
    differences.
- Remove xlocale.patch (code to patch is gone),
  icu-number-grouping.diff (merged upstream)</changelog>
  <changelog author="idonmez@suse.com" date="1539777600">- Update to new upstream release 63.1
  * CLDR 34
    + Segmentation rules and emoji sort order adjusted for
    Unicode 11
    + Somali and Javanese data now up to moderate level
    (document content)
    + Tongan, Konkani, Maori, Dzongkha, Tatar, Kurdish (ku),
    and Xhosa data now up to basic level
    + Many data additions and corrections in many other
    languages
    + The following languages have been added to ICU: Sindhi,
    Maori, Turkmen, Javanese, Interlingua, Kurdish (ku), Xhosa
  * New currency: Venezuela's Bolívar Soberano (VES)
  * New Japanese calendar era from 2019: CLDR and ICU include
    data for testing that can be enabled.
    (ICU #12973, CLDR #10750)
  * To enable CLDR new Japanese era placeholder name, set
    environment variable (and Java system property for ICU4J)
    ICU_ENABLE_TENTATIVE_ERA=true.
  * New API for number and currency range formatting
    (class NumberRangeFormatter, #11276)
  * Support for additional Unicode properties:
    Indic_Positional_Category &amp; Indic_Syllabic_Category (#8966)
    and Vertical_Orientation (#12850)
  * New API for code point maps and tries, mapping Unicode
    code points (U+0000..U+10FFFF) to integer values. (#13530)
  * Java classes CodePointMap, CodePointTrie, MutableCodePointTrie
  * C types UCPMap, UCPTrie, UMutableCPTrie
  * New API for getting a UnicodeSet per binary property and a code
    point map per enumerated/int-value property. (#20086)
  * Full conformance with UAX #14 Line Breaking
    (required BreakIterator feature work). (#7270)
  * C++ Locale class
    + Additional functions forLanguageTag()/toLanguageTag(),
    and functions that are easier and safer to use by using
    StringPiece and ByteSink rather than raw buffers. (#13417)
    + Move semantics. (#13645)
  * Various Out-Of-Memory (OOM) issues have been fixed.
- Refresh icu-versioning.diff</changelog>
  <changelog author="jengelh@inai.de" date="1554120000">- Update to new upstream release 64.1
  * Updates to Unicode 12 and to CLDR 35 locale data with many
    additions and corrections, and some new languages. ICU adds a
    data filtering/subsetting mechanism, improved formatting API,
    and a C++ LocaleBuilder.
- New python3 dependency to build intermediate file
  test/testdata/rules.mk.</changelog>
  <changelog author="jengelh@inai.de" date="1555588800">- Update to new upstream release 64.2
  * This maintenance update for ICU 64 includes draft Unicode
    12.1 update, CLDR 35.1 locale data and support for the new
    Japanese era Reiwa (??). (boo#1112183, bnc#1103893,
    FATE#325570)</changelog>
  <changelog author="idonmez@suse.com" date="1557835200">- Add 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch to fix a
  regression with the C.UTF-8 locale
  https://unicode-org.atlassian.net/browse/ICU-20575</changelog>
  <changelog author="kukuk@suse.de" date="1566388800">- Remove old obsoletes/provides for migration from very old
  products, as they break our shared library policy (bsc#1146907).</changelog>
  <changelog author="jengelh@inai.de" date="1570276800">- Update to release 65.1 (jsc#SLE-11118).
  * Updated to CLDR 36 locale data with many additions and
    corrections, and some new measurement units.
  * The Java LocaleMatcher API is improved, and ported to C++.
- Drop 075cefb2e21f57f4cac1bc2868e93dd1b8c077cc.patch
  (merged)</changelog>
  <changelog author="qzhao@suse.com" date="1590926400">- Add the provides for libicu to Make .Net core can install
  successfully. (bsc#1167603, bsc#1161007)</changelog>
  <changelog author="qzhao@suse.com" date="1660305600">- Backport icu-CVE-2020-21913.patch: backport commit 727505bdd
  from upstream, use LocalMemory for cmd to prevent use after free
  (bsc#1193951 CVE-2020-21913).</changelog>
</package>
<package pkgid="b80fbdbcfb07366ff8963029a0914293afa5d213b906a0484ebf0a3c4ec9d9d1" name="libjpeg-turbo" arch="src">
  <version epoch="0" ver="1.5.3" rel="150000.32.5.1"/>
  <changelog author="pgajdos@suse.com" date="1417089600">- security update CVE-2014-9092 [bnc#906761]
  * added libjpeg-turbo-CVE-2014-9092.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1420891200">- Update to version 1.4.0
  + Fixed a build issue on OS X PowerPC platforms (md5cmp failed to build
    because OS X does not provide the le32toh() and htole32() functions.)
  + The non-SIMD RGB565 color conversion code did not work correctly on big
    endian machines.  This has been fixed.
  + Fixed an issue in tjPlaneSizeYUV() whereby it would erroneously return 1
    instead of -1 if componentID was &gt; 0 and subsamp was TJSAMP_GRAY.
  + Fixed an issue in tjBufSizeYUV2() wherby it would erroneously return 0
    instead of -1 if width was &lt; 1.
  + The Huffman encoder now uses clz and bsr instructions for bit counting on
    ARM64 platforms (see 1.4 beta1 [5].)
  + The close() method in the TJCompressor and TJDecompressor Java classes is
    now idempotent.  Previously, that method would call the native tjDestroy()
    function even if the TurboJPEG instance had already been destroyed.  This
    caused an exception to be thrown during finalization, if the close() method had
    already been called.  The exception was caught, but it was still an expensive
    operation.
  + The TurboJPEG API previously generated an error ("Could not determine
    subsampling type for JPEG image") when attempting to decompress grayscale JPEG
    images that were compressed with a sampling factor other than 1 (for instance,
    with 'cjpeg -grayscale -sample 2x2').  Subsampling technically has no meaning
    with grayscale JPEGs, and thus the horizontal and vertical sampling factors
    for such images are ignored by the decompressor.  However, the TurboJPEG API
    was being too rigid and was expecting the sampling factors to be equal to 1
    before it treated the image as a grayscale JPEG.
  + cjpeg, djpeg, and jpegtran now accept an argument of -version, which will
    print the library version and exit.
  + Referring to 1.4 beta1 [15], another extremely rare circumstance was
    discovered under which the Huffman encoder's local buffer can be overrun
    when a buffered destination manager is being used and an
    extremely-high-frequency block (basically junk image data) is being encoded.
    Even though the Huffman local buffer was increased from 128 bytes to 136 bytes
    to address the previous issue, the new issue caused even the larger buffer to
    be overrun.  Further analysis reveals that, in the absolute worst case (such as
    setting alternating AC coefficients to 32767 and -32768 in the JPEG scanning
    order), the Huffman encoder can produce encoded blocks that approach double the
    size of the unencoded blocks.  Thus, the Huffman local buffer was increased to
    256 bytes, which should prevent any such issue from re-occurring in the future.
  + The new tjPlaneSizeYUV(), tjPlaneWidth(), and tjPlaneHeight() functions
    were not actually usable on any platform except OS X and Windows, because
    those functions were not included in the libturbojpeg mapfile.  This has been
    fixed.
  + Restored the JPP(), JMETHOD(), and FAR macros in the libjpeg-turbo header
    files.  The JPP() and JMETHOD() macros were originally implemented in libjpeg
    as a way of supporting non-ANSI compilers that lacked support for prototype
    parameters.  libjpeg-turbo has never supported such compilers, but some
    software packages still use the macros to define their own prototypes.
    Similarly, libjpeg-turbo has never supported MS-DOS and other platforms that
    have far symbols, but some software packages still use the FAR macro.  A pretty
    good argument can be made that this is a bad practice on the part of the
    software in question, but since this affects more than one package, it's just
    easier to fix it here.
  + Fixed issues that were preventing the ARM 64-bit SIMD code from compiling
    for iOS, and included an ARMv8 architecture in all of the binaries installed by
    the "official" libjpeg-turbo SDK for OS X.
- Adapt patches to upstream changes
  libjpeg-ocloexec.patch &gt;  libjpeg-1.4.0-ocloexec.patch
  libjpeg-turbo-1.3.0-int32.patch &gt;  libjpeg-turbo-1.4.0-int32.patch
- Remove libjpeg-turbo-CVE-2014-9092.patch; fixed on upstream release
- Bump tminor to 1</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1425297600">-  Remove float tests with new libjpeg-turbo-remove-test.patch
  same as Fedora bug 1161585 related to upstream issue
  https://sourceforge.net/p/libjpeg-turbo/bugs/83/</changelog>
  <changelog author="jengelh@inai.de" date="1425556800">- Remove useless same-name provides. Use download URLs not
  dependent on directory structure.</changelog>
  <changelog author="idonmez@suse.com" date="1444305600">- Update to version 1.4.2
  + Crash fixes
  + clang compatibility fixes
  + See the included ChangeLog.txt for the details
- Drop libjpeg-turbo-1.4.0-int32.patch, not needed anymore.
- Drop libjpeg-turbo-remove-test.patch, fixed upstream.</changelog>
  <changelog author="idonmez@suse.com" date="1465387200">- Update to version 1.5.0
  + Fixed an issue whereby a malformed motion-JPEG frame could
    cause the "fast path" of libjpeg-turbo's Huffman decoder to
    read from uninitialized memory.
  + Added libjpeg-turbo version and build information to the global
    string table of the libjpeg and TurboJPEG API libraries.
  + Fixed a couple of issues in the PPM reader that would cause
    buffer overruns in cjpeg if one of the values in a binary
    PPM/PGM input file exceeded the maximum value defined in the
    file's header. libjpeg-turbo 1.4.2 already included a similar
    fix for ASCII PPM/PGM files. Note that these issues were not
    security bugs, since they were confined to the cjpeg program
    and did not affect any of the libjpeg-turbo libraries.
  + Fixed an issue whereby attempting to decompress a JPEG file with
    a corrupt header using the tjDecompressToYUV2() function would
    cause the function to abort without returning an error and,
    under certain circumstances, corrupt the stack. This only
    occurred if tjDecompressToYUV2() was called prior to calling
    tjDecompressHeader3(), or if the return value from
    tjDecompressHeader3() was ignored (both cases represent
    incorrect usage of the TurboJPEG API.)
  + The jpeg_stdio_src(), jpeg_mem_src(), jpeg_stdio_dest(),
    and jpeg_mem_dest() functions in the libjpeg API will now
    throw an error if a source/destination manager has already
    been assigned to the compress or decompress object by a
    different function or by the calling program.</changelog>
  <changelog author="idonmez@suse.com" date="1474459200">- Update to version 1.5.1 fate#324061
  + Fix for PowerPC platforms lacking AltiVec instructions
  + Fix ABI problem with clang/llvm on aarch64.
  + Fancy upsampling is now supported when decompressing JPEG
    images that use 4:4:0 (h1v2) chroma subsampling.
  + If merged upsampling isn't SIMD-accelerated but YCbCr-to-RGB
    conversion is, then libjpeg-turbo will now disable merged
    upsampling when decompressing YCbCr JPEG images into RGB
    or extended RGB output images. This significantly speeds up
    the decompression of 4:2:0 and 4:2:2 JPEGs on ARM platforms
    if fancy upsampling is not used
    (for example, if the -nosmooth option to djpeg is specified.)
  + The TurboJPEG API will now decompress 4:2:2 and 4:4:0 JPEG
    images with 2x2 luminance sampling factors and 2x1 or 1x2
    chrominance sampling factors.
  + Fixed an unsigned integer overflow in the libjpeg memory manager.
  + Fixed additional negative left shifts and other issues reported
    by the GCC and Clang undefined behavior sanitizers when
    attempting to decompress specially-crafted malformed JPEG
    images. None of these issues posed a security threat, but
    removing the warnings makes it easier to detect actual
    security issues, should they arise in the future.
  + Fixed an out-of-bounds array reference, introduced by
    1.4.902 and detected by the Clang undefined behavior sanitizer,
    that could be triggered by a specially-crafted malformed
    JPEG image with more than four components. Because the
    out-of-bounds reference was still within the same structure,
    it was not known to pose a security threat, but removing
    the warning makes it easier to detect actual security issues,
    should they arise in the future.</changelog>
  <changelog author="bwiedemann@suse.com" date="1484740800">- set build date to enable reproducible builds</changelog>
  <changelog author="pgajdos@suse.com" date="1507809600">- Update to version 1.5.2
  + Fixed several memory leaks in the TurboJPEG API library that
    could occur if the library was built with certain compilers
    and optimization levels.
  + The libjpeg-turbo memory manager will now honor the
    max_memory_to_use structure member in jpeg_memory_mgr,
    which can be set to the maximum amount of memory (in bytes)
    that libjpeg-turbo should use during decompression or
    multi-pass (including progressive) compression. This limit
    can also be set using the JPEGMEM environment variable or
    using the -maxmemory switch in cjpeg/djpeg/jpegtran.
  + TJBench will now run each benchmark for 1 second prior to
    starting the timer, in order to improve the consistency of
    the results. Furthermore, the -warmup option is now used to
    specify the amount of warmup time rather than the number of
    warmup iterations.
  + Fixed an error (short jump is out of range) that occurred
    when assembling the 32-bit x86 SIMD extensions with NASM
    versions prior to 2.04.
  + Fixed a regression introduced by 1.5 beta1[11] that prevented
    the Java version of TJBench from outputting any reference images
    (the -nowrite switch was accidentally enabled by default.)
    libjpeg-turbo should now build and run with full AltiVec SIMD
    acceleration on PowerPC-based AmigaOS 4 and OpenBSD systems.</changelog>
  <changelog author="pgajdos@suse.com" date="1507809601">- security update:
  * CVE-2017-15232 [bsc#1062937]
    + libjpeg-turbo-CVE-2017-15232.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1513598400">- - update to version 1.5.3
  1. Fixed a NullPointerException in the TurboJPEG Java wrapper that occurred
  when using the YUVImage constructor that creates an instance backed by separate
  image planes and allocates memory for the image planes.
  2. Fixed an issue whereby the Java version of TJUnitTest would fail when
  testing BufferedImage encoding/decoding on big endian systems.
  3. Fixed a segfault in djpeg that would occur if an output format other than
  PPM/PGM was selected along with the `-crop` option.  The `-crop` option now
  works with the GIF and Targa formats as well (unfortunately, it cannot be made
  to work with the BMP and RLE formats due to the fact that those output engines
  write scanlines in bottom-up order.)  djpeg will now exit gracefully if an
  output format other than PPM/PGM, GIF, or Targa is selected along with the
  `-crop` option.
  4. Fixed an issue whereby `jpeg_skip_scanlines()` would segfault if color
  quantization was enabled.
  5. TJBench (both C and Java versions) will now display usage information if any
  command-line argument is unrecognized.  This prevents the program from silently
  ignoring typos.
  6. Fixed an access violation in tjbench.exe (Windows) that occurred when the
  program was used to decompress an existing JPEG image.
  7. Fixed an ArrayIndexOutOfBoundsException in the TJExample Java program that
  occurred when attempting to decompress a JPEG image that had been compressed
  with 4:1:1 chrominance subsampling.
  8. Fixed an issue whereby, when using `jpeg_skip_scanlines()` to skip to the
  end of a single-scan (non-progressive) image, subsequent calls to
  `jpeg_consume_input()` would return `JPEG_SUSPENDED` rather than
  `JPEG_REACHED_EOI`.
  9. `jpeg_crop_scanlines()` now works correctly when decompressing grayscale
  JPEG images that were compressed with a sampling factor other than 1 (for
  instance, with `cjpeg -grayscale -sample 2x2`).</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- security update:
  * CVE-2018-11813 [bsc#1096209]
    + libjpeg-turbo-CVE-2018-11813.patch
  * remove redundant libjpeg-turbo-CVE-2017-15232.patch
    [bsc#1062937#c17]</changelog>
  <changelog author="pgajdos@suse.com" date="1529409600">- security update:
  * CVE-2018-1152 [bsc#1098155]
    + libjpeg-turbo-CVE-2018-1152.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1543838400">- asan_build: build ASAN included
- debug_build: build more suitable for debugging
- disable silent rules</changelog>
  <changelog author="pgajdos@suse.com" date="1552478400">- security update
- added patches
  CVE-2018-14498 [bsc#1128712]
  + libjpeg-turbo-CVE-2018-14498.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573560000">- security update
- added patches
  CVE-2019-2201 [bsc#1156402]
  + libjpeg-turbo-CVE-2019-2201.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573646400">- security update [bsc#1156402]
- modified patches
  % libjpeg-turbo-CVE-2019-2201.patch (use upstream one)</changelog>
  <changelog author="pgajdos@suse.com" date="1591617600">- security update
- added patches
  fix CVE-2020-13790 [bsc#1172491], heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file
  + libjpeg-turbo-CVE-2020-13790.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1622721600">- security update
- added patches
  fix CVE-2020-17541 [bsc#1186764], stack-based buffer overflow in the "transform" component
  + libjpeg-turbo-CVE-2020-17541.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-35538 [bsc#1202915], Null pointer dereference in jcopy_sample_rows() function
  + libjpeg-turbo-CVE-2020-35538.patch</changelog>
</package>
<package pkgid="2acb0b612a56dcf41b7bb4f4487c5c6754148d53c32407c2e3717bcb6d4ff56c" name="libjpeg8" arch="aarch64">
  <version epoch="0" ver="8.1.2" rel="150000.32.5.1"/>
  <changelog author="pgajdos@suse.com" date="1417089600">- security update CVE-2014-9092 [bnc#906761]
  * added libjpeg-turbo-CVE-2014-9092.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1420891200">- Update to version 1.4.0
  + Fixed a build issue on OS X PowerPC platforms (md5cmp failed to build
    because OS X does not provide the le32toh() and htole32() functions.)
  + The non-SIMD RGB565 color conversion code did not work correctly on big
    endian machines.  This has been fixed.
  + Fixed an issue in tjPlaneSizeYUV() whereby it would erroneously return 1
    instead of -1 if componentID was &gt; 0 and subsamp was TJSAMP_GRAY.
  + Fixed an issue in tjBufSizeYUV2() wherby it would erroneously return 0
    instead of -1 if width was &lt; 1.
  + The Huffman encoder now uses clz and bsr instructions for bit counting on
    ARM64 platforms (see 1.4 beta1 [5].)
  + The close() method in the TJCompressor and TJDecompressor Java classes is
    now idempotent.  Previously, that method would call the native tjDestroy()
    function even if the TurboJPEG instance had already been destroyed.  This
    caused an exception to be thrown during finalization, if the close() method had
    already been called.  The exception was caught, but it was still an expensive
    operation.
  + The TurboJPEG API previously generated an error ("Could not determine
    subsampling type for JPEG image") when attempting to decompress grayscale JPEG
    images that were compressed with a sampling factor other than 1 (for instance,
    with 'cjpeg -grayscale -sample 2x2').  Subsampling technically has no meaning
    with grayscale JPEGs, and thus the horizontal and vertical sampling factors
    for such images are ignored by the decompressor.  However, the TurboJPEG API
    was being too rigid and was expecting the sampling factors to be equal to 1
    before it treated the image as a grayscale JPEG.
  + cjpeg, djpeg, and jpegtran now accept an argument of -version, which will
    print the library version and exit.
  + Referring to 1.4 beta1 [15], another extremely rare circumstance was
    discovered under which the Huffman encoder's local buffer can be overrun
    when a buffered destination manager is being used and an
    extremely-high-frequency block (basically junk image data) is being encoded.
    Even though the Huffman local buffer was increased from 128 bytes to 136 bytes
    to address the previous issue, the new issue caused even the larger buffer to
    be overrun.  Further analysis reveals that, in the absolute worst case (such as
    setting alternating AC coefficients to 32767 and -32768 in the JPEG scanning
    order), the Huffman encoder can produce encoded blocks that approach double the
    size of the unencoded blocks.  Thus, the Huffman local buffer was increased to
    256 bytes, which should prevent any such issue from re-occurring in the future.
  + The new tjPlaneSizeYUV(), tjPlaneWidth(), and tjPlaneHeight() functions
    were not actually usable on any platform except OS X and Windows, because
    those functions were not included in the libturbojpeg mapfile.  This has been
    fixed.
  + Restored the JPP(), JMETHOD(), and FAR macros in the libjpeg-turbo header
    files.  The JPP() and JMETHOD() macros were originally implemented in libjpeg
    as a way of supporting non-ANSI compilers that lacked support for prototype
    parameters.  libjpeg-turbo has never supported such compilers, but some
    software packages still use the macros to define their own prototypes.
    Similarly, libjpeg-turbo has never supported MS-DOS and other platforms that
    have far symbols, but some software packages still use the FAR macro.  A pretty
    good argument can be made that this is a bad practice on the part of the
    software in question, but since this affects more than one package, it's just
    easier to fix it here.
  + Fixed issues that were preventing the ARM 64-bit SIMD code from compiling
    for iOS, and included an ARMv8 architecture in all of the binaries installed by
    the "official" libjpeg-turbo SDK for OS X.
- Adapt patches to upstream changes
  libjpeg-ocloexec.patch &gt;  libjpeg-1.4.0-ocloexec.patch
  libjpeg-turbo-1.3.0-int32.patch &gt;  libjpeg-turbo-1.4.0-int32.patch
- Remove libjpeg-turbo-CVE-2014-9092.patch; fixed on upstream release
- Bump tminor to 1</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1425297600">-  Remove float tests with new libjpeg-turbo-remove-test.patch
  same as Fedora bug 1161585 related to upstream issue
  https://sourceforge.net/p/libjpeg-turbo/bugs/83/</changelog>
  <changelog author="jengelh@inai.de" date="1425556800">- Remove useless same-name provides. Use download URLs not
  dependent on directory structure.</changelog>
  <changelog author="idonmez@suse.com" date="1444305600">- Update to version 1.4.2
  + Crash fixes
  + clang compatibility fixes
  + See the included ChangeLog.txt for the details
- Drop libjpeg-turbo-1.4.0-int32.patch, not needed anymore.
- Drop libjpeg-turbo-remove-test.patch, fixed upstream.</changelog>
  <changelog author="idonmez@suse.com" date="1465387200">- Update to version 1.5.0
  + Fixed an issue whereby a malformed motion-JPEG frame could
    cause the "fast path" of libjpeg-turbo's Huffman decoder to
    read from uninitialized memory.
  + Added libjpeg-turbo version and build information to the global
    string table of the libjpeg and TurboJPEG API libraries.
  + Fixed a couple of issues in the PPM reader that would cause
    buffer overruns in cjpeg if one of the values in a binary
    PPM/PGM input file exceeded the maximum value defined in the
    file's header. libjpeg-turbo 1.4.2 already included a similar
    fix for ASCII PPM/PGM files. Note that these issues were not
    security bugs, since they were confined to the cjpeg program
    and did not affect any of the libjpeg-turbo libraries.
  + Fixed an issue whereby attempting to decompress a JPEG file with
    a corrupt header using the tjDecompressToYUV2() function would
    cause the function to abort without returning an error and,
    under certain circumstances, corrupt the stack. This only
    occurred if tjDecompressToYUV2() was called prior to calling
    tjDecompressHeader3(), or if the return value from
    tjDecompressHeader3() was ignored (both cases represent
    incorrect usage of the TurboJPEG API.)
  + The jpeg_stdio_src(), jpeg_mem_src(), jpeg_stdio_dest(),
    and jpeg_mem_dest() functions in the libjpeg API will now
    throw an error if a source/destination manager has already
    been assigned to the compress or decompress object by a
    different function or by the calling program.</changelog>
  <changelog author="idonmez@suse.com" date="1474459200">- Update to version 1.5.1 fate#324061
  + Fix for PowerPC platforms lacking AltiVec instructions
  + Fix ABI problem with clang/llvm on aarch64.
  + Fancy upsampling is now supported when decompressing JPEG
    images that use 4:4:0 (h1v2) chroma subsampling.
  + If merged upsampling isn't SIMD-accelerated but YCbCr-to-RGB
    conversion is, then libjpeg-turbo will now disable merged
    upsampling when decompressing YCbCr JPEG images into RGB
    or extended RGB output images. This significantly speeds up
    the decompression of 4:2:0 and 4:2:2 JPEGs on ARM platforms
    if fancy upsampling is not used
    (for example, if the -nosmooth option to djpeg is specified.)
  + The TurboJPEG API will now decompress 4:2:2 and 4:4:0 JPEG
    images with 2x2 luminance sampling factors and 2x1 or 1x2
    chrominance sampling factors.
  + Fixed an unsigned integer overflow in the libjpeg memory manager.
  + Fixed additional negative left shifts and other issues reported
    by the GCC and Clang undefined behavior sanitizers when
    attempting to decompress specially-crafted malformed JPEG
    images. None of these issues posed a security threat, but
    removing the warnings makes it easier to detect actual
    security issues, should they arise in the future.
  + Fixed an out-of-bounds array reference, introduced by
    1.4.902 and detected by the Clang undefined behavior sanitizer,
    that could be triggered by a specially-crafted malformed
    JPEG image with more than four components. Because the
    out-of-bounds reference was still within the same structure,
    it was not known to pose a security threat, but removing
    the warning makes it easier to detect actual security issues,
    should they arise in the future.</changelog>
  <changelog author="bwiedemann@suse.com" date="1484740800">- set build date to enable reproducible builds</changelog>
  <changelog author="pgajdos@suse.com" date="1507809600">- Update to version 1.5.2
  + Fixed several memory leaks in the TurboJPEG API library that
    could occur if the library was built with certain compilers
    and optimization levels.
  + The libjpeg-turbo memory manager will now honor the
    max_memory_to_use structure member in jpeg_memory_mgr,
    which can be set to the maximum amount of memory (in bytes)
    that libjpeg-turbo should use during decompression or
    multi-pass (including progressive) compression. This limit
    can also be set using the JPEGMEM environment variable or
    using the -maxmemory switch in cjpeg/djpeg/jpegtran.
  + TJBench will now run each benchmark for 1 second prior to
    starting the timer, in order to improve the consistency of
    the results. Furthermore, the -warmup option is now used to
    specify the amount of warmup time rather than the number of
    warmup iterations.
  + Fixed an error (short jump is out of range) that occurred
    when assembling the 32-bit x86 SIMD extensions with NASM
    versions prior to 2.04.
  + Fixed a regression introduced by 1.5 beta1[11] that prevented
    the Java version of TJBench from outputting any reference images
    (the -nowrite switch was accidentally enabled by default.)
    libjpeg-turbo should now build and run with full AltiVec SIMD
    acceleration on PowerPC-based AmigaOS 4 and OpenBSD systems.</changelog>
  <changelog author="pgajdos@suse.com" date="1507809601">- security update:
  * CVE-2017-15232 [bsc#1062937]
    + libjpeg-turbo-CVE-2017-15232.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1513598400">- - update to version 1.5.3
  1. Fixed a NullPointerException in the TurboJPEG Java wrapper that occurred
  when using the YUVImage constructor that creates an instance backed by separate
  image planes and allocates memory for the image planes.
  2. Fixed an issue whereby the Java version of TJUnitTest would fail when
  testing BufferedImage encoding/decoding on big endian systems.
  3. Fixed a segfault in djpeg that would occur if an output format other than
  PPM/PGM was selected along with the `-crop` option.  The `-crop` option now
  works with the GIF and Targa formats as well (unfortunately, it cannot be made
  to work with the BMP and RLE formats due to the fact that those output engines
  write scanlines in bottom-up order.)  djpeg will now exit gracefully if an
  output format other than PPM/PGM, GIF, or Targa is selected along with the
  `-crop` option.
  4. Fixed an issue whereby `jpeg_skip_scanlines()` would segfault if color
  quantization was enabled.
  5. TJBench (both C and Java versions) will now display usage information if any
  command-line argument is unrecognized.  This prevents the program from silently
  ignoring typos.
  6. Fixed an access violation in tjbench.exe (Windows) that occurred when the
  program was used to decompress an existing JPEG image.
  7. Fixed an ArrayIndexOutOfBoundsException in the TJExample Java program that
  occurred when attempting to decompress a JPEG image that had been compressed
  with 4:1:1 chrominance subsampling.
  8. Fixed an issue whereby, when using `jpeg_skip_scanlines()` to skip to the
  end of a single-scan (non-progressive) image, subsequent calls to
  `jpeg_consume_input()` would return `JPEG_SUSPENDED` rather than
  `JPEG_REACHED_EOI`.
  9. `jpeg_crop_scanlines()` now works correctly when decompressing grayscale
  JPEG images that were compressed with a sampling factor other than 1 (for
  instance, with `cjpeg -grayscale -sample 2x2`).</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- security update:
  * CVE-2018-11813 [bsc#1096209]
    + libjpeg-turbo-CVE-2018-11813.patch
  * remove redundant libjpeg-turbo-CVE-2017-15232.patch
    [bsc#1062937#c17]</changelog>
  <changelog author="pgajdos@suse.com" date="1529409600">- security update:
  * CVE-2018-1152 [bsc#1098155]
    + libjpeg-turbo-CVE-2018-1152.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1543838400">- asan_build: build ASAN included
- debug_build: build more suitable for debugging
- disable silent rules</changelog>
  <changelog author="pgajdos@suse.com" date="1552478400">- security update
- added patches
  CVE-2018-14498 [bsc#1128712]
  + libjpeg-turbo-CVE-2018-14498.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573560000">- security update
- added patches
  CVE-2019-2201 [bsc#1156402]
  + libjpeg-turbo-CVE-2019-2201.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573646400">- security update [bsc#1156402]
- modified patches
  % libjpeg-turbo-CVE-2019-2201.patch (use upstream one)</changelog>
  <changelog author="pgajdos@suse.com" date="1591617600">- security update
- added patches
  fix CVE-2020-13790 [bsc#1172491], heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file
  + libjpeg-turbo-CVE-2020-13790.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1622721600">- security update
- added patches
  fix CVE-2020-17541 [bsc#1186764], stack-based buffer overflow in the "transform" component
  + libjpeg-turbo-CVE-2020-17541.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-35538 [bsc#1202915], Null pointer dereference in jcopy_sample_rows() function
  + libjpeg-turbo-CVE-2020-35538.patch</changelog>
</package>
<package pkgid="ce9d4f59457f270521fa016595eedba165f2ad905a350a9f105f351aa3c36229" name="libjpeg8" arch="x86_64">
  <version epoch="0" ver="8.1.2" rel="150000.32.5.1"/>
  <changelog author="pgajdos@suse.com" date="1417089600">- security update CVE-2014-9092 [bnc#906761]
  * added libjpeg-turbo-CVE-2014-9092.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1420891200">- Update to version 1.4.0
  + Fixed a build issue on OS X PowerPC platforms (md5cmp failed to build
    because OS X does not provide the le32toh() and htole32() functions.)
  + The non-SIMD RGB565 color conversion code did not work correctly on big
    endian machines.  This has been fixed.
  + Fixed an issue in tjPlaneSizeYUV() whereby it would erroneously return 1
    instead of -1 if componentID was &gt; 0 and subsamp was TJSAMP_GRAY.
  + Fixed an issue in tjBufSizeYUV2() wherby it would erroneously return 0
    instead of -1 if width was &lt; 1.
  + The Huffman encoder now uses clz and bsr instructions for bit counting on
    ARM64 platforms (see 1.4 beta1 [5].)
  + The close() method in the TJCompressor and TJDecompressor Java classes is
    now idempotent.  Previously, that method would call the native tjDestroy()
    function even if the TurboJPEG instance had already been destroyed.  This
    caused an exception to be thrown during finalization, if the close() method had
    already been called.  The exception was caught, but it was still an expensive
    operation.
  + The TurboJPEG API previously generated an error ("Could not determine
    subsampling type for JPEG image") when attempting to decompress grayscale JPEG
    images that were compressed with a sampling factor other than 1 (for instance,
    with 'cjpeg -grayscale -sample 2x2').  Subsampling technically has no meaning
    with grayscale JPEGs, and thus the horizontal and vertical sampling factors
    for such images are ignored by the decompressor.  However, the TurboJPEG API
    was being too rigid and was expecting the sampling factors to be equal to 1
    before it treated the image as a grayscale JPEG.
  + cjpeg, djpeg, and jpegtran now accept an argument of -version, which will
    print the library version and exit.
  + Referring to 1.4 beta1 [15], another extremely rare circumstance was
    discovered under which the Huffman encoder's local buffer can be overrun
    when a buffered destination manager is being used and an
    extremely-high-frequency block (basically junk image data) is being encoded.
    Even though the Huffman local buffer was increased from 128 bytes to 136 bytes
    to address the previous issue, the new issue caused even the larger buffer to
    be overrun.  Further analysis reveals that, in the absolute worst case (such as
    setting alternating AC coefficients to 32767 and -32768 in the JPEG scanning
    order), the Huffman encoder can produce encoded blocks that approach double the
    size of the unencoded blocks.  Thus, the Huffman local buffer was increased to
    256 bytes, which should prevent any such issue from re-occurring in the future.
  + The new tjPlaneSizeYUV(), tjPlaneWidth(), and tjPlaneHeight() functions
    were not actually usable on any platform except OS X and Windows, because
    those functions were not included in the libturbojpeg mapfile.  This has been
    fixed.
  + Restored the JPP(), JMETHOD(), and FAR macros in the libjpeg-turbo header
    files.  The JPP() and JMETHOD() macros were originally implemented in libjpeg
    as a way of supporting non-ANSI compilers that lacked support for prototype
    parameters.  libjpeg-turbo has never supported such compilers, but some
    software packages still use the macros to define their own prototypes.
    Similarly, libjpeg-turbo has never supported MS-DOS and other platforms that
    have far symbols, but some software packages still use the FAR macro.  A pretty
    good argument can be made that this is a bad practice on the part of the
    software in question, but since this affects more than one package, it's just
    easier to fix it here.
  + Fixed issues that were preventing the ARM 64-bit SIMD code from compiling
    for iOS, and included an ARMv8 architecture in all of the binaries installed by
    the "official" libjpeg-turbo SDK for OS X.
- Adapt patches to upstream changes
  libjpeg-ocloexec.patch &gt;  libjpeg-1.4.0-ocloexec.patch
  libjpeg-turbo-1.3.0-int32.patch &gt;  libjpeg-turbo-1.4.0-int32.patch
- Remove libjpeg-turbo-CVE-2014-9092.patch; fixed on upstream release
- Bump tminor to 1</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1425297600">-  Remove float tests with new libjpeg-turbo-remove-test.patch
  same as Fedora bug 1161585 related to upstream issue
  https://sourceforge.net/p/libjpeg-turbo/bugs/83/</changelog>
  <changelog author="jengelh@inai.de" date="1425556800">- Remove useless same-name provides. Use download URLs not
  dependent on directory structure.</changelog>
  <changelog author="idonmez@suse.com" date="1444305600">- Update to version 1.4.2
  + Crash fixes
  + clang compatibility fixes
  + See the included ChangeLog.txt for the details
- Drop libjpeg-turbo-1.4.0-int32.patch, not needed anymore.
- Drop libjpeg-turbo-remove-test.patch, fixed upstream.</changelog>
  <changelog author="idonmez@suse.com" date="1465387200">- Update to version 1.5.0
  + Fixed an issue whereby a malformed motion-JPEG frame could
    cause the "fast path" of libjpeg-turbo's Huffman decoder to
    read from uninitialized memory.
  + Added libjpeg-turbo version and build information to the global
    string table of the libjpeg and TurboJPEG API libraries.
  + Fixed a couple of issues in the PPM reader that would cause
    buffer overruns in cjpeg if one of the values in a binary
    PPM/PGM input file exceeded the maximum value defined in the
    file's header. libjpeg-turbo 1.4.2 already included a similar
    fix for ASCII PPM/PGM files. Note that these issues were not
    security bugs, since they were confined to the cjpeg program
    and did not affect any of the libjpeg-turbo libraries.
  + Fixed an issue whereby attempting to decompress a JPEG file with
    a corrupt header using the tjDecompressToYUV2() function would
    cause the function to abort without returning an error and,
    under certain circumstances, corrupt the stack. This only
    occurred if tjDecompressToYUV2() was called prior to calling
    tjDecompressHeader3(), or if the return value from
    tjDecompressHeader3() was ignored (both cases represent
    incorrect usage of the TurboJPEG API.)
  + The jpeg_stdio_src(), jpeg_mem_src(), jpeg_stdio_dest(),
    and jpeg_mem_dest() functions in the libjpeg API will now
    throw an error if a source/destination manager has already
    been assigned to the compress or decompress object by a
    different function or by the calling program.</changelog>
  <changelog author="idonmez@suse.com" date="1474459200">- Update to version 1.5.1 fate#324061
  + Fix for PowerPC platforms lacking AltiVec instructions
  + Fix ABI problem with clang/llvm on aarch64.
  + Fancy upsampling is now supported when decompressing JPEG
    images that use 4:4:0 (h1v2) chroma subsampling.
  + If merged upsampling isn't SIMD-accelerated but YCbCr-to-RGB
    conversion is, then libjpeg-turbo will now disable merged
    upsampling when decompressing YCbCr JPEG images into RGB
    or extended RGB output images. This significantly speeds up
    the decompression of 4:2:0 and 4:2:2 JPEGs on ARM platforms
    if fancy upsampling is not used
    (for example, if the -nosmooth option to djpeg is specified.)
  + The TurboJPEG API will now decompress 4:2:2 and 4:4:0 JPEG
    images with 2x2 luminance sampling factors and 2x1 or 1x2
    chrominance sampling factors.
  + Fixed an unsigned integer overflow in the libjpeg memory manager.
  + Fixed additional negative left shifts and other issues reported
    by the GCC and Clang undefined behavior sanitizers when
    attempting to decompress specially-crafted malformed JPEG
    images. None of these issues posed a security threat, but
    removing the warnings makes it easier to detect actual
    security issues, should they arise in the future.
  + Fixed an out-of-bounds array reference, introduced by
    1.4.902 and detected by the Clang undefined behavior sanitizer,
    that could be triggered by a specially-crafted malformed
    JPEG image with more than four components. Because the
    out-of-bounds reference was still within the same structure,
    it was not known to pose a security threat, but removing
    the warning makes it easier to detect actual security issues,
    should they arise in the future.</changelog>
  <changelog author="bwiedemann@suse.com" date="1484740800">- set build date to enable reproducible builds</changelog>
  <changelog author="pgajdos@suse.com" date="1507809600">- Update to version 1.5.2
  + Fixed several memory leaks in the TurboJPEG API library that
    could occur if the library was built with certain compilers
    and optimization levels.
  + The libjpeg-turbo memory manager will now honor the
    max_memory_to_use structure member in jpeg_memory_mgr,
    which can be set to the maximum amount of memory (in bytes)
    that libjpeg-turbo should use during decompression or
    multi-pass (including progressive) compression. This limit
    can also be set using the JPEGMEM environment variable or
    using the -maxmemory switch in cjpeg/djpeg/jpegtran.
  + TJBench will now run each benchmark for 1 second prior to
    starting the timer, in order to improve the consistency of
    the results. Furthermore, the -warmup option is now used to
    specify the amount of warmup time rather than the number of
    warmup iterations.
  + Fixed an error (short jump is out of range) that occurred
    when assembling the 32-bit x86 SIMD extensions with NASM
    versions prior to 2.04.
  + Fixed a regression introduced by 1.5 beta1[11] that prevented
    the Java version of TJBench from outputting any reference images
    (the -nowrite switch was accidentally enabled by default.)
    libjpeg-turbo should now build and run with full AltiVec SIMD
    acceleration on PowerPC-based AmigaOS 4 and OpenBSD systems.</changelog>
  <changelog author="pgajdos@suse.com" date="1507809601">- security update:
  * CVE-2017-15232 [bsc#1062937]
    + libjpeg-turbo-CVE-2017-15232.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1513598400">- - update to version 1.5.3
  1. Fixed a NullPointerException in the TurboJPEG Java wrapper that occurred
  when using the YUVImage constructor that creates an instance backed by separate
  image planes and allocates memory for the image planes.
  2. Fixed an issue whereby the Java version of TJUnitTest would fail when
  testing BufferedImage encoding/decoding on big endian systems.
  3. Fixed a segfault in djpeg that would occur if an output format other than
  PPM/PGM was selected along with the `-crop` option.  The `-crop` option now
  works with the GIF and Targa formats as well (unfortunately, it cannot be made
  to work with the BMP and RLE formats due to the fact that those output engines
  write scanlines in bottom-up order.)  djpeg will now exit gracefully if an
  output format other than PPM/PGM, GIF, or Targa is selected along with the
  `-crop` option.
  4. Fixed an issue whereby `jpeg_skip_scanlines()` would segfault if color
  quantization was enabled.
  5. TJBench (both C and Java versions) will now display usage information if any
  command-line argument is unrecognized.  This prevents the program from silently
  ignoring typos.
  6. Fixed an access violation in tjbench.exe (Windows) that occurred when the
  program was used to decompress an existing JPEG image.
  7. Fixed an ArrayIndexOutOfBoundsException in the TJExample Java program that
  occurred when attempting to decompress a JPEG image that had been compressed
  with 4:1:1 chrominance subsampling.
  8. Fixed an issue whereby, when using `jpeg_skip_scanlines()` to skip to the
  end of a single-scan (non-progressive) image, subsequent calls to
  `jpeg_consume_input()` would return `JPEG_SUSPENDED` rather than
  `JPEG_REACHED_EOI`.
  9. `jpeg_crop_scanlines()` now works correctly when decompressing grayscale
  JPEG images that were compressed with a sampling factor other than 1 (for
  instance, with `cjpeg -grayscale -sample 2x2`).</changelog>
  <changelog author="pgajdos@suse.com" date="1528804800">- security update:
  * CVE-2018-11813 [bsc#1096209]
    + libjpeg-turbo-CVE-2018-11813.patch
  * remove redundant libjpeg-turbo-CVE-2017-15232.patch
    [bsc#1062937#c17]</changelog>
  <changelog author="pgajdos@suse.com" date="1529409600">- security update:
  * CVE-2018-1152 [bsc#1098155]
    + libjpeg-turbo-CVE-2018-1152.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1543838400">- asan_build: build ASAN included
- debug_build: build more suitable for debugging
- disable silent rules</changelog>
  <changelog author="pgajdos@suse.com" date="1552478400">- security update
- added patches
  CVE-2018-14498 [bsc#1128712]
  + libjpeg-turbo-CVE-2018-14498.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573560000">- security update
- added patches
  CVE-2019-2201 [bsc#1156402]
  + libjpeg-turbo-CVE-2019-2201.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573646400">- security update [bsc#1156402]
- modified patches
  % libjpeg-turbo-CVE-2019-2201.patch (use upstream one)</changelog>
  <changelog author="pgajdos@suse.com" date="1591617600">- security update
- added patches
  fix CVE-2020-13790 [bsc#1172491], heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file
  + libjpeg-turbo-CVE-2020-13790.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1622721600">- security update
- added patches
  fix CVE-2020-17541 [bsc#1186764], stack-based buffer overflow in the "transform" component
  + libjpeg-turbo-CVE-2020-17541.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1662638400">- security update
- added patches
  fix CVE-2020-35538 [bsc#1202915], Null pointer dereference in jcopy_sample_rows() function
  + libjpeg-turbo-CVE-2020-35538.patch</changelog>
</package>
<package pkgid="099c3b2afb3d4d29fb75428e857430d22c778bcce68b670bcfe24da7610c7b06" name="libksba" arch="src">
  <version epoch="0" ver="1.3.5" rel="150000.4.3.1"/>
  <changelog author="puzel@suse.cz" date="1222344000">- update to 1.0.4
  * autoconf fixes
- correctly install/uninstall info files
- use %makeinstall and %configure macros</changelog>
  <changelog author="puzel@suse.cz" date="1231761600">- update to 1.0.5 (bugfix release)
  - minor bugfixes</changelog>
  <changelog author="crrodriguez@suse.de" date="1239105600">- remove static libraries and "la" files
- fix buildrequires and -devel package dependencies</changelog>
  <changelog author="puzel@suse.cz" date="1245844800">- update to libksba-1.0.6
  * Support SHA-{384,512} based signature generation.
  * The RSA algorithmIdentifier ASN.1 sequence is now emitted with an
  explicit NULL parameter.  Despite the interop testing we did in the
  past, some software still requires this and thus we better follow
  the best current practise.</changelog>
  <changelog author="puzel@novell.com" date="1247140800">- update to libksba-1.0.7
  * Detect overflow while parsing OIDs.  Map BER encoded OIDs to well
  known names.
  * Allow mixed case names in DNs.</changelog>
  <changelog author="puzel@novell.com" date="1282046400">- update to libksba-1.0.8
  * Fixed a CMS parsing bug exhibited by Lotus Notes.</changelog>
  <changelog author="jengelh@medozas.de" date="1288526400">- Use %_smp_mflags</changelog>
  <changelog author="puzel@novell.com" date="1291377600">- update to libksba-1.1.0
  * New functions to fix a leak in dirmngr.
  * Interface changes relative to the 1.0.0 release:
  ksba_reader_set_release_notify   NEW
  ksba_writer_set_release_notify   NEW
- clean up specfile</changelog>
  <changelog author="puzel@novell.com" date="1311940800">- update to libksba-1.2.0
  - New functions to allow the creation of X.509 certificates.
  - Interface changes relative to the 1.1.0 release:
    ksba_certreq_set_serial          NEW
    ksba_certreq_set_issuer          NEW
    ksba_certreq_set_validity        NEW
    ksba_certreq_set_siginfo         NEW</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1349092800">- update to libksba 1.3.0
  - change license from GPLv2 to LGPLv3/GPLv2
  - minor bug fixes
- implement shared library packaging policy
- remove nld-build.diff which was added 2004 before package was in
  the openSUSE OBS, was never used or applied cleanly since r1</changelog>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
</package>
<package pkgid="02ed35b552d2aa5d4a0a6c7d469411004895d9fda2a5a298c65de64ad998b441" name="libksba" arch="src">
  <version epoch="0" ver="1.3.5" rel="150000.4.6.1"/>
  <changelog author="puzel@suse.cz" date="1231761600">- update to 1.0.5 (bugfix release)
  - minor bugfixes</changelog>
  <changelog author="crrodriguez@suse.de" date="1239105600">- remove static libraries and "la" files
- fix buildrequires and -devel package dependencies</changelog>
  <changelog author="puzel@suse.cz" date="1245844800">- update to libksba-1.0.6
  * Support SHA-{384,512} based signature generation.
  * The RSA algorithmIdentifier ASN.1 sequence is now emitted with an
  explicit NULL parameter.  Despite the interop testing we did in the
  past, some software still requires this and thus we better follow
  the best current practise.</changelog>
  <changelog author="puzel@novell.com" date="1247140800">- update to libksba-1.0.7
  * Detect overflow while parsing OIDs.  Map BER encoded OIDs to well
  known names.
  * Allow mixed case names in DNs.</changelog>
  <changelog author="puzel@novell.com" date="1282046400">- update to libksba-1.0.8
  * Fixed a CMS parsing bug exhibited by Lotus Notes.</changelog>
  <changelog author="jengelh@medozas.de" date="1288526400">- Use %_smp_mflags</changelog>
  <changelog author="puzel@novell.com" date="1291377600">- update to libksba-1.1.0
  * New functions to fix a leak in dirmngr.
  * Interface changes relative to the 1.0.0 release:
  ksba_reader_set_release_notify   NEW
  ksba_writer_set_release_notify   NEW
- clean up specfile</changelog>
  <changelog author="puzel@novell.com" date="1311940800">- update to libksba-1.2.0
  - New functions to allow the creation of X.509 certificates.
  - Interface changes relative to the 1.1.0 release:
    ksba_certreq_set_serial          NEW
    ksba_certreq_set_issuer          NEW
    ksba_certreq_set_validity        NEW
    ksba_certreq_set_siginfo         NEW</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1349092800">- update to libksba 1.3.0
  - change license from GPLv2 to LGPLv3/GPLv2
  - minor bug fixes
- implement shared library packaging policy
- remove nld-build.diff which was added 2004 before package was in
  the openSUSE OBS, was never used or applied cleanly since r1</changelog>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1672747200">- Security fix: [bsc#1206579, CVE-2022-47629]
  * Integer overflow in the CRL signature parser.
  * Add libksba-CVE-2022-47629.patch</changelog>
</package>
<package pkgid="ca53ed2eead7b9f330a884a37615a6f90a9eb05153983eadb378a81ece1af882" name="libksba8" arch="aarch64">
  <version epoch="0" ver="1.3.5" rel="150000.4.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1349092800">- update to libksba 1.3.0
  - change license from GPLv2 to LGPLv3/GPLv2
  - minor bug fixes
- implement shared library packaging policy
- remove nld-build.diff which was added 2004 before package was in
  the openSUSE OBS, was never used or applied cleanly since r1</changelog>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
</package>
<package pkgid="7de5ee5205feac2ac1f5a139419f0123eaa91e1402311958b61efd1415b73acf" name="libksba8" arch="x86_64">
  <version epoch="0" ver="1.3.5" rel="150000.4.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1349092800">- update to libksba 1.3.0
  - change license from GPLv2 to LGPLv3/GPLv2
  - minor bug fixes
- implement shared library packaging policy
- remove nld-build.diff which was added 2004 before package was in
  the openSUSE OBS, was never used or applied cleanly since r1</changelog>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
</package>
<package pkgid="39c3eda4c1c7e4fd7e6a196baf3d87a6f767c82bd4c8086e0e271afaceb7a36c" name="libksba8" arch="aarch64">
  <version epoch="0" ver="1.3.5" rel="150000.4.6.1"/>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1672747200">- Security fix: [bsc#1206579, CVE-2022-47629]
  * Integer overflow in the CRL signature parser.
  * Add libksba-CVE-2022-47629.patch</changelog>
</package>
<package pkgid="edb49c4da5f33a2cb56439a54e954ea2ac7a46962b38fee3e2ce2bd4749ae8a4" name="libksba8" arch="x86_64">
  <version epoch="0" ver="1.3.5" rel="150000.4.6.1"/>
  <changelog author="meissner@suse.com" date="1354017600">- Use URL for source</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1411300800">- libksba 1.3.1:
  * Fixed memory leak in CRL parsing
  * Build fixes for ppc64el</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1417003200">- libksba 1.3.2 [boo#907074] [CVE-2014-9087]
  This version contains a security update which fixes a buffer
  overflow in OID to string conversion code that can be triggered
  by a specially crafted S/MIME message or ECC based OpenPGP data.
  Users of GnuPG 2.x should install this version and restart the
  dirmgr process.
  * Fixed a buffer overflow in ksba_oid_to_str.
- verify source signature</changelog>
  <changelog author="astieger@suse.com" date="1426766400">- remove libtool requirement</changelog>
  <changelog author="astieger@suse.com" date="1428667200">- libksba 1.3.3:
  * Fixed an integer overflow in the DN decoder.
  * Now returns an error instead of terminating the process for
  certain bad BER encodings.
  * Improved the parsing of utf-8 strings in DNs.
  * Allow building with newer versions of Bison.</changelog>
  <changelog author="astieger@suse.com" date="1462881600">- libksba 1.3.4:
  * Fixed two OOB read access bugs which could be used to force a DoS.
  boo#979261 CVE-2016-4574, CVE-2016-4579
  * Fixed a crash due to faulty curve OID lookup code.
  * Synced the list of supported curves with those of Libgcrypt.
  * New configure option --enable-build-timestamp; a build timestamp is
  not anymore used by default.</changelog>
  <changelog author="astieger@suse.com" date="1471867200">- libksba 1.3.5:
  * Limit the allowed size of complex ASN.1 objects (e.g.
  certificates) to 16MiB.
  * Avoid read access to unitialized memory.
  * Improve detection of invalid RDNs.
  * Encode the OCSP nonce value as an octet string as described by
  RFC-6960.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security fix: [bsc#1204357, CVE-2022-3515]
  * Detect a possible overflow directly in the TLV parser.
  * Add libksba-CVE-2022-3515.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1672747200">- Security fix: [bsc#1206579, CVE-2022-47629]
  * Integer overflow in the CRL signature parser.
  * Add libksba-CVE-2022-47629.patch</changelog>
</package>
<package pkgid="67d17efda1495f16bac80b7b4870c5c1e119d16ed1336e9a5b6206cd04b63063" name="libldap-2_4-2" arch="aarch64">
  <version epoch="0" ver="2.4.46" rel="150200.14.11.2"/>
  <changelog author="william.brown@suse.com" date="1579867200">- bsc#1158921 libldap-data should be requires, not recommends to help
  prevent user confusion around configuration ownership.</changelog>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
</package>
<package pkgid="fd72b530ddbfd9c94b1afd44d1db652e4b877df377622a43dc806586b4787555" name="libldap-2_4-2" arch="x86_64">
  <version epoch="0" ver="2.4.46" rel="150200.14.11.2"/>
  <changelog author="william.brown@suse.com" date="1579867200">- bsc#1158921 libldap-data should be requires, not recommends to help
  prevent user confusion around configuration ownership.</changelog>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
</package>
<package pkgid="19e9e899f373e8b1633c3ccef0df6672a59532829c5707f95f2a2f51c7fc130c" name="libldap-data" arch="noarch">
  <version epoch="0" ver="2.4.46" rel="150200.14.11.2"/>
  <changelog author="william.brown@suse.com" date="1579867200">- bsc#1158921 libldap-data should be requires, not recommends to help
  prevent user confusion around configuration ownership.</changelog>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
</package>
<package pkgid="10182030cc01c1023c0db04aae8bf11162ab7bbe604e5239cc781f172beaade1" name="libldb2" arch="aarch64">
  <version epoch="0" ver="2.4.3" rel="150300.3.20.1"/>
  <changelog author="scabrero@suse.de" date="1542024000">- Update to 1.4.3
  + Python: Ensure ldb.Dn can accept utf8 encoded unicode (bug 13616)</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to 1.5.2
  + dirsync: Allow arbitrary length cookies (bug #13686)
  + The build uses python3 by default: --extra-python would take
    python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to 1.5.4
  + Fix standalone build of ldb.
  + C99 build fixes.
  + CVE-2019-3824 out of bounds read in wildcard compare (bug#13773)
- Update to 1.5.3
  + Avoid inefficient one-level searches (bug#13762)
  + The test api.py should not rely on order of entries in dict (bug#13772)</changelog>
  <changelog author="scabrero@suse.de" date="1564660800">- Update to 1.5.5
  + LDAP_REFERRAL_SCHEME_OPAQUE was added to ldb_module.h; (bso#12478);
  + Skip @ records early in a search full scan; (bso#13893);</changelog>
  <changelog author="jmcdonough@suse.com" date="1570104000">- Update to version 2.0.7
  + Robustness improvements against duplicate attributes in ldb_filter_attrs()
    (bso#13695)
  + Robustness improvements against invalid string DN values (bso#14049)
  + log database repack so users know what is happening (bso#14059)
  + add ldb_options_get
  + add "batch_mode" option.
  + Remove Python 2.x support except to build just the bare C library
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + Fix standalone build of ldb.
  + CVE-2019-3824 out of bounds read in wildcard compare (bso#13773)</changelog>
  <changelog author="nopower@suse.com" date="1576756800">- Add obsolete ldb1 directive to baselibs.conf</changelog>
  <changelog author="dmulder@suse.com" date="1579262400">- libldb1 fails to migrate to libldb2 when libldb2 version is less
  than libldb1 version; (bsc#1160341)</changelog>
  <changelog author="david.mulder@suse.com" date="1579694400">ldb: Release ldb 2.0.8
  + Upgrade waf to version 2.0.18 to match the rest of Samba 4.11.x
    (bso#13846)</changelog>
  <changelog author="nopower@suse.com" date="1583496000">- Release ldb 2.1.1
  + Samba 4.11 and later give incorrect results for SCOPE_ONE
    searches; (bso#14270).</changelog>
  <changelog author="nopower@suse.com" date="1588075200">- Release ldb 2.1.2
  + CVE-2020-10700: ldb: Always use ldb_next_request() in
    ASQ module; ;(bso#14331); (bsc#1169850).</changelog>
  <changelog author="david.mulder@suse.com" date="1589976000">ldb: Bump version to 2.1.3; (bso#14330)</changelog>
  <changelog author="nopower@suse.com" date="1593777600">- Release ldb 2.1.4
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when
    ASQ and VLV combined; (bso#14364); (bsc#1173159)</changelog>
  <changelog author="ddiss@suse.com" date="1599825600">- Release ldb 2.2.0
  + Fix memory leak in ldb_kv_index_dn_ordered(); (bso#14299)
  + Fix off-by-one increment in lldb_add_msg_attr; (bso#14413)</changelog>
  <changelog author="scabrero@suse.de" date="1616587200">- Release ldb 2.2.1
  + CVE-2020-27840: Unauthenticated remote heap corruption via bad DNs;
    (bso#14595); (bsc#1183572);
  + CVE-2021-20277: out of bounds read in ldb_handler_fold; (bso#14655);
    (bsc#1183574);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Add ldb-cve-2020-25718.patch &amp;
  CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch to backport all
  changes from ldb-2.4.1.
  + CVE-2020-25718: samba: An RODC can issue (forge) administrator
    tickets to other servers; (bsc#1192246); (bso#14558)
  + CVE-2021-3738: samba: crash in dsdb stack;
    (bsc#1192215);(bso#14848)
-  Release ldb 2.2.2
  + Corrected python behaviour for 'in' for LDAP attributes
  contained as part of ldb.Message;(bso#14845).
  + Fix memory handling in ldb.msg_diff
  Corrected python docstrings;(bso#14836)
  + Backport bronze bit fixes, tests, and selftest improvements;
  (bso#14881).</changelog>
  <changelog author="nopower@suse.com" date="1641297600">- Update to version 2.4.1; (jsc#SLE-23329);
  - Release 2.4.1
    + Corrected python behaviour for 'in' for LDAP attributes
    contained as part of ldb.Message; (bso#14845);
    + Fix memory handling in ldb.msg_diff; (bso#14836);
    + Corrected python docstrings
  - Release 2.4.0
    + Improve calculate_popt_array_length()
    + Use C99 initializers for builtin_popt_options[]
    + pyldb: Fix Message.items() for a message containing elements
    + pyldb: Add test for Message.items()
    + tests: Use ldbsearch '--scope instead of '-s'
    + pyldb: fix a typo
    + Change page size of guidindexpackv1.ldb
    + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream
    + attrib_handler casefold: simplify space dropping
    + fix ldb_comparison_fold off-by-one overrun
    + CVE-2020-27840: pytests: move Dn.validate test to ldb
    + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
    + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
    + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
    + improve comments for ldb_module_connect_backend()
    + test/ldb_tdb: correct introductory comments
    + ldb.h: remove undefined async_ctx function signatures
    + correct comments in attrib_handers val_to_int64
    + dn tests use cmocka print functions
    + ldb_match: remove redundant check
    + add tests for ldb_wildcard_compare
    + ldb_match: trailing chunk must match end of string
    + pyldb: catch potential overflow error in py_timestring
    + ldb: remove some 'if PY3's in tests
    + Add missing break in switch statement
- Drop obsolete patch CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch
- Drop obsolete patch ldb-cve-2020-25718.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Modify packaging to allow parallel installation with libldb1
  (bsc#1192684):
  + Private libraries are installed in %{_libdir}/ldb2/
  + Modules are installed in %{_libdir}/ldb2/modules</changelog>
  <changelog author="scabrero@suse.de" date="1649246400">- Update to version 2.4.2
  + Fix for CVE-2021-3670, ensure that the LDB request has not
    timed out during filter processing as the LDAP server
    MaxQueryDuration is otherwise not honoured (bsc#1198397).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to version 2.4.3
  + Fix build problems, waf produces incorrect names for python
    extensions; (bso#15071);</changelog>
  <changelog author="nopower@suse.com" date="1657886400">- Add ldb-memory-bug-15096-4.15-ldbonly.patch to backport all
  changes for ldb-2.4.4.
  + CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  + CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  + CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="d911a2dd1c3807dcd2763512829ab5f3fc0d0bdac2cabd9b33d529a1d4491951" name="libldb2" arch="x86_64">
  <version epoch="0" ver="2.4.3" rel="150300.3.20.1"/>
  <changelog author="scabrero@suse.de" date="1542024000">- Update to 1.4.3
  + Python: Ensure ldb.Dn can accept utf8 encoded unicode (bug 13616)</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to 1.5.2
  + dirsync: Allow arbitrary length cookies (bug #13686)
  + The build uses python3 by default: --extra-python would take
    python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to 1.5.4
  + Fix standalone build of ldb.
  + C99 build fixes.
  + CVE-2019-3824 out of bounds read in wildcard compare (bug#13773)
- Update to 1.5.3
  + Avoid inefficient one-level searches (bug#13762)
  + The test api.py should not rely on order of entries in dict (bug#13772)</changelog>
  <changelog author="scabrero@suse.de" date="1564660800">- Update to 1.5.5
  + LDAP_REFERRAL_SCHEME_OPAQUE was added to ldb_module.h; (bso#12478);
  + Skip @ records early in a search full scan; (bso#13893);</changelog>
  <changelog author="jmcdonough@suse.com" date="1570104000">- Update to version 2.0.7
  + Robustness improvements against duplicate attributes in ldb_filter_attrs()
    (bso#13695)
  + Robustness improvements against invalid string DN values (bso#14049)
  + log database repack so users know what is happening (bso#14059)
  + add ldb_options_get
  + add "batch_mode" option.
  + Remove Python 2.x support except to build just the bare C library
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + Fix standalone build of ldb.
  + CVE-2019-3824 out of bounds read in wildcard compare (bso#13773)</changelog>
  <changelog author="nopower@suse.com" date="1576756800">- Add obsolete ldb1 directive to baselibs.conf</changelog>
  <changelog author="dmulder@suse.com" date="1579262400">- libldb1 fails to migrate to libldb2 when libldb2 version is less
  than libldb1 version; (bsc#1160341)</changelog>
  <changelog author="david.mulder@suse.com" date="1579694400">ldb: Release ldb 2.0.8
  + Upgrade waf to version 2.0.18 to match the rest of Samba 4.11.x
    (bso#13846)</changelog>
  <changelog author="nopower@suse.com" date="1583496000">- Release ldb 2.1.1
  + Samba 4.11 and later give incorrect results for SCOPE_ONE
    searches; (bso#14270).</changelog>
  <changelog author="nopower@suse.com" date="1588075200">- Release ldb 2.1.2
  + CVE-2020-10700: ldb: Always use ldb_next_request() in
    ASQ module; ;(bso#14331); (bsc#1169850).</changelog>
  <changelog author="david.mulder@suse.com" date="1589976000">ldb: Bump version to 2.1.3; (bso#14330)</changelog>
  <changelog author="nopower@suse.com" date="1593777600">- Release ldb 2.1.4
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when
    ASQ and VLV combined; (bso#14364); (bsc#1173159)</changelog>
  <changelog author="ddiss@suse.com" date="1599825600">- Release ldb 2.2.0
  + Fix memory leak in ldb_kv_index_dn_ordered(); (bso#14299)
  + Fix off-by-one increment in lldb_add_msg_attr; (bso#14413)</changelog>
  <changelog author="scabrero@suse.de" date="1616587200">- Release ldb 2.2.1
  + CVE-2020-27840: Unauthenticated remote heap corruption via bad DNs;
    (bso#14595); (bsc#1183572);
  + CVE-2021-20277: out of bounds read in ldb_handler_fold; (bso#14655);
    (bsc#1183574);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Add ldb-cve-2020-25718.patch &amp;
  CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch to backport all
  changes from ldb-2.4.1.
  + CVE-2020-25718: samba: An RODC can issue (forge) administrator
    tickets to other servers; (bsc#1192246); (bso#14558)
  + CVE-2021-3738: samba: crash in dsdb stack;
    (bsc#1192215);(bso#14848)
-  Release ldb 2.2.2
  + Corrected python behaviour for 'in' for LDAP attributes
  contained as part of ldb.Message;(bso#14845).
  + Fix memory handling in ldb.msg_diff
  Corrected python docstrings;(bso#14836)
  + Backport bronze bit fixes, tests, and selftest improvements;
  (bso#14881).</changelog>
  <changelog author="nopower@suse.com" date="1641297600">- Update to version 2.4.1; (jsc#SLE-23329);
  - Release 2.4.1
    + Corrected python behaviour for 'in' for LDAP attributes
    contained as part of ldb.Message; (bso#14845);
    + Fix memory handling in ldb.msg_diff; (bso#14836);
    + Corrected python docstrings
  - Release 2.4.0
    + Improve calculate_popt_array_length()
    + Use C99 initializers for builtin_popt_options[]
    + pyldb: Fix Message.items() for a message containing elements
    + pyldb: Add test for Message.items()
    + tests: Use ldbsearch '--scope instead of '-s'
    + pyldb: fix a typo
    + Change page size of guidindexpackv1.ldb
    + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream
    + attrib_handler casefold: simplify space dropping
    + fix ldb_comparison_fold off-by-one overrun
    + CVE-2020-27840: pytests: move Dn.validate test to ldb
    + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
    + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
    + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
    + improve comments for ldb_module_connect_backend()
    + test/ldb_tdb: correct introductory comments
    + ldb.h: remove undefined async_ctx function signatures
    + correct comments in attrib_handers val_to_int64
    + dn tests use cmocka print functions
    + ldb_match: remove redundant check
    + add tests for ldb_wildcard_compare
    + ldb_match: trailing chunk must match end of string
    + pyldb: catch potential overflow error in py_timestring
    + ldb: remove some 'if PY3's in tests
    + Add missing break in switch statement
- Drop obsolete patch CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch
- Drop obsolete patch ldb-cve-2020-25718.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Modify packaging to allow parallel installation with libldb1
  (bsc#1192684):
  + Private libraries are installed in %{_libdir}/ldb2/
  + Modules are installed in %{_libdir}/ldb2/modules</changelog>
  <changelog author="scabrero@suse.de" date="1649246400">- Update to version 2.4.2
  + Fix for CVE-2021-3670, ensure that the LDB request has not
    timed out during filter processing as the LDAP server
    MaxQueryDuration is otherwise not honoured (bsc#1198397).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to version 2.4.3
  + Fix build problems, waf produces incorrect names for python
    extensions; (bso#15071);</changelog>
  <changelog author="nopower@suse.com" date="1657886400">- Add ldb-memory-bug-15096-4.15-ldbonly.patch to backport all
  changes for ldb-2.4.4.
  + CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  + CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  + CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="3ea5f7bb86c186c414dae7b4fd8f21288421002961843ca9967a57966150c60f" name="liblvm2cmd2_03" arch="aarch64">
  <version epoch="0" ver="2.03.05" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="9a01d6c3ee2e0eaf9cb873681104d789b317e6f9f7cff2c0d5ce39fa95e73255" name="liblvm2cmd2_03" arch="x86_64">
  <version epoch="0" ver="2.03.05" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="ec483b5867fec4c8c2f082f1957786fa10bb6329e5b1fa126f582f36216bbb10" name="libmount1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="6bcdfcf32d3175dc744ee936d7ce339fa0d6cf03e8b00a2360dedea9a5ff9ef4" name="libmount1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="89bf82afeaed03e4c5e3a1eb955e78248d9c1e3097d5afd7fbeb4ffe9ca5f3b0" name="libmount1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="a1a7033a728a7a3a4e44f93bdee49bc8e7c51823858746e642ae2ce59fc73385" name="libmount1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="88160d99ee6cd15096c0bc28f81c93eb7ba2dac346c9b964951875b6fbd32622" name="libmount1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="09c78dced3e2f51743a618ae9166555037acef2dfdc3e96b08f534adea952271" name="libmount1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="5827f75170e8f4cd32e803380066d24f18a829f6633c6d4022224d62e7fcd46d" name="libmpath0" arch="aarch64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.14.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+190+suse.fe234ea:
  * Fixes for daemon shutdown issues from  SLE(bsc#1110060, bsc#1110439)
  - multipathd: allow shutdown during configure()
  * fix compilation of external programs with -lmultipath
  (bsc#1133957, necessary after the above fix)
  * Minor upstream fixes</changelog>
  <changelog author="mwilck@suse.com" date="1600257601">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
</package>
<package pkgid="7d8b0d6b7bf8b10847045a93792caf3184655d7e28913aff942ae9a17d76c3a5" name="libmpath0" arch="x86_64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.14.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+190+suse.fe234ea:
  * Fixes for daemon shutdown issues from  SLE(bsc#1110060, bsc#1110439)
  - multipathd: allow shutdown during configure()
  * fix compilation of external programs with -lmultipath
  (bsc#1133957, necessary after the above fix)
  * Minor upstream fixes</changelog>
  <changelog author="mwilck@suse.com" date="1600257601">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
</package>
<package pkgid="f2be476f9ccc8aa9c1356d1d4e0990fcafcf3a727f1e2e1af32e764542ae7f16" name="libmpath0" arch="aarch64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.17.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="eeb24b27cdf5ae9dcfc79b81bf704eaca14eaeeb0e133ae88dc25809ca923b90" name="libmpath0" arch="x86_64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.17.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="5d4c98cf2d61ef6e67bc08166b50671361e0e08c63a7b6d112c825319abe4603" name="libncurses6" arch="aarch64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="799b94b2f599af5834d7d7848bc6b2658ea336269572e3f763d1b72d2348ee7d" name="libncurses6" arch="x86_64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="e8fef1e53aaf14812a854e75c1d033efa88e46fa0539f3a444b51c6400c9e25e" name="libogg" arch="src">
  <version epoch="0" ver="1.3.2" rel="150000.3.4.1"/>
  <changelog author="tiwai@suse.de" date="1133524800">- updated to version 1.1.3.</changelog>
  <changelog author="tiwai@suse.de" date="1136980800">- compile with -fstack-protector.</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="tiwai@suse.de" date="1176724800">- follow library packaging policy
  * move docs to devel package
  * remove static library
- remove obsoleted m4 files</changelog>
  <changelog author="crrodriguez@suse.de" date="1186833600">- really follow the library packaging policy
- run make check
- add missing glibc-devel dependency on -devel package</changelog>
  <changelog author="ro@suse.de" date="1207828800">- added baselibs.conf file to build xxbit packages
  for multilib support</changelog>
  <changelog author="coolo@suse.de" date="1210507200">- fix rename of xxbit packages</changelog>
  <changelog author="olh@suse.de" date="1231329600">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="beineri@opensuse.org" date="1249128000">- update to version 1.1.4:
  * New async error reporting mechanism. Calls made after a fatal
    error are now safely handled in the event an error code is ignored
  * Added allocation checks useful to some embedded applications
  * fix possible read past end of buffer when reading 0 bits
  * Updates to API documentation
  * Build fixes</changelog>
  <changelog author="coolo@novell.com" date="1257249600">- updated patches to apply with fuzz=0</changelog>
  <changelog author="jengelh@medozas.de" date="1260964800">- add baselibs.conf as a source</changelog>
  <changelog author="reddwarf@opensuse.org" date="1291723200">- update to version 1.2.1
  * Various build updates (see SVN)
  * Add ogg_stream_pageout_fill() to API to allow applications
    greater explicit flexibility in page sizing.
  * Documentation updates including multiplexing description,
    terminology and API (incl. ogg_packet_clear(),
    ogg_stream_pageout_fill())
  * Correct possible buffer overwrite in stream encoding on 32 bit
    when a single packet exceed 250MB.
  * Correct read-buffer overrun [without side effects] under
    similar circumstances.
  * Update unit testing to work properly with new page spill
    heuristic.
  * Alter default flushing behavior to span less often and use
    larger page sizes when packet sizes are large.
  * Build fixes for additional compilers
  * Documentation updates
- run spec-cleaner
- removed configure.dif (reapply if -fsigned-char causes problems)
- removed libogg-compile-warning-fix.diff (upstreamed)</changelog>
  <changelog author="reddwarf@opensuse.org" date="1291809600">- update to version 1.2.2
  * Build fix (types correction) for Mac OS X
  * Update win32 project files to Visual Studio 2008
  * ogg_stream_pageout_fill documentation fix</changelog>
  <changelog author="coolo@suse.com" date="1315569600">- replace _service with real file</changelog>
  <changelog author="reddwarf@opensuse.org" date="1321790400">- updated to version 1.3.0
  * Add ogg_stream_flush_fill() call
    This produces longer packets on flush, similar to
    what ogg_stream_pageout_fill() does for single pages.
- run spec-cleaner on it
- remove "SLES10 -&gt; SLES11 upgrade path" parts since the upgrade
  already happened and anyway the entry in bugzilla is not public</changelog>
  <changelog author="idonmez@suse.com" date="1324814400">- -O20 optimization level does not exist, use -O3</changelog>
  <changelog author="coolo@suse.com" date="1324814401">- own aclocal directory</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1393156800">- Xiph libogg 1.3.1
  * Guard against very large packets.
  * Respect the configure --docdir override.
  * Documentation fixes.
- fix SLE build</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.3.2
  * Fix an bug in oggpack_writecopy().</changelog>
  <changelog author="jengelh@inai.de" date="1489233600">- Orthographic fixes to descriptions. RPM group fix.</changelog>
</package>
<package pkgid="537537979c2213474173dcead97adeb0506a4e30f254c82ab7b0b766fbebfb1e" name="libogg0" arch="aarch64">
  <version epoch="0" ver="1.3.2" rel="150000.3.4.1"/>
  <changelog author="jengelh@medozas.de" date="1260964800">- add baselibs.conf as a source</changelog>
  <changelog author="reddwarf@opensuse.org" date="1291723200">- update to version 1.2.1
  * Various build updates (see SVN)
  * Add ogg_stream_pageout_fill() to API to allow applications
    greater explicit flexibility in page sizing.
  * Documentation updates including multiplexing description,
    terminology and API (incl. ogg_packet_clear(),
    ogg_stream_pageout_fill())
  * Correct possible buffer overwrite in stream encoding on 32 bit
    when a single packet exceed 250MB.
  * Correct read-buffer overrun [without side effects] under
    similar circumstances.
  * Update unit testing to work properly with new page spill
    heuristic.
  * Alter default flushing behavior to span less often and use
    larger page sizes when packet sizes are large.
  * Build fixes for additional compilers
  * Documentation updates
- run spec-cleaner
- removed configure.dif (reapply if -fsigned-char causes problems)
- removed libogg-compile-warning-fix.diff (upstreamed)</changelog>
  <changelog author="reddwarf@opensuse.org" date="1291809600">- update to version 1.2.2
  * Build fix (types correction) for Mac OS X
  * Update win32 project files to Visual Studio 2008
  * ogg_stream_pageout_fill documentation fix</changelog>
  <changelog author="coolo@suse.com" date="1315569600">- replace _service with real file</changelog>
  <changelog author="reddwarf@opensuse.org" date="1321790400">- updated to version 1.3.0
  * Add ogg_stream_flush_fill() call
    This produces longer packets on flush, similar to
    what ogg_stream_pageout_fill() does for single pages.
- run spec-cleaner on it
- remove "SLES10 -&gt; SLES11 upgrade path" parts since the upgrade
  already happened and anyway the entry in bugzilla is not public</changelog>
  <changelog author="idonmez@suse.com" date="1324814400">- -O20 optimization level does not exist, use -O3</changelog>
  <changelog author="coolo@suse.com" date="1324814401">- own aclocal directory</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1393156800">- Xiph libogg 1.3.1
  * Guard against very large packets.
  * Respect the configure --docdir override.
  * Documentation fixes.
- fix SLE build</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.3.2
  * Fix an bug in oggpack_writecopy().</changelog>
  <changelog author="jengelh@inai.de" date="1489233600">- Orthographic fixes to descriptions. RPM group fix.</changelog>
</package>
<package pkgid="7962add6eb67f2946eb54ad7d5952325087f3ae775d600f8f82140dfae2e07e0" name="libogg0" arch="x86_64">
  <version epoch="0" ver="1.3.2" rel="150000.3.4.1"/>
  <changelog author="jengelh@medozas.de" date="1260964800">- add baselibs.conf as a source</changelog>
  <changelog author="reddwarf@opensuse.org" date="1291723200">- update to version 1.2.1
  * Various build updates (see SVN)
  * Add ogg_stream_pageout_fill() to API to allow applications
    greater explicit flexibility in page sizing.
  * Documentation updates including multiplexing description,
    terminology and API (incl. ogg_packet_clear(),
    ogg_stream_pageout_fill())
  * Correct possible buffer overwrite in stream encoding on 32 bit
    when a single packet exceed 250MB.
  * Correct read-buffer overrun [without side effects] under
    similar circumstances.
  * Update unit testing to work properly with new page spill
    heuristic.
  * Alter default flushing behavior to span less often and use
    larger page sizes when packet sizes are large.
  * Build fixes for additional compilers
  * Documentation updates
- run spec-cleaner
- removed configure.dif (reapply if -fsigned-char causes problems)
- removed libogg-compile-warning-fix.diff (upstreamed)</changelog>
  <changelog author="reddwarf@opensuse.org" date="1291809600">- update to version 1.2.2
  * Build fix (types correction) for Mac OS X
  * Update win32 project files to Visual Studio 2008
  * ogg_stream_pageout_fill documentation fix</changelog>
  <changelog author="coolo@suse.com" date="1315569600">- replace _service with real file</changelog>
  <changelog author="reddwarf@opensuse.org" date="1321790400">- updated to version 1.3.0
  * Add ogg_stream_flush_fill() call
    This produces longer packets on flush, similar to
    what ogg_stream_pageout_fill() does for single pages.
- run spec-cleaner on it
- remove "SLES10 -&gt; SLES11 upgrade path" parts since the upgrade
  already happened and anyway the entry in bugzilla is not public</changelog>
  <changelog author="idonmez@suse.com" date="1324814400">- -O20 optimization level does not exist, use -O3</changelog>
  <changelog author="coolo@suse.com" date="1324814401">- own aclocal directory</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1393156800">- Xiph libogg 1.3.1
  * Guard against very large packets.
  * Respect the configure --docdir override.
  * Documentation fixes.
- fix SLE build</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.3.2
  * Fix an bug in oggpack_writecopy().</changelog>
  <changelog author="jengelh@inai.de" date="1489233600">- Orthographic fixes to descriptions. RPM group fix.</changelog>
</package>
<package pkgid="a9fda0d1656d2dec1af29c21a46b03eff5c4e6f44c334d14ea0aa49830221779" name="libonig4" arch="aarch64">
  <version epoch="0" ver="6.7.0" rel="150000.3.3.1"/>
  <changelog author="mrueckert@suse.de" date="1135684800">- Initial package of version 2.5.1</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="mrueckert@suse.de" date="1159531200">- update to version 2.5.7:
  many fixes.</changelog>
  <changelog author="gber@opensuse.org" date="1281787200">- update to version 5.9.2:
  + many fixes
- cleanup:
  + split into liborig2 and oniguruma-devel subpackages
  + corrected license information
  + changed summary to conform with policy</changelog>
  <changelog author="i@marguerite.su" date="1410004800">- update version 5.9.5
  * [impl] escape warnings for -Wall.
  * [impl] remove unused variable.
- changes in 5.9.4
  * [dist] add oniguruma.pc.in file
- changes in 5.9.3
  * fix print_tree ENCLOSE_OPTION bug</changelog>
  <changelog author="i@marguerite.su" date="1445428800">- update version 5.9.6
  * [impl] add onigenc_end_unicode().
  * [impl] add onig_add_end_call().</changelog>
  <changelog author="mrueckert@suse.de" date="1456833600">- remove ruby build requires. seems unused.</changelog>
  <changelog author="mrueckert@suse.de" date="1502107200">- Version 6.5.0
  - [new] support Absent clear (Absent functions)
  - abolish configure option: --enable-combination-explosion-check
  - [new] support Absent functions (?~...)
  - fix #65: SIZEOF_SIZE_T doesn't exist on certain architecutres
  - [new] support \O (true anychar)
  - [new] support \K (keep)
  - add new node type: NODE_GIMMICK
  - [new] support \N (no newline)
  - [new] support \R (general newline)
  - [new] support if-then-else syntax
  - [new] support backref validity checker
- Version 6.4.0
  - fix memory leaks
  - change encoding of doc/XXXX.ja from EUC-JP to UTF-8
  - update doc/RE, and doc/RE.ja
  - fix fatal bug of endless repeat check on Windows
  - PR #62 : add check for return values
  - [new] support call zero (\g{0})
  - [new] support relative call by positive number
  - [new] support relative back-reference by positive number
  - fix #60 : check value type
  - change output format for ONIG_DEBUG_COMPILE and
    ONIG_DEBUG_MATCH
- Version 6.3.0
  - fix #60 : invalid state(CCS_VALUE) in parse_char_class()
  - fix #59 : access to invalid address by reg-&gt;dmax value
  - fix invalid increment of start position in onig_scan()
  - fix #58 : access to invalid address by reg-&gt;dmin value
  - fix #57 : DATA_ENSURE() check must be before data access
  - fix #56 : return invalid result for codepoint 0xFFFFFFFF
  - [new] add \o{17777777777} syntax.
  - fix #55 : Byte value expressed in octal must be smaller than
    256
- Version 6.2.0
  - fix: size in xmemcpy in stack_double (PR #51)
  - Initialize return value
  - NEW API: add onig_set_capture_num_limit()
  - change MemNumType from short int to int
  - fix: [0-9-a] was not allowed as [0-9\-a]
  - fix: illegal capture after recursive call
  - fix: problem with optimization of \z
  - fix: .* optimization
  - Set a limit of parser recursion
  - fix; that warnings are not shown properly
  - fix: /[a-c#]+\W/ =~ "def#" fails when encoding is UTF-16/32
  - fix: /[\x{0}-X]/i doesn't match properly when UTF-16/32 is
    used.
- Version 6.1.3
  - fix: Syntax error: redirection unexpected (expecting word) #35
- Version 6.1.2
  - allow word bound, word begin and word end in look-behind.
  - add ONIG_OPTION_CHECK_VALIDITY_OF_STRING option.
  - fix use after free node.
  - fix memory leaks after parsing regexp error.
  - implement many of is_valid_mbc_string().
- Version 6.1.1
  - fix segfault /W.?{888}{888}{888}\x00/ (found by libfuzzer)
  - fix error unmatched close parenthesis for %{(.*?)} #23
- Version 6.1.0
  - add contributed/libfuzzer-onig.cpp  (thanks hannob)
  - update LTVERSION 4:0:0
  - NEW API: onigenc_is_valid_mbc_string().
  - add is_valid_mbc_string() member into OnigEncodingType.
  - fix out of bounds read.
  - disable USE_INVALID_CODE_SCHEME.
  - doc/RE improved.
  - add onig_scan() into doc/API.
  - fix bug: Out of bounds read in onig_strcpy() #17
  - fix bug: infinite loop of backreference and group.
  - fix out of bounds read in mbc_to_code() #16
  - doc/RE refinements.
  - add onig_scan() (NEW API)
  - reimplement match stack allocation for case too many repeat
  - and too many captures in regexp.
  - number of captures &lt;= 32767 for bytecode representation.
  - don't use int_map_backward for thread-safe.
  - fix case of enclosed option in look-behind.
  - fix ignore case in look-behind.
  - fix memory leak in onig_unicode_define_user_property()
  - declare variables at the top of scope.  (thanks nmaya)
- Version 6.0.0
  - add NEW API: onig_unicode_define_user_property()
  - update Unicode data to 8.0.0
  - change OnigCodePoint type to unsigned int.
  - add doc/UNICODE_PROPERTIES.
  - add error code ONIGERR_FAIL_TO_INITIALIZE.
  - add make_win64/32.bat.
  - fix bug of uninitialized regex_t value on error.
  - reimplement Unicode case folding.
  - update LTVERSION = 3.0.0
  - remove all THREAD_ macro.
  - add init member into OnigEncoding. (add onig_initialize())
  - remove state member of regex.
  - move source files into src/
  - rename configre.in to configure.ac.
  - fix memory leak. (thanks pigzang)
  - change mail address.</changelog>
  <changelog author="avindra@opensuse.org" date="1514030400">- Version 6.7.0
  - add ONIG_SYNTAX_ONIGURUMA (default syntax)
  - restructure StackType
  - implement subexp calls (?R), (?&amp;name), (?-n), (?+n) for Perl
    syntax
  - use string pool of gperf for Unicode Property lookup function
  - fix an empty greedy regex and a word boundary (.*\b) fails
  - remove a stack type STK_POS
  - add a declaration of onig_end()
  - fix compilation failure in out-of-source build
  - [new] hexadecimal codepoint \uHHHH
- Version 6.6.1
  - fix definition of \X to (?&gt;\O(?:\Y\O)*)
- Version 6.6.0
  - rename Absent clear to Range clear
  - [new] Extended Grapheme Cluster \X and boundary \y, \Y
  - fix: invalid index(ctype) value assigned to Unicode Block
    properties
  - --enable-crnl-as-line-terminator to be deprecated
  - [new] ASCII only mode options (?WDSP)
  - [new] ONIG_OPTION_XXXX_IS_ASCII  options
  - disable OP_CCLASS_NODE
  - [spec] Absent clear restore previous range value at backtrack
  - optimize for simple one char repetition in Absent expression
  - fix: invalid impl. for reluctant repetition in Absent expression
  - remove compile switch USE_NAMED_GROUP
  - Visual Studio 2005 compilation fixed
- cleanup with spec-cleaner</changelog>
  <changelog author="mrueckert@suse.de" date="1661515200">- Added d3e402928b6eb3327f8f7d59a9edfa622fec557b.patch: (boo#1157805 CVE-2019-19246)
  oniguruma: Heap-based buffer over-read in str_lower_case_match in regexec.c
- Added 6eb4aca6a7f2f60f473580576d86686ed6a6ebec.patch: (boo#1164569 CVE-2019-19204)
  oniguruma: heap-based buffer over-read in function fetch_interval_quantifier in regparse.c
- Added aa0188eaedc056dca8374ac03d0177429b495515.patch: (boo#1164550 CVE-2019-19203)
  oniguruma: heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c
- Added 4097828d7cc87589864fecf452f2cd46c5f37180.patch: (boo#1150130 CVE-2019-16163)
  oniguruma: stack Exhaustion in regcomp.c because of recursion in regparse.c.
- Added cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch: (boo#1177179 CVE-2020-26159)
  oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS
- Added 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55.patch: (boo#1142847 CVE-2019-13224)
  oniguruma: use-after-free in onig_new_deluxe() in regext.c</changelog>
</package>
<package pkgid="fe5ee85bc298d219bf33ebe6a9a6b562875eb6e83bda19066c9061fa46c28e5a" name="libonig4" arch="x86_64">
  <version epoch="0" ver="6.7.0" rel="150000.3.3.1"/>
  <changelog author="mrueckert@suse.de" date="1135684800">- Initial package of version 2.5.1</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="mrueckert@suse.de" date="1159531200">- update to version 2.5.7:
  many fixes.</changelog>
  <changelog author="gber@opensuse.org" date="1281787200">- update to version 5.9.2:
  + many fixes
- cleanup:
  + split into liborig2 and oniguruma-devel subpackages
  + corrected license information
  + changed summary to conform with policy</changelog>
  <changelog author="i@marguerite.su" date="1410004800">- update version 5.9.5
  * [impl] escape warnings for -Wall.
  * [impl] remove unused variable.
- changes in 5.9.4
  * [dist] add oniguruma.pc.in file
- changes in 5.9.3
  * fix print_tree ENCLOSE_OPTION bug</changelog>
  <changelog author="i@marguerite.su" date="1445428800">- update version 5.9.6
  * [impl] add onigenc_end_unicode().
  * [impl] add onig_add_end_call().</changelog>
  <changelog author="mrueckert@suse.de" date="1456833600">- remove ruby build requires. seems unused.</changelog>
  <changelog author="mrueckert@suse.de" date="1502107200">- Version 6.5.0
  - [new] support Absent clear (Absent functions)
  - abolish configure option: --enable-combination-explosion-check
  - [new] support Absent functions (?~...)
  - fix #65: SIZEOF_SIZE_T doesn't exist on certain architecutres
  - [new] support \O (true anychar)
  - [new] support \K (keep)
  - add new node type: NODE_GIMMICK
  - [new] support \N (no newline)
  - [new] support \R (general newline)
  - [new] support if-then-else syntax
  - [new] support backref validity checker
- Version 6.4.0
  - fix memory leaks
  - change encoding of doc/XXXX.ja from EUC-JP to UTF-8
  - update doc/RE, and doc/RE.ja
  - fix fatal bug of endless repeat check on Windows
  - PR #62 : add check for return values
  - [new] support call zero (\g{0})
  - [new] support relative call by positive number
  - [new] support relative back-reference by positive number
  - fix #60 : check value type
  - change output format for ONIG_DEBUG_COMPILE and
    ONIG_DEBUG_MATCH
- Version 6.3.0
  - fix #60 : invalid state(CCS_VALUE) in parse_char_class()
  - fix #59 : access to invalid address by reg-&gt;dmax value
  - fix invalid increment of start position in onig_scan()
  - fix #58 : access to invalid address by reg-&gt;dmin value
  - fix #57 : DATA_ENSURE() check must be before data access
  - fix #56 : return invalid result for codepoint 0xFFFFFFFF
  - [new] add \o{17777777777} syntax.
  - fix #55 : Byte value expressed in octal must be smaller than
    256
- Version 6.2.0
  - fix: size in xmemcpy in stack_double (PR #51)
  - Initialize return value
  - NEW API: add onig_set_capture_num_limit()
  - change MemNumType from short int to int
  - fix: [0-9-a] was not allowed as [0-9\-a]
  - fix: illegal capture after recursive call
  - fix: problem with optimization of \z
  - fix: .* optimization
  - Set a limit of parser recursion
  - fix; that warnings are not shown properly
  - fix: /[a-c#]+\W/ =~ "def#" fails when encoding is UTF-16/32
  - fix: /[\x{0}-X]/i doesn't match properly when UTF-16/32 is
    used.
- Version 6.1.3
  - fix: Syntax error: redirection unexpected (expecting word) #35
- Version 6.1.2
  - allow word bound, word begin and word end in look-behind.
  - add ONIG_OPTION_CHECK_VALIDITY_OF_STRING option.
  - fix use after free node.
  - fix memory leaks after parsing regexp error.
  - implement many of is_valid_mbc_string().
- Version 6.1.1
  - fix segfault /W.?{888}{888}{888}\x00/ (found by libfuzzer)
  - fix error unmatched close parenthesis for %{(.*?)} #23
- Version 6.1.0
  - add contributed/libfuzzer-onig.cpp  (thanks hannob)
  - update LTVERSION 4:0:0
  - NEW API: onigenc_is_valid_mbc_string().
  - add is_valid_mbc_string() member into OnigEncodingType.
  - fix out of bounds read.
  - disable USE_INVALID_CODE_SCHEME.
  - doc/RE improved.
  - add onig_scan() into doc/API.
  - fix bug: Out of bounds read in onig_strcpy() #17
  - fix bug: infinite loop of backreference and group.
  - fix out of bounds read in mbc_to_code() #16
  - doc/RE refinements.
  - add onig_scan() (NEW API)
  - reimplement match stack allocation for case too many repeat
  - and too many captures in regexp.
  - number of captures &lt;= 32767 for bytecode representation.
  - don't use int_map_backward for thread-safe.
  - fix case of enclosed option in look-behind.
  - fix ignore case in look-behind.
  - fix memory leak in onig_unicode_define_user_property()
  - declare variables at the top of scope.  (thanks nmaya)
- Version 6.0.0
  - add NEW API: onig_unicode_define_user_property()
  - update Unicode data to 8.0.0
  - change OnigCodePoint type to unsigned int.
  - add doc/UNICODE_PROPERTIES.
  - add error code ONIGERR_FAIL_TO_INITIALIZE.
  - add make_win64/32.bat.
  - fix bug of uninitialized regex_t value on error.
  - reimplement Unicode case folding.
  - update LTVERSION = 3.0.0
  - remove all THREAD_ macro.
  - add init member into OnigEncoding. (add onig_initialize())
  - remove state member of regex.
  - move source files into src/
  - rename configre.in to configure.ac.
  - fix memory leak. (thanks pigzang)
  - change mail address.</changelog>
  <changelog author="avindra@opensuse.org" date="1514030400">- Version 6.7.0
  - add ONIG_SYNTAX_ONIGURUMA (default syntax)
  - restructure StackType
  - implement subexp calls (?R), (?&amp;name), (?-n), (?+n) for Perl
    syntax
  - use string pool of gperf for Unicode Property lookup function
  - fix an empty greedy regex and a word boundary (.*\b) fails
  - remove a stack type STK_POS
  - add a declaration of onig_end()
  - fix compilation failure in out-of-source build
  - [new] hexadecimal codepoint \uHHHH
- Version 6.6.1
  - fix definition of \X to (?&gt;\O(?:\Y\O)*)
- Version 6.6.0
  - rename Absent clear to Range clear
  - [new] Extended Grapheme Cluster \X and boundary \y, \Y
  - fix: invalid index(ctype) value assigned to Unicode Block
    properties
  - --enable-crnl-as-line-terminator to be deprecated
  - [new] ASCII only mode options (?WDSP)
  - [new] ONIG_OPTION_XXXX_IS_ASCII  options
  - disable OP_CCLASS_NODE
  - [spec] Absent clear restore previous range value at backtrack
  - optimize for simple one char repetition in Absent expression
  - fix: invalid impl. for reluctant repetition in Absent expression
  - remove compile switch USE_NAMED_GROUP
  - Visual Studio 2005 compilation fixed
- cleanup with spec-cleaner</changelog>
  <changelog author="mrueckert@suse.de" date="1661515200">- Added d3e402928b6eb3327f8f7d59a9edfa622fec557b.patch: (boo#1157805 CVE-2019-19246)
  oniguruma: Heap-based buffer over-read in str_lower_case_match in regexec.c
- Added 6eb4aca6a7f2f60f473580576d86686ed6a6ebec.patch: (boo#1164569 CVE-2019-19204)
  oniguruma: heap-based buffer over-read in function fetch_interval_quantifier in regparse.c
- Added aa0188eaedc056dca8374ac03d0177429b495515.patch: (boo#1164550 CVE-2019-19203)
  oniguruma: heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c
- Added 4097828d7cc87589864fecf452f2cd46c5f37180.patch: (boo#1150130 CVE-2019-16163)
  oniguruma: stack Exhaustion in regcomp.c because of recursion in regparse.c.
- Added cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch: (boo#1177179 CVE-2020-26159)
  oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS
- Added 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55.patch: (boo#1142847 CVE-2019-13224)
  oniguruma: use-after-free in onig_new_deluxe() in regext.c</changelog>
</package>
<package pkgid="aca2a7e10109718775131780d3f35ede46725b9df939ca45a5b4ebcf77eba5f7" name="libopeniscsiusr0_2_0" arch="aarch64">
  <version epoch="0" ver="2.1.7" rel="150300.32.21.1"/>
  <changelog author="lduncan@suse.com" date="1611662400">- Update to latest upstream (no new tag yet). To fix
  bsc#1181313. Changes since last update added to
  open-iscsi-SUSE-latest.diff.bz2:
  * Fix iscsiadm segfault when exiting
  * iscsid: Add NO_SYSTEMD to CFLAGS
  * Change mkdir permissions to 0770, adjust usmask
  * Fix typo in util.py
  * iscsid: Do not allow conflicting pid-file options
  * iscsiadm: Fix memory leak in iscsiadm
  * libopeniscsiusr: Fix memory leak in iscsi_sessions_get()
  * libopeniscsiusr: Fix memory leak in iscsi_nodes_get()
  * idbm: Fix memory leak and NULL pointer dereference in idbm_rec_update_param()
  * Add etc/systemd/iscsi-init.service to SYSTEMDFILES Makefile variable</changelog>
  <changelog author="lduncan@suse.com" date="1615464000">- Updated to latest upstream 2.1.4 as 2.1.4-suse, which contains
  these changes not already present:
  * Enable iscsi.service asynchronous logins, cleanup services
    (bsc#1183421)
  * libopeniscsiusr: dont error loudly if a session isn't found when
    working through iscsi_sessions_get()
  * libopeniscsiusr: skip over removed sessions
  * libopeniscsiusr: fix error messages
  * Avoid hardcoding pkg-config to fix cross build
  * Fix iscsistart login issue when target is delayed.</changelog>
  <changelog author="lduncan@suse.com" date="1619611200">- Merged with latest from upstream, which contains these fixes:
  * Add "no wait" option to iscsiadm firmware login
  * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart
  * Log proper error message when AUTH failure occurs</changelog>
  <changelog author="lduncan@suse.com" date="1619611201">- Local (SUSE) change: update iscsi.service so that it tries to
  logon to any "onboot" and firmware targets, in case a target
  was offline when booted but back up when the service is started.
  (bsc#1153806)</changelog>
  <changelog author="lduncan@suse.com" date="1620820800">- Merge latest upstream, which added fix (bsc#1185930):
  * Set default 'startup' to 'onboot' for FW nodes</changelog>
  <changelog author="lduncan@suse.com" date="1626868800">- Merge latest upstream, which includeds:
  * Support the "qede" CMA-card driver. (bsc#1188579)
  * iscsistart: fix null pointer deref before exit</changelog>
  <changelog author="lduncan@suse.com" date="1629460800">- Merged latest upstream, which includes:
  * iscsid: set PR_SET_IO_FLUSHER (bsc#1188869)</changelog>
  <changelog author="lduncan@suse.com" date="1631102400">- Updated to latest upstream 2.1.5 as 2.1.5-suse, which contains
  these changes not already present:
  * Handle IPv6 interfaces correctly. (bsc#1187958)
  * Handle qedi correctly in NPAR mode (bsc#1187958)
  * Update iscsiadm man page (bsc#1187958)
  * Update iface.example for ipv6
  * Change iscsi IP type from defines to enum.
  * Handle recv() returning 0 in iscsid_response()</changelog>
  <changelog author="lduncan@suse.com" date="1633003200">- Update to latest from upstream, fixing:
  * Moving the executables from /sbin to /usr/sbin (bsc#1191054)
  * Remove default dependencies from iscsi-init.service
  (bsc#1187190)</changelog>
  <changelog author="lduncan@suse.com" date="1633435200">- Fix possible systemd cycle by adding an "obsoletes" for
  the old libopeniscsiusr for older versions.</changelog>
  <changelog author="lduncan@suse.com" date="1635163200">- Fix the usr-merge changes (bsc#1192013). This includes catching
  all the places that /sbin was still used directly, as well as
  making the SPEC file build using /usr/sbin for openSUSE but
  still use /sbin for SLE, for now.</changelog>
  <changelog author="lduncan@suse.com" date="1636632000">- Merged latest upstream. Mostly cleanup, but includes a fix for
  iscsi-init.service when trying to write to the root volume too
  early (bsc#1192568), as well as an upstream fix for possible
  deadlock when dealing with sysfs.</changelog>
  <changelog author="lduncan@suse.com" date="1644840000">- Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains
  bug fixes and cleanups. See the Changelog for more details.</changelog>
  <changelog author="lduncan@suse.com" date="1646481600">- Update to latest upstream, including test cleanup, minor
  bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656).</changelog>
  <changelog author="lduncan@suse.com" date="1649246400">- Updated to latest upstream, including bug fixes and cleanups.
  Changes included:
  * add handling name/value pairs for firmware login (bsc#1196113),
    including man page update for same
  * Fix bug where some package parts were installed using
    DESTDIR twice
  * general build cleanup (in prep for removing DB files from
    /etc/iscsi some day soon)
  Also, now delivering a "package config" file for libopeniscsiusr.</changelog>
  <changelog author="lduncan@suse.com" date="1651838400">- Updated to latest upstream version, tagged 2.1.7. Changes
  included:
  * updated/fixed test script
  * updated build system
  * several bug fixes, including one for bsc#1199264</changelog>
  <changelog author="lduncan@suse.com" date="1652097600">- Update to latest upstream, including:
  * Added 'distclean' to Makefile targets
  * Ensure Makefile '.PHONY' targets set up correctly
  * fix an iscsid logout bug generating a false error
    and cleanup logout error messages</changelog>
  <changelog author="lduncan@suse.com" date="1652443200">- Set initiatorname in %post (at end of install), for cases
  where root is read-only at startup time (bsc#1198457)</changelog>
  <changelog author="lduncan@suse.com" date="1655467200">- For Tumbleweed, moved logrotate files from user-specific
  directory /etc/logrotate.d to vendor-specific
  /usr/etc/logrotate.d
  (for Stefan Schubert &lt;schubi@suse.com&gt;)</changelog>
  <changelog author="lduncan@suse.com" date="1657108800">- Modify SPEC file so systemd unit files are mode 644 (not 755)
  (bsc#1200570)</changelog>
</package>
<package pkgid="7fb6ed61c116db88df2f4d80b2019574851f29980c61c975db6abb7b1f4ffc2e" name="libopeniscsiusr0_2_0" arch="x86_64">
  <version epoch="0" ver="2.1.7" rel="150300.32.21.1"/>
  <changelog author="lduncan@suse.com" date="1611662400">- Update to latest upstream (no new tag yet). To fix
  bsc#1181313. Changes since last update added to
  open-iscsi-SUSE-latest.diff.bz2:
  * Fix iscsiadm segfault when exiting
  * iscsid: Add NO_SYSTEMD to CFLAGS
  * Change mkdir permissions to 0770, adjust usmask
  * Fix typo in util.py
  * iscsid: Do not allow conflicting pid-file options
  * iscsiadm: Fix memory leak in iscsiadm
  * libopeniscsiusr: Fix memory leak in iscsi_sessions_get()
  * libopeniscsiusr: Fix memory leak in iscsi_nodes_get()
  * idbm: Fix memory leak and NULL pointer dereference in idbm_rec_update_param()
  * Add etc/systemd/iscsi-init.service to SYSTEMDFILES Makefile variable</changelog>
  <changelog author="lduncan@suse.com" date="1615464000">- Updated to latest upstream 2.1.4 as 2.1.4-suse, which contains
  these changes not already present:
  * Enable iscsi.service asynchronous logins, cleanup services
    (bsc#1183421)
  * libopeniscsiusr: dont error loudly if a session isn't found when
    working through iscsi_sessions_get()
  * libopeniscsiusr: skip over removed sessions
  * libopeniscsiusr: fix error messages
  * Avoid hardcoding pkg-config to fix cross build
  * Fix iscsistart login issue when target is delayed.</changelog>
  <changelog author="lduncan@suse.com" date="1619611200">- Merged with latest from upstream, which contains these fixes:
  * Add "no wait" option to iscsiadm firmware login
  * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart
  * Log proper error message when AUTH failure occurs</changelog>
  <changelog author="lduncan@suse.com" date="1619611201">- Local (SUSE) change: update iscsi.service so that it tries to
  logon to any "onboot" and firmware targets, in case a target
  was offline when booted but back up when the service is started.
  (bsc#1153806)</changelog>
  <changelog author="lduncan@suse.com" date="1620820800">- Merge latest upstream, which added fix (bsc#1185930):
  * Set default 'startup' to 'onboot' for FW nodes</changelog>
  <changelog author="lduncan@suse.com" date="1626868800">- Merge latest upstream, which includeds:
  * Support the "qede" CMA-card driver. (bsc#1188579)
  * iscsistart: fix null pointer deref before exit</changelog>
  <changelog author="lduncan@suse.com" date="1629460800">- Merged latest upstream, which includes:
  * iscsid: set PR_SET_IO_FLUSHER (bsc#1188869)</changelog>
  <changelog author="lduncan@suse.com" date="1631102400">- Updated to latest upstream 2.1.5 as 2.1.5-suse, which contains
  these changes not already present:
  * Handle IPv6 interfaces correctly. (bsc#1187958)
  * Handle qedi correctly in NPAR mode (bsc#1187958)
  * Update iscsiadm man page (bsc#1187958)
  * Update iface.example for ipv6
  * Change iscsi IP type from defines to enum.
  * Handle recv() returning 0 in iscsid_response()</changelog>
  <changelog author="lduncan@suse.com" date="1633003200">- Update to latest from upstream, fixing:
  * Moving the executables from /sbin to /usr/sbin (bsc#1191054)
  * Remove default dependencies from iscsi-init.service
  (bsc#1187190)</changelog>
  <changelog author="lduncan@suse.com" date="1633435200">- Fix possible systemd cycle by adding an "obsoletes" for
  the old libopeniscsiusr for older versions.</changelog>
  <changelog author="lduncan@suse.com" date="1635163200">- Fix the usr-merge changes (bsc#1192013). This includes catching
  all the places that /sbin was still used directly, as well as
  making the SPEC file build using /usr/sbin for openSUSE but
  still use /sbin for SLE, for now.</changelog>
  <changelog author="lduncan@suse.com" date="1636632000">- Merged latest upstream. Mostly cleanup, but includes a fix for
  iscsi-init.service when trying to write to the root volume too
  early (bsc#1192568), as well as an upstream fix for possible
  deadlock when dealing with sysfs.</changelog>
  <changelog author="lduncan@suse.com" date="1644840000">- Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains
  bug fixes and cleanups. See the Changelog for more details.</changelog>
  <changelog author="lduncan@suse.com" date="1646481600">- Update to latest upstream, including test cleanup, minor
  bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656).</changelog>
  <changelog author="lduncan@suse.com" date="1649246400">- Updated to latest upstream, including bug fixes and cleanups.
  Changes included:
  * add handling name/value pairs for firmware login (bsc#1196113),
    including man page update for same
  * Fix bug where some package parts were installed using
    DESTDIR twice
  * general build cleanup (in prep for removing DB files from
    /etc/iscsi some day soon)
  Also, now delivering a "package config" file for libopeniscsiusr.</changelog>
  <changelog author="lduncan@suse.com" date="1651838400">- Updated to latest upstream version, tagged 2.1.7. Changes
  included:
  * updated/fixed test script
  * updated build system
  * several bug fixes, including one for bsc#1199264</changelog>
  <changelog author="lduncan@suse.com" date="1652097600">- Update to latest upstream, including:
  * Added 'distclean' to Makefile targets
  * Ensure Makefile '.PHONY' targets set up correctly
  * fix an iscsid logout bug generating a false error
    and cleanup logout error messages</changelog>
  <changelog author="lduncan@suse.com" date="1652443200">- Set initiatorname in %post (at end of install), for cases
  where root is read-only at startup time (bsc#1198457)</changelog>
  <changelog author="lduncan@suse.com" date="1655467200">- For Tumbleweed, moved logrotate files from user-specific
  directory /etc/logrotate.d to vendor-specific
  /usr/etc/logrotate.d
  (for Stefan Schubert &lt;schubi@suse.com&gt;)</changelog>
  <changelog author="lduncan@suse.com" date="1657108800">- Modify SPEC file so systemd unit files are mode 644 (not 755)
  (bsc#1200570)</changelog>
</package>
<package pkgid="06dde86725a56598ad89d126bb3d73aa988dd2baf099dfe57852f191e3a3671d" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="e38837b1adfcd49eed1d014fc014e3d30ec7e9e03da2688a1458789067206d5d" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="8fff34089ea6b9925eeb727213b13bd64966bfef35dbd8e73de82133d374eca2" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="8a076299e3462f47acea26adc4146c58b40ecfde396d2aa49bd8ff515b7da8d5" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="badf773dcc249968d906f3e79a04b3006e0d2a175b73e6eff3350f7f47447804" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="ae0772da29ceca0726737878a8cbcb7db6a58fd042b5dca6bc2068d43f9a5ced" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="da87f23570e0b9d1f5bf520b7742461088ba240c19cd94e501a35a2061c6d902" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="07381815127b788f87e8748db7c9560b0c5c31e8d36d9891f9f913a0a2361090" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="9ebd926d3f830f19a4bce29156a8053cb238f9af6f531837c012ba8d2bfefc52" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="a365c108bd4f8563afc422b312c31ea11f32bde7d31d2a744825084f3ad3cbca" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="7c3acd1db20f413fa0b31473fa682b6d2813791c993e605634e24a891b169a10" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="8ad86e13e121e1f8bb30eca4e0d3a3b6c7aa60b25aa0c262c0168e577a91f24b" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="058a98aeb5846e1f3a680217f0426d282d3cc9b0d75e0701536f7436f278a30d" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="d8c08589d7daec52c42f737f5051372c962041cdd96a1b1936cf1b3f57e90ef2" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="cf445a1a5f4cdbb3ce6caa35e8380066dd2846b1a46987a7fef0174dfad1d1b7" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="bfbe458e71eb1b9aa3211ebfb070d83af79ef0e80e2a3b8f009441ee90e90e5f" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="8a6f6ee0e4bdc9f257b287f378cb735e1cddb75b5dfea29260a247540ed9cda9" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="21975e8495542f9a45d706e79d5b92048f1673e28b88782b1042736e66887c6b" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="8031867f6098e6a48691bfa1c1f739602eaabb0212a30aaa59e7ef66b081582f" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="87ba4bbdc9b2febfe438752c096c61cd4898b52935fbb76636dc61a927c85534" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="89b3c10be42f3962d6e15c7313b4f8e86d63ec1b7713bdeeecc800e04e0c60a9" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="2808dc94d4dfdfe3e6b15e95371e92b716b7bae109a4312672b789d899665dd1" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="8326e79a60508f4a1d48d1512783d78b94fdf074159bd1a8e982f36818b89af3" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="00eb4ebf49520e6cf9b175f7064021e8654e4d8806c2a4a0bbd079a1fcac48e7" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="44baf160c75e035604aef0227eac67c0c468a545b5ca1493d1528ebf9069794a" name="libp11-kit0" arch="aarch64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="91f832cd113d3ad981496eb7aa8b9182ad211bc8a12d14f840d913d4781319bc" name="libp11-kit0" arch="x86_64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="1a5b73f0df7e61b0e73f4241291abb1911c61ad17fbb40f3e6401daa4fdef51c" name="libpcre1" arch="aarch64">
  <version epoch="0" ver="8.45" rel="150000.20.13.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1448539200">- pcre 8.38:
  * CVE-2015-3217: Call Stack Overflow Vulnerability in match()
    bsc#933878
  * Other fixes to assertions, crashes, buffer overflows and
    performance issues found by fuzzer, affecting applications
    accepting regular expression from untrusted sources</changelog>
  <changelog author="mpluskal@suse.com" date="1465992000">- Update to version 8.39:
  * Some appropriate PCRE2 JIT improvements have been retro-fitted
    to PCRE1.
  * CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)
  * CVE-2016-1283: Heap buffer overflow DoS (boo#960837)
  * Apart from that, this is another bug-fix release.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- record minor vulnerabilities fixed in 8.39</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1486641600">- pcre 8.40:
  * Using -o with -M in pcregrep could cause unnecessary repeated
    output when the match extended over a line boundary.
  * Fix register overwite in JIT when SSE2 acceleration is enabled.
  * Ignore "show all captures" (/=) for DFA matching.
  * Fix JIT unaligned accesses on x86
  * In any wide-character mode (8-bit UTF or any 16-bit or 32-bit
    mode), without PCRE_UCP set, a negative character type such as
    \D in a positive class should cause all characters greater than
    255 to match, whatever else is in the class. There was a bug
    that caused this not to happen if a Unicode property item was
    added to such a class, for example [\D\P{Nd}] or [\W\pL].
  * When pcretest was outputing information from a callout, the
    caret indicator for the current position in the subject line
    was incorrect if it was after an escape sequence for a
    character whose code point was greater than \x{ff}.
  * A pattern such as (?&lt;RA&gt;abc)(?(R)xyz) was incorrectly compiled
    such that the conditional was interpreted as a reference to
    capturing group 1 instead of a test for recursion. Any group
    whose name began with R was misinterpreted in this way. (The
    reference interpretation should only happen if the group's name
    is precisely "R".)
  * A number of bugs have been mended relating to match start-up
    optimizations when the first thing in a pattern is a positive
    lookahead. These all applied only when PCRE_NO_START_OPTIMIZE
    was *not* set:
    + A pattern such as (?=.*X)X$ was incorrectly optimized as if
    it needed both an initial 'X' and a following 'X'.
    + Some patterns starting with an assertion that started with
    .* were incorrectly optimized as having to match at the start
    of the subject or after a newline. There are cases where this
    is not true, for example, (?=.*[A-Z])(?=.{8,16})(?!.*[\s])
    matches after the start in lines that start with spaces.
    Starting .* in an assertion is no longer taken as an
    indication of matching at the start (or after a newline).</changelog>
  <changelog author="mpluskal@suse.com" date="1496404800">- Enable jit on aarch64
- Enable profiled building</changelog>
  <changelog author="astieger@suse.com" date="1500984000">- pcre 8.41:
  * If pcregrep in multiline mode with --only-matching matched
    several lines, it restarted scanning at the next line instead
    of moving on to the end of the matched string, which can be
    several lines after the start.
  * Fix a missing else in the JIT compiler reported by 'idaifish'.
    CVE-2017-6004 bsc#1025709
  * A (?# style comment is now ignored between a basic quantifier
    and a following '+' or '?' (example: /X+(?#comment)?Y/.
  * Avoid use of a potentially overflowing buffer in pcregrep
  * Fix issues reported by fuzzers in pcretest:
  - Check for values &lt; 256 when calling isprint() in pcretest.
  - Give an error for too big a number after \O.
  * In the 32-bit library in non-UTF mode, an attempt to find a
    Unicode property for a character with a code point greater than
    0x10ffff (the Unicode maximum) caused a crash.
    CVE-2017-7186 bsc#1030066, CVE-2017-7244 bsc#1030807
  * The alternative matching function, pcre_dfa_exec() misbehaved
    if it encountered a character class with a possessive repeat,
    for example [a-f]{3}+.
  * When pcretest called pcre_copy_substring() in 32-bit mode, it
    set the buffer length incorrectly, which could result in buffer
    overflow. CVE-2017-7245 bsc#1030805, CVE-2017-7246 bsc#1030803</changelog>
  <changelog author="matz@suse.com" date="1505217600">- RunTest needs much stack, on s390x more than the default
  8 MB.  [bnc#1046102]</changelog>
  <changelog author="kstreitova@suse.com" date="1509537600">- add pcre-8.41-stack_frame_size_detection.patch to fix pcre stack
  frame size detection because modern compilers broke it by cloning
  and inlining pcre match() function [bsc#1058722]</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="bwiedemann@suse.com" date="1620734400">- Do not run profiling 'check' in parallel
  to make package build reproducible (boo#1040589)</changelog>
  <changelog author="coolo@suse.com" date="1634644800">- pcre 8.45 (the final release)
  * Fixed a small (*MARK) bug in the interpreter (Bugzilla #2771).
- pcre 8.44
  * Small patch to pcreposix.c to set the erroroffset field to -1 immediately
  after a successful compile, instead of at the start of matching to avoid a
  sanitizer complaint (regexec is supposed to be thread safe).
  * Check the size of the number after (?C as it is read, in order to avoid
  integer overflow. (bsc#1172974, CVE-2020-14155)
  * Tidy up left shifts to avoid sanitize warnings; also fix one NULL deference
  in pcretest.
- pcre 8.43
  * In a pattern such as /[^\x{100}-\x{ffff}]*[\x80-\xff]/ which has a repeated
  negative class with no characters less than 0x100 followed by a positive class
  with only characters less than 0x100, the first class was incorrectly being
  auto-possessified, causing incorrect match failures.
  * If the only branch in a conditional subpattern was anchored, the whole
  subpattern was treated as anchored, when it should not have been, since the
  assumed empty second branch cannot be anchored. Demonstrated by test patterns
  such as /(?(1)^())b/ or /(?(?=^))b/.
  * Fix subject buffer overread in JIT when UTF is disabled and \X or \R has
  a greater than 1 fixed quantifier. This issue was found by Yunho Kim.
  (bsc#1172973 CVE-2019-20838)
  * If a pattern started with a subroutine call that had a quantifier with a
  minimum of zero, an incorrect "match must start with this character" could be
  recorded. Example: /(?&amp;xxx)*ABC(?&lt;xxx&gt;XYZ)/ would (incorrectly) expect 'A' to
  be the first character of a match.
- pcre 8.42
  * If a backreference with a minimum repeat count of zero was first in a
  pattern, apart from assertions, an incorrect first matching character could be
  recorded. For example, for the pattern /(?=(a))\1?b/, "b" was incorrectly set
  as the first character of a match.
  * Fix out-of-bounds read for partial matching of /./ against an empty string
  when the newline type is CRLF.
  * When matching using the the REG_STARTEND feature of the POSIX API with a
  non-zero starting offset, unset capturing groups with lower numbers than a
  group that did capture something were not being correctly returned as "unset"
  (that is, with offset values of -1).
  * Matching the pattern /(*UTF)\C[^\v]+\x80/ against an 8-bit string
  containing multi-code-unit characters caused bad behaviour and possibly a
  crash. This issue was fixed for other kinds of repeat in release 8.37 by change
  38, but repeating character classes were overlooked.</changelog>
  <changelog author="jsikes@suse.com" date="1652270400">- Added pcre-8.45-bsc1199232-unicode-property-matching.patch
  * bsc#1199232
  * CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
</package>
<package pkgid="7ec244571a2a1237e11f045b60341a955c7bd3c96d98e7d1aa993edd236b8dfe" name="libpcre1" arch="x86_64">
  <version epoch="0" ver="8.45" rel="150000.20.13.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1448539200">- pcre 8.38:
  * CVE-2015-3217: Call Stack Overflow Vulnerability in match()
    bsc#933878
  * Other fixes to assertions, crashes, buffer overflows and
    performance issues found by fuzzer, affecting applications
    accepting regular expression from untrusted sources</changelog>
  <changelog author="mpluskal@suse.com" date="1465992000">- Update to version 8.39:
  * Some appropriate PCRE2 JIT improvements have been retro-fitted
    to PCRE1.
  * CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)
  * CVE-2016-1283: Heap buffer overflow DoS (boo#960837)
  * Apart from that, this is another bug-fix release.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- record minor vulnerabilities fixed in 8.39</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1486641600">- pcre 8.40:
  * Using -o with -M in pcregrep could cause unnecessary repeated
    output when the match extended over a line boundary.
  * Fix register overwite in JIT when SSE2 acceleration is enabled.
  * Ignore "show all captures" (/=) for DFA matching.
  * Fix JIT unaligned accesses on x86
  * In any wide-character mode (8-bit UTF or any 16-bit or 32-bit
    mode), without PCRE_UCP set, a negative character type such as
    \D in a positive class should cause all characters greater than
    255 to match, whatever else is in the class. There was a bug
    that caused this not to happen if a Unicode property item was
    added to such a class, for example [\D\P{Nd}] or [\W\pL].
  * When pcretest was outputing information from a callout, the
    caret indicator for the current position in the subject line
    was incorrect if it was after an escape sequence for a
    character whose code point was greater than \x{ff}.
  * A pattern such as (?&lt;RA&gt;abc)(?(R)xyz) was incorrectly compiled
    such that the conditional was interpreted as a reference to
    capturing group 1 instead of a test for recursion. Any group
    whose name began with R was misinterpreted in this way. (The
    reference interpretation should only happen if the group's name
    is precisely "R".)
  * A number of bugs have been mended relating to match start-up
    optimizations when the first thing in a pattern is a positive
    lookahead. These all applied only when PCRE_NO_START_OPTIMIZE
    was *not* set:
    + A pattern such as (?=.*X)X$ was incorrectly optimized as if
    it needed both an initial 'X' and a following 'X'.
    + Some patterns starting with an assertion that started with
    .* were incorrectly optimized as having to match at the start
    of the subject or after a newline. There are cases where this
    is not true, for example, (?=.*[A-Z])(?=.{8,16})(?!.*[\s])
    matches after the start in lines that start with spaces.
    Starting .* in an assertion is no longer taken as an
    indication of matching at the start (or after a newline).</changelog>
  <changelog author="mpluskal@suse.com" date="1496404800">- Enable jit on aarch64
- Enable profiled building</changelog>
  <changelog author="astieger@suse.com" date="1500984000">- pcre 8.41:
  * If pcregrep in multiline mode with --only-matching matched
    several lines, it restarted scanning at the next line instead
    of moving on to the end of the matched string, which can be
    several lines after the start.
  * Fix a missing else in the JIT compiler reported by 'idaifish'.
    CVE-2017-6004 bsc#1025709
  * A (?# style comment is now ignored between a basic quantifier
    and a following '+' or '?' (example: /X+(?#comment)?Y/.
  * Avoid use of a potentially overflowing buffer in pcregrep
  * Fix issues reported by fuzzers in pcretest:
  - Check for values &lt; 256 when calling isprint() in pcretest.
  - Give an error for too big a number after \O.
  * In the 32-bit library in non-UTF mode, an attempt to find a
    Unicode property for a character with a code point greater than
    0x10ffff (the Unicode maximum) caused a crash.
    CVE-2017-7186 bsc#1030066, CVE-2017-7244 bsc#1030807
  * The alternative matching function, pcre_dfa_exec() misbehaved
    if it encountered a character class with a possessive repeat,
    for example [a-f]{3}+.
  * When pcretest called pcre_copy_substring() in 32-bit mode, it
    set the buffer length incorrectly, which could result in buffer
    overflow. CVE-2017-7245 bsc#1030805, CVE-2017-7246 bsc#1030803</changelog>
  <changelog author="matz@suse.com" date="1505217600">- RunTest needs much stack, on s390x more than the default
  8 MB.  [bnc#1046102]</changelog>
  <changelog author="kstreitova@suse.com" date="1509537600">- add pcre-8.41-stack_frame_size_detection.patch to fix pcre stack
  frame size detection because modern compilers broke it by cloning
  and inlining pcre match() function [bsc#1058722]</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="bwiedemann@suse.com" date="1620734400">- Do not run profiling 'check' in parallel
  to make package build reproducible (boo#1040589)</changelog>
  <changelog author="coolo@suse.com" date="1634644800">- pcre 8.45 (the final release)
  * Fixed a small (*MARK) bug in the interpreter (Bugzilla #2771).
- pcre 8.44
  * Small patch to pcreposix.c to set the erroroffset field to -1 immediately
  after a successful compile, instead of at the start of matching to avoid a
  sanitizer complaint (regexec is supposed to be thread safe).
  * Check the size of the number after (?C as it is read, in order to avoid
  integer overflow. (bsc#1172974, CVE-2020-14155)
  * Tidy up left shifts to avoid sanitize warnings; also fix one NULL deference
  in pcretest.
- pcre 8.43
  * In a pattern such as /[^\x{100}-\x{ffff}]*[\x80-\xff]/ which has a repeated
  negative class with no characters less than 0x100 followed by a positive class
  with only characters less than 0x100, the first class was incorrectly being
  auto-possessified, causing incorrect match failures.
  * If the only branch in a conditional subpattern was anchored, the whole
  subpattern was treated as anchored, when it should not have been, since the
  assumed empty second branch cannot be anchored. Demonstrated by test patterns
  such as /(?(1)^())b/ or /(?(?=^))b/.
  * Fix subject buffer overread in JIT when UTF is disabled and \X or \R has
  a greater than 1 fixed quantifier. This issue was found by Yunho Kim.
  (bsc#1172973 CVE-2019-20838)
  * If a pattern started with a subroutine call that had a quantifier with a
  minimum of zero, an incorrect "match must start with this character" could be
  recorded. Example: /(?&amp;xxx)*ABC(?&lt;xxx&gt;XYZ)/ would (incorrectly) expect 'A' to
  be the first character of a match.
- pcre 8.42
  * If a backreference with a minimum repeat count of zero was first in a
  pattern, apart from assertions, an incorrect first matching character could be
  recorded. For example, for the pattern /(?=(a))\1?b/, "b" was incorrectly set
  as the first character of a match.
  * Fix out-of-bounds read for partial matching of /./ against an empty string
  when the newline type is CRLF.
  * When matching using the the REG_STARTEND feature of the POSIX API with a
  non-zero starting offset, unset capturing groups with lower numbers than a
  group that did capture something were not being correctly returned as "unset"
  (that is, with offset values of -1).
  * Matching the pattern /(*UTF)\C[^\v]+\x80/ against an 8-bit string
  containing multi-code-unit characters caused bad behaviour and possibly a
  crash. This issue was fixed for other kinds of repeat in release 8.37 by change
  38, but repeating character classes were overlooked.</changelog>
  <changelog author="jsikes@suse.com" date="1652270400">- Added pcre-8.45-bsc1199232-unicode-property-matching.patch
  * bsc#1199232
  * CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
</package>
<package pkgid="734d6768f8e20914ccec6ff39ed3e10a244a4b6047d90dddfbc8c6cde568832b" name="libpcre2-8-0" arch="aarch64">
  <version epoch="0" ver="10.31" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1434628800">- PCRE2, a re-working of the original PCRE library to provide an
  entirely new API, version 10.10. Not source compatible.
- copy of the pcre package, with the following adjustments:
  * required name changes
  * adjust pcre-8.21-multilib.patch to pcre2-10.10-multilib.patch
  * drop upstreamed pcre-8.32-visibility.patch
  * --enable-{utf8,unicode-properties} became --enable-unicode
  * drop cpp subpackage
  * make test -&gt; check
  * enable 32 bit character support</changelog>
  <changelog author="astieger@suse.com" date="1436875200">- PCRE2 10.20:
  * Callouts with string arguments and the
    pcre2_callout_enumerate() function have been implemented.
  * The PCRE2_NEVER_BACKSLASH_C option, which locks out the use of
    \C, is added.
  * The PCRE2_ALT_CIRCUMFLEX option lets ^ match after a newline at
    the end of a subject in multiline mode.
  * The way named subpatterns are handled has been refactored. The
    previous approach had several bugs.
  * The handling of \c in EBCDIC environments has been changed to
    conform to the perlebcdic document. (Incompatible change)
  * Bugs have been mended, many of them discovered by fuzzers.</changelog>
  <changelog author="jengelh@inai.de" date="1453032000">- Update to new upstream release 10.21
  * Improve JIT matching speed of patterns starting with + or *.
  * Use memchr() to find the first character in an unanchored match
  in 8-bit mode in the interpreter. This gives a significant speed
  improvement.
  * 10.20 broke the handling of [[:&gt;:]] and [[:&lt;:]] in that
  processing them could involve a buffer overflow if the
  following character was an opening parenthesis.
  * 10.20 also introduced a bug in processing this pattern:
  /((?x)(*:0))#(?'/, which was fixed.
  * A callout with a string argument containing an opening square
  bracket, for example /(?C$[$)(?&lt;]/, was incorrectly processed and
  could provoke a buffer overflow.
  * A possessively repeated conditional group that could match an empty
  string, for example, /(?(R))*+/, was incorrectly compiled.
  * The Unicode tables have been updated to Unicode 8.0.0.
  * An empty comment (?#) in a pattern was incorrectly processed and
  could provoke a buffer overflow.
  * Fix infinite recursion in the JIT compiler when certain patterns
  /such as (?:|a|){100}x/ are analysed.
  * Some patterns with character classes involving [: and \\ were
  incorrectly compiled and could cause reading from uninitialized
  memory or an incorrect error diagnosis. Examples are:
  /[[:\\](?&lt;[::]/ and /[[:\\](?'abc')[a:].
  * A missing closing parenthesis for a callout with a string argument
  was not being diagnosed, possibly leading to a buffer overflow.
  * If (?R was followed by - or + incorrect behaviour happened instead
  of a diagnostic.
  * Fixed an issue when \p{Any} inside an xclass did not read the current
  character.
  * About 80 more fixes, which you can read about in the ChangeLog
  shipped with the libpcre2-8-0 package.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- pcre2 10.22:
  * The POSIX wrapper function regcomp() did not used to
    support back references and subroutine calls if called with the
    REG_NOSUB option. It now does.
  * A new function, pcre2_code_copy(), is added, to make a copy of a
    compiled pattern.
  * Support for string callouts is added to pcre2grep.
  * Added the PCRE2_NO_JIT option to pcre2_match().
  * The pcre2_get_error_message() function now returns with a
    negative error code if the error number it is given is unknown.
  * Several updates have been made to pcre2test and test scripts
  * Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1487246400">- pcre2 10.23:
  * major re-factoring of the pcre2_compile.c file
  * Back references are now permitted in lookbehind assertions when
    there are no duplicated group numbers (that is, (?| has not
    been used), and, if the reference is by name, there is only one
    group of that name. The referenced group must, of course be of
    fixed length.
  * \g{+&lt;number&gt;} (e.g. \g{+2} ) is now supported. It is a "forward
    back reference" and can be useful in repetitions
    (compare \g{-&lt;number&gt;} ). Perl does not recognize this syntax.
  * pcre2grep now automatically expands its buffer up to a maximum
    set by --max-buffer-size.
  * The -t option (grand total) has been added to pcre2grep.
  * A new function called pcre2_code_copy_with_tables() exists to
    copy a compiled pattern along with a private copy of the
    character tables that is uses.</changelog>
  <changelog author="astieger@suse.com" date="1493726400">- pcre2grep can now read .gz and .bz2 files directly
- pcre2test is now built to support line editing</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- fix SLE 11 build</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Update to new upstream release 10.30
  * The main interpreter, pcre2_match(), has been refactored into
    a new version that does not use recursive function calls for
    remembering backtracking positions. The new implementation
    allows backtracking into recursive group calls in patterns,
    making it more compatible with Perl. For patterns that have a
    lot of backtracking, the heap is now used, and there is
    explicit limit on the amount, settable by
    pcre2_set_heap_limit(). The "recursion limit" is retained,
    but is renamed as "depth limit".
  * The new option PCRE2_ENDANCHORED insists that a pattern match
    must end at the end of the subject.
  * The new option PCRE2_EXTENDED_MORE implements Perl's /xx
    feature, and pcre2test is upgraded to support it. Setting
    within the pattern by (?xx) is Also supported.
  * (?n) can be used to set PCRE2_NO_AUTO_CAPTURE, because Perl
    now has this.
  * Additional pattern compile options in the compile context are
    now available: PCRE2_EXTRA_ALLOW_SURROGATE_ESCAPES and
    PCRE2_EXTRA_BAD_ESCAPE_IS LITERAL.
  * The newline type PCRE2_NEWLINE_NUL is now available.
  * The match limit value now also applies to pcre2_dfa_match()
    as there are patterns that can use up a lot of resources
    without necessarily recursing very deeply.
  * Various minor security fixes found by fuzzers:
    + bsc#1037165: crash for forward reference in lookbehind with
    PCRE2_ANCHORED
    + CVE-2017-8786: heap-based buffer overflow write in pcre2test
    (bsc#1036942)
    + CVE-2017-7186: DoS by triggering an invalid Unicode property
    lookup (bsc#1030066)
- Switch source URLs to use HTTP.</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to new upstream release 10.31
  * New pcre2_config() options: PCRE2_CONFIG_NEVER_BACKSLASH_C and
    PCRE2_CONFIG_COMPILED_WIDTHS.
  * New pcre2_pattern_info() option PCRE2_INFO_EXTRAOPTIONS to
    retrieve the extra compile time options.
  * Public names for all pcre2_compile() error numbers.
  * Added PCRE2_CALLOUT_STARTMATCH and PCRE2_CALLOUT_BACKTRACK
    bits to a new field callout_flags in callout blocks.
- use https for main site
- cleanup with spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1627128000">- Added 0001-Fixed-atomic-group-backtracking-bug.patch
  * bsc#1187937
  * PHP 7.6.4 on s390x returns different results for preg_match
    function as compared to older PHP versions and x86
  * Sourced from upstream subversion commit:
    $ svn log -r965 svn://vcs.pcre.org/pcre2/code/trunk</changelog>
  <changelog author="jsikes@suse.com" date="1651924800">- Added pcre2-10.31-bsc1199232-unicode-property-matching.patch
  * bsc#1199232 / CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
  <changelog author="jsikes@suse.com" date="1658232000">- Added pcre2-Fix_crash_when_X_is_used_without_UTF_in_JIT.patch
  * CVE-2019-20454 / bsc#1164384
  * Fix crash when \X is used in non-UTF mode on certain inputs.
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/342c16ecd31bd12fc350ee31d2dcc041832ebb3f
  - https://github.com/PCRE2Project/pcre2/commit/e118e60a68f03f38dd2ff3d16ca2e2e0d800e1d9</changelog>
  <changelog author="jsikes@suse.com" date="1658318400">- Added pcre2-bsc1199235-CVE-2022-1587.patch
  * CVE-2022-1587 / bsc#1199235
  * Fix out-of-bounds read due to bug in recursions
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0</changelog>
</package>
<package pkgid="c5107e90142763060eeafd0ceaf0111e3d0352baefdf0457205679fca24fa989" name="libpcre2-8-0" arch="x86_64">
  <version epoch="0" ver="10.31" rel="150000.3.12.1"/>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1434628800">- PCRE2, a re-working of the original PCRE library to provide an
  entirely new API, version 10.10. Not source compatible.
- copy of the pcre package, with the following adjustments:
  * required name changes
  * adjust pcre-8.21-multilib.patch to pcre2-10.10-multilib.patch
  * drop upstreamed pcre-8.32-visibility.patch
  * --enable-{utf8,unicode-properties} became --enable-unicode
  * drop cpp subpackage
  * make test -&gt; check
  * enable 32 bit character support</changelog>
  <changelog author="astieger@suse.com" date="1436875200">- PCRE2 10.20:
  * Callouts with string arguments and the
    pcre2_callout_enumerate() function have been implemented.
  * The PCRE2_NEVER_BACKSLASH_C option, which locks out the use of
    \C, is added.
  * The PCRE2_ALT_CIRCUMFLEX option lets ^ match after a newline at
    the end of a subject in multiline mode.
  * The way named subpatterns are handled has been refactored. The
    previous approach had several bugs.
  * The handling of \c in EBCDIC environments has been changed to
    conform to the perlebcdic document. (Incompatible change)
  * Bugs have been mended, many of them discovered by fuzzers.</changelog>
  <changelog author="jengelh@inai.de" date="1453032000">- Update to new upstream release 10.21
  * Improve JIT matching speed of patterns starting with + or *.
  * Use memchr() to find the first character in an unanchored match
  in 8-bit mode in the interpreter. This gives a significant speed
  improvement.
  * 10.20 broke the handling of [[:&gt;:]] and [[:&lt;:]] in that
  processing them could involve a buffer overflow if the
  following character was an opening parenthesis.
  * 10.20 also introduced a bug in processing this pattern:
  /((?x)(*:0))#(?'/, which was fixed.
  * A callout with a string argument containing an opening square
  bracket, for example /(?C$[$)(?&lt;]/, was incorrectly processed and
  could provoke a buffer overflow.
  * A possessively repeated conditional group that could match an empty
  string, for example, /(?(R))*+/, was incorrectly compiled.
  * The Unicode tables have been updated to Unicode 8.0.0.
  * An empty comment (?#) in a pattern was incorrectly processed and
  could provoke a buffer overflow.
  * Fix infinite recursion in the JIT compiler when certain patterns
  /such as (?:|a|){100}x/ are analysed.
  * Some patterns with character classes involving [: and \\ were
  incorrectly compiled and could cause reading from uninitialized
  memory or an incorrect error diagnosis. Examples are:
  /[[:\\](?&lt;[::]/ and /[[:\\](?'abc')[a:].
  * A missing closing parenthesis for a callout with a string argument
  was not being diagnosed, possibly leading to a buffer overflow.
  * If (?R was followed by - or + incorrect behaviour happened instead
  of a diagnostic.
  * Fixed an issue when \p{Any} inside an xclass did not read the current
  character.
  * About 80 more fixes, which you can read about in the ChangeLog
  shipped with the libpcre2-8-0 package.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- pcre2 10.22:
  * The POSIX wrapper function regcomp() did not used to
    support back references and subroutine calls if called with the
    REG_NOSUB option. It now does.
  * A new function, pcre2_code_copy(), is added, to make a copy of a
    compiled pattern.
  * Support for string callouts is added to pcre2grep.
  * Added the PCRE2_NO_JIT option to pcre2_match().
  * The pcre2_get_error_message() function now returns with a
    negative error code if the error number it is given is unknown.
  * Several updates have been made to pcre2test and test scripts
  * Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1487246400">- pcre2 10.23:
  * major re-factoring of the pcre2_compile.c file
  * Back references are now permitted in lookbehind assertions when
    there are no duplicated group numbers (that is, (?| has not
    been used), and, if the reference is by name, there is only one
    group of that name. The referenced group must, of course be of
    fixed length.
  * \g{+&lt;number&gt;} (e.g. \g{+2} ) is now supported. It is a "forward
    back reference" and can be useful in repetitions
    (compare \g{-&lt;number&gt;} ). Perl does not recognize this syntax.
  * pcre2grep now automatically expands its buffer up to a maximum
    set by --max-buffer-size.
  * The -t option (grand total) has been added to pcre2grep.
  * A new function called pcre2_code_copy_with_tables() exists to
    copy a compiled pattern along with a private copy of the
    character tables that is uses.</changelog>
  <changelog author="astieger@suse.com" date="1493726400">- pcre2grep can now read .gz and .bz2 files directly
- pcre2test is now built to support line editing</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- fix SLE 11 build</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Update to new upstream release 10.30
  * The main interpreter, pcre2_match(), has been refactored into
    a new version that does not use recursive function calls for
    remembering backtracking positions. The new implementation
    allows backtracking into recursive group calls in patterns,
    making it more compatible with Perl. For patterns that have a
    lot of backtracking, the heap is now used, and there is
    explicit limit on the amount, settable by
    pcre2_set_heap_limit(). The "recursion limit" is retained,
    but is renamed as "depth limit".
  * The new option PCRE2_ENDANCHORED insists that a pattern match
    must end at the end of the subject.
  * The new option PCRE2_EXTENDED_MORE implements Perl's /xx
    feature, and pcre2test is upgraded to support it. Setting
    within the pattern by (?xx) is Also supported.
  * (?n) can be used to set PCRE2_NO_AUTO_CAPTURE, because Perl
    now has this.
  * Additional pattern compile options in the compile context are
    now available: PCRE2_EXTRA_ALLOW_SURROGATE_ESCAPES and
    PCRE2_EXTRA_BAD_ESCAPE_IS LITERAL.
  * The newline type PCRE2_NEWLINE_NUL is now available.
  * The match limit value now also applies to pcre2_dfa_match()
    as there are patterns that can use up a lot of resources
    without necessarily recursing very deeply.
  * Various minor security fixes found by fuzzers:
    + bsc#1037165: crash for forward reference in lookbehind with
    PCRE2_ANCHORED
    + CVE-2017-8786: heap-based buffer overflow write in pcre2test
    (bsc#1036942)
    + CVE-2017-7186: DoS by triggering an invalid Unicode property
    lookup (bsc#1030066)
- Switch source URLs to use HTTP.</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to new upstream release 10.31
  * New pcre2_config() options: PCRE2_CONFIG_NEVER_BACKSLASH_C and
    PCRE2_CONFIG_COMPILED_WIDTHS.
  * New pcre2_pattern_info() option PCRE2_INFO_EXTRAOPTIONS to
    retrieve the extra compile time options.
  * Public names for all pcre2_compile() error numbers.
  * Added PCRE2_CALLOUT_STARTMATCH and PCRE2_CALLOUT_BACKTRACK
    bits to a new field callout_flags in callout blocks.
- use https for main site
- cleanup with spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1627128000">- Added 0001-Fixed-atomic-group-backtracking-bug.patch
  * bsc#1187937
  * PHP 7.6.4 on s390x returns different results for preg_match
    function as compared to older PHP versions and x86
  * Sourced from upstream subversion commit:
    $ svn log -r965 svn://vcs.pcre.org/pcre2/code/trunk</changelog>
  <changelog author="jsikes@suse.com" date="1651924800">- Added pcre2-10.31-bsc1199232-unicode-property-matching.patch
  * bsc#1199232 / CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
  <changelog author="jsikes@suse.com" date="1658232000">- Added pcre2-Fix_crash_when_X_is_used_without_UTF_in_JIT.patch
  * CVE-2019-20454 / bsc#1164384
  * Fix crash when \X is used in non-UTF mode on certain inputs.
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/342c16ecd31bd12fc350ee31d2dcc041832ebb3f
  - https://github.com/PCRE2Project/pcre2/commit/e118e60a68f03f38dd2ff3d16ca2e2e0d800e1d9</changelog>
  <changelog author="jsikes@suse.com" date="1658318400">- Added pcre2-bsc1199235-CVE-2022-1587.patch
  * CVE-2022-1587 / bsc#1199235
  * Fix out-of-bounds read due to bug in recursions
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0</changelog>
</package>
<package pkgid="bbb9504bb0eb73f265cdd3e956b83f562f6a64689037174a987f81b8f8220a0a" name="libpixman-1-0" arch="aarch64">
  <version epoch="0" ver="0.34.0" rel="150000.7.5.1"/>
  <changelog author="dimstar@opensuse.org" date="1384776000">- Update to version 0.32.4:
  + Fix the SSSE3 CPUID detection.
- Changes from version 0.32.2:
  + Build fixes.
- Changes from version 0.32.0:
  + This release contains performance improvements to bilinear
    scaling, and a large number of bug fixes.</changelog>
  <changelog author="fcrozat@suse.com" date="1402056000">- RENDER extension hotfix: Add --disable-vmx for PPC64LE.
  This makes the RENDER extension work for the time being.
  Proper fix for vmx will come later (bnc#876757) (from Egbert
  Eich).</changelog>
  <changelog author="dimstar@opensuse.org" date="1404993600">- Update to version 0.32.6:
  + MIPS: Fix exported symbols in public API.
  + build: Check if the compiler supports GCC vector extensions.
  + Bugs fixed: rh#972647, fdo#69014.</changelog>
  <changelog author="zaitor@opensuse.org" date="1440244800">- Update to version 0.33.2:
  + ARMv6 - Many fast paths implementations were added.
  + PPC64/PPC64LE - Fix all outstanding bugs and add many fast
    paths implementations using vmx.
  + Major enhancements to lowlevel-blt-bench utility.
  + A couple of fixes and enhancements to mmx code.</changelog>
  <changelog author="zaitor@opensuse.org" date="1445947200">- Update to version 0.33.4:
  + Important security fix to prevent stack buffer overflow.
  + POWER: New fast-paths and optimizations to existing fast-paths.
  + ARMv6: New fast-path.
  + Tests: New cover and fence-image-self tests.
  + Remove redundant corrections in various calculations for
    COVER-CLIP and COVER analysis.</changelog>
  <changelog author="zaitor@opensuse.org" date="1451736000">- Update to version 0.33.6:
  + configura.ac: fix test for SSE2 &amp; SSSE3 assembler support.
  + mmx: Improve detection of support for "K" constraint.
  + Revert "mmx: Use MMX2 intrinsics from xmmintrin.h directly".</changelog>
  <changelog author="zaitor@opensuse.org" date="1454328000">- Update to version 0.34.0:
  + No changes from last version, stable version release only.</changelog>
  <changelog author="zaitor@opensuse.org" date="1459771200">- Add pixman-private-correct-include.patch: pixman-private: include
  &lt;float.h&gt; only in C code, patch from upstream git.</changelog>
  <changelog author="mgorse@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="mgorse@suse.com" date="1667563200">- Add pixman-CVE-2022-44638.patch: avoid an integer overflow
  (boo#1205033 CVE-2022-44638).</changelog>
</package>
<package pkgid="fbd5c0c521e3d3e96df44b83584ee17c2a421eed4702403ef1753d25dda2478b" name="libpixman-1-0" arch="x86_64">
  <version epoch="0" ver="0.34.0" rel="150000.7.5.1"/>
  <changelog author="dimstar@opensuse.org" date="1384776000">- Update to version 0.32.4:
  + Fix the SSSE3 CPUID detection.
- Changes from version 0.32.2:
  + Build fixes.
- Changes from version 0.32.0:
  + This release contains performance improvements to bilinear
    scaling, and a large number of bug fixes.</changelog>
  <changelog author="fcrozat@suse.com" date="1402056000">- RENDER extension hotfix: Add --disable-vmx for PPC64LE.
  This makes the RENDER extension work for the time being.
  Proper fix for vmx will come later (bnc#876757) (from Egbert
  Eich).</changelog>
  <changelog author="dimstar@opensuse.org" date="1404993600">- Update to version 0.32.6:
  + MIPS: Fix exported symbols in public API.
  + build: Check if the compiler supports GCC vector extensions.
  + Bugs fixed: rh#972647, fdo#69014.</changelog>
  <changelog author="zaitor@opensuse.org" date="1440244800">- Update to version 0.33.2:
  + ARMv6 - Many fast paths implementations were added.
  + PPC64/PPC64LE - Fix all outstanding bugs and add many fast
    paths implementations using vmx.
  + Major enhancements to lowlevel-blt-bench utility.
  + A couple of fixes and enhancements to mmx code.</changelog>
  <changelog author="zaitor@opensuse.org" date="1445947200">- Update to version 0.33.4:
  + Important security fix to prevent stack buffer overflow.
  + POWER: New fast-paths and optimizations to existing fast-paths.
  + ARMv6: New fast-path.
  + Tests: New cover and fence-image-self tests.
  + Remove redundant corrections in various calculations for
    COVER-CLIP and COVER analysis.</changelog>
  <changelog author="zaitor@opensuse.org" date="1451736000">- Update to version 0.33.6:
  + configura.ac: fix test for SSE2 &amp; SSSE3 assembler support.
  + mmx: Improve detection of support for "K" constraint.
  + Revert "mmx: Use MMX2 intrinsics from xmmintrin.h directly".</changelog>
  <changelog author="zaitor@opensuse.org" date="1454328000">- Update to version 0.34.0:
  + No changes from last version, stable version release only.</changelog>
  <changelog author="zaitor@opensuse.org" date="1459771200">- Add pixman-private-correct-include.patch: pixman-private: include
  &lt;float.h&gt; only in C code, patch from upstream git.</changelog>
  <changelog author="mgorse@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="mgorse@suse.com" date="1667563200">- Add pixman-CVE-2022-44638.patch: avoid an integer overflow
  (boo#1205033 CVE-2022-44638).</changelog>
</package>
<package pkgid="839ea62fa25d8a352fba0023f5aff95aed4aa6877520db8040292b1216fe08e7" name="libprocps7" arch="aarch64">
  <version epoch="0" ver="3.3.15" rel="150000.7.25.1"/>
  <changelog author="werner@suse.de" date="1495454400">- Add patch procps-ng-3.3.12-sysctl-a.patch (bsc#1039941, had been
  accepted upstream) that is allow content lines below /proc/sys
  longer than 1024 characters</changelog>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
</package>
<package pkgid="933b6000b928cff197fd8b0344994d4e9d1c37fbfe40d2a182c45d7402ded171" name="libprocps7" arch="x86_64">
  <version epoch="0" ver="3.3.15" rel="150000.7.25.1"/>
  <changelog author="werner@suse.de" date="1495454400">- Add patch procps-ng-3.3.12-sysctl-a.patch (bsc#1039941, had been
  accepted upstream) that is allow content lines below /proc/sys
  longer than 1024 characters</changelog>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
</package>
<package pkgid="49239eb7f7f16956f387df0e9b23e2397d807f6dd50c9b9b7f3acf44a8ef99b6" name="libprocps7" arch="aarch64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="c985064b5a3c22141b3f3e1124af14badda171f235881e774225ad0315069480" name="libprocps7" arch="x86_64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="01a9dfc5c8e76d7c501983eeb1c3d55a683bfde51c27a9532077ae65a41a4fc0" name="libprotobuf-lite20" arch="aarch64">
  <version epoch="0" ver="3.9.2" rel="150200.4.19.2"/>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new upstream release 3.5.0
  * Proto3 messages are now preserving unknown fields by default.
    If you rely on unknowns fields being dropped, use
    DiscardUnknownFields() explicitly.
  * Deprecated the unsafe_arena_release_* and
    unsafe_arena_add_allocated_* methods for string fields.
  * Added move constructor and move assignment to RepeatedField,
    RepeatedPtrField and google::protobuf::Any.
  * Added perfect forwarding in Arena::CreateMessage.
  * In-progress experimental support for implicit weak fields
    with lite protos. This feature allows the linker to strip out
    more unused messages and reduce binary size.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Conditionalize python2 and python3 in order to be able to build
  without python2 present in distribution
  * Use singlespec macros to simplify the logic
- Run fdupes on python modules to avoid duplicates
- Remove shebangs from import-only code</changelog>
  <changelog author="mlin@suse.com" date="1519387200">- Add adding-Release_CompareAndSwap-64-bit-variant.patch
  * Fix compile error undefined reference to
    `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)'
    on s390x https://github.com/google/protobuf/issues/3937</changelog>
  <changelog author="tbechtold@suse.com" date="1526299200">update to version v3.5.2:
  * Update release date
  * Disable pip cache when testing uploaded packages
  * Replace private timelib_update_ts with public date_timestamp_get
  * Remove py2.6 support.
  * Cherrypick for csharp, including:
  * Update changelog
  * Update changelog for 3.5.1
  * Fix uploading binary wheel.
  * Fix memory leak when creating map field via array.
  * Update rake file to build of 2.1.6.
  * Avoid using php_date_get_date_ce() in case date extension is not
  * Update protoc-artfacts
  * Fix string::back() usage in googletest.cc
  * Fix memory leak in php7
  * Support ruby2.5
  * io_win32: support non-ASCII paths
  * Explicitly propagate the status of Flush().
  * Add discard unknown API in ruby. (#3990)
  * Update version for 3.5.0.post1
  * remove nullptr
  * Fix more memory leak for php c extension (#4211)
  * Bumping number to fix ruby 2.1 on mac
  * io_win32_unittest: remove incorrect error check
  * Fix memory leak when creating repeated field via array.
  * Update version number for php c extension (#3896)
  * Fix file permission for python package.
  * Create containing directory before generating well_known_types_embed.cc
  * Replace C++11 only method std::map::at
  * Recursively clear unknown fields in submessages. (#3982)
  * Update version number to 3.5.1
  * io_win32_unittest: fix condition in GetCwdAsUtf8
  * Add release log
  * io_win32_unittest: use CWD as last tempdir
  * Add PROTOBUF_ENABLE_TIMESTAMP to let user decide whether timestamp util
  * Add support for Windows ARM64 build
  * Add protobuf-all in post release
  * Use fully qualifed name for DescriptorPool in Any.php to avoid name (#3886)
  * Add _file_desc_by_toplevel_extension back
  * Fix setup.py for windows build.
  * io_win32_unittest: make //:win32_test run again
  * Provide discardUnknonwnFields API in php (#3976)
  * Update php c extension version number to 3.5.0.1
  * Fix ruby gc_test in ruby 2.4 (#4011)
  * Remove duplicate typedef. (#3975)
  * Accept DatetimeInterface in fromDatetime
  * io_win32: add more encoding-related tests
  * Bump version number to 3.5.2
  * Bump protoc-artifact version for a patch rebuild
  * Call php method via function name instead of calling directly.
  * Well known types are not initialized properly. (#4139)
  * Use matching enum type for IsPOD.
  * Fix several more memory leak
  * Fix for php5.5
  * Add backslach to make class explict in global namespace</changelog>
  <changelog author="tbechtold@suse.com" date="1536753600">- update to version v3.6.1:
  * PHP namespaces for nested messages and enums (#4536)
  * Allows the json marshaller to be passed json marshal options (#4252)
  * Make sure to delete temporary maps used by FileDescriptorTables
  * fix python cpp kokoro build
  * Change C# reflection to avoid using expression trees
  * Updated checked-in generated code
  * Removed unused variables in repeated_scalar_container.cc
  * Removed unused code pertaining to shared_ptr
  * Include no_package.proto in Python test
  * Only check filenames when end with .py in _CalledFromGeneratedFile() (#4262)
  * Convert descriptortype to type for upb_msgval_sizeof (#4357)
  * Removed duplicate using statement from ReflectionUtil.cs
  * Add support for power ppc64le
  * Cat the test-suite.log on errors for presubits
  * Address review comments
  * Add third-party RPC implementation: raster - a network framework supports pbrpc by 'service' keyword.
  * Delete javanano kokoro build configs.
  * Updated Ruby conformance test failure list
  * Removed use of some type traits
  * Adopt php_metadata_namespace in php code generator (#4622)
  * Move to Xcode 9.3 which also means a High Sierra image.
  * Add protoc release script for Linux build.
  * protoc-artifacts: Avoid storing temporary files and use fewer layers
  * Rewrite go_benchmark
  * Add files to build ruby artifact for mac on kokoro (#4814)
  * Remove javanano.
  * Comment out unused command from release script.
  * Avoid direct check of class name (#4601)
  * The JsonParseOptions::ignore_unknown_fields option behavior treats
  * Fix php memory leak test (#4692)
  * Fix benchmark build
  * Add VS2017 optional component dependency details to the C# readme (#4128)
  * Fix initialization with Visual Studio
  * For windows, all python version should use /MT (#4468)
  * use brew install instead of easy_install in OSX (#4537)
  * Sync upb change (#4373)
  * Always add -std=c++11 for mac (#4684)
  * Add kokoro build status badges.
  * Removed unrecognized option from no_package.proto
  * Fixed up proto3_lite_unittest.cc
  * Update Xcode settings
  * Cleanup LICENSE file.
  * Remove js_embed binary. (#4709)
  * Fixed JS parsing of unspecified map keys
  * Update version number to 3.6.0
  * Deliberately call simple code to avoid Unity linker pruning
  * Revert "Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources."
  * protoc-artifacts: Use ENTRYPOINT to enable devtoolset-1.1
  * MinGW build failed
  * Support using MSVC intrinsics in Log2FloorNonZero
  * Fix array constructor in c extension for compatibility (#4667)
  * Add space between class name and concat message (#4577)
  * fix python
  * Add performance.md and add instruction for linking tcmalloc
  * Add script for run and upload the benchmark result to bq
  * Add test for failing write of raw pointer to output stream
  * [objectivec] Fix memory leak of exceptions raised by RaiseException() (#4556)
  * Remove stray indent on normal imports.
  * Fix python ext build on kokoro (#4527)
  * Add compile test sources for to test include order.
  * Fixed a Visual Studio 2017 build error. (#4488)
  * fix linux kokoro build in docker
  * Fixes MSVC compiler warning C4800 "Forcing value to bool 'true' or 'false'" (#4350)
  * Updated Docker setup to use GCC 4.8
  * Remove broken build status icons.
  * Run autogen.sh in release script.
  * Output *_pb2_grpc.py when use_grpc_plugin=True
  * Adopt ruby_package in ruby generated code. (#4627)
  * Cygwin build failed
  * Work around an "old runtime" issue with reflection
  * Added Kokoro protoc release build for OS X (#4770)
  * Updated change log for 3.6.1 release
  * Move methods out of class (#4697)
  * Fix to allow AOT compilers to play nicely with reflection
  * Update Makefile.am for Java lite files.
  * Added map_lite_test.proto to fix LiteTest
  * Introduce a compatiblity shim to support .NET 3.5 delegate creation
  * Revert "Removed mention of Buffer in byteSourceToUint8Array"
  * Add gogo benchmark
  * Set ext.no_native = true for non mac platform
  * Removed atomicops.h since it is no longer used
  * Rename a shadowed variable.
  * Add kokoro bazel configs for 3.6.x branch.
  * Deleted scoped_ptr.h
  * Check the message to be encoded is the wrong type. (#4885) (#4949)
  * protoc-artifacts: Avoid checking out protobuf code
  * Add conformance test for null value in list JSON
  * Build ruby gem on kokoro (#4819)
  * Try using a new version of Visual Studio on AppVeyor
  * Make ruby release configs consistent with protoc.
  * fix for API change in PHP 7.3 (#4898)
  * Add .proto files to extract_includes.bat
  * Update protoc build scripts.
  * Blacklist all WELL_KNOWN_PROTOS from Bazel C++ code generation.
  * Additional support for building and deploying ppcle_64 artifacts
  * Fix php tests
  * Cleanup + documentation for Java Lite runtime.
  * Added Kokoro Windows release build config for protoc (#4766)
  * typo
  * fix golang kokoro linux build
  * Fix spelling error of __GNUC_MINOR__
  * Update code to work for Xcode 10b1 (#4729)
  * Added pyext/thread_unsafe_shared_ptr.h
  * Added missing .inc files to BUILD
  * js message support for jstype string on integers (#4332)
  * Improve error message when googletest is missing.
  * Make assertEquals pass for message (#4947)
  * Sync internal benchmark changes
  * Removed some unused C++ source files
  * Fix missing LIBPROTOC_EXPORT.
  * Added new test source files to Makefile.am
  * Update php version to 3.6.0 (#4736)
  * Fix RepeatedField#delete_if (#4292)
  * Merge branch (#4466)
  * Implement array constructor in php c extension.
  * protoc-artifacts: Update centos base from 6.6 to 6.9
  * PHP array constructors for protobuf messages (#4530)
  * Fix problem: cmake build failed in c++11  by clang
  * Don't assume Windows builds use MSVC.
  * Use legacy name in php runtime (#4741)
  * Add file option php_metadata_namespace and ruby_package (#4609)
  * Fix cpp benchmark dependency on mac
  * Use the first enum value instead of 0 in DefaultValueObjectWriter::FindEnumDefault
  * Check return value on write of raw pointer
  * Delete unused directories.
  * Replace //:protoc and similar default macro arguments with
  * Add extra C# file to Makefile.am
  * includes the expected class in the exception, otherwise the error is harder to track down (#3371)
  * Update instructions about getting protobuf source.
  * Add cpp tests under release docker image.
  * fix java benchmark, fix dashboard build
  * `update_file_lists.sh` depends on Bash features, thus needs Bash sebang.
  * Rename build_artifacts.cfg to release.cfg (#4818)
  * Fix bug: whether always_print_enums_as_ints is true or false, it always print the default value of enums as strings
  * source code info for interpreted options; fix source code info for extension range options (#4342)
  * Updated version numbers to 3.6.1
  * Trim imports for bundled generated protos.
  * Require C++11 and pass -std=c++11
  * Remove the iOS Test App.
  * fix duplicate mkdir in update_file_lists.sh
  * Updated csharp/README.md to reflect testing changes
  * Fix bazel build of examples.
  * Add missing ruby/tests/test_ruby_package.proto
  * Fix cpp_distcheck
  * Updated the change log with changes for 3.6.0
  * some fix
  * CMake: Update CXX Standard management
  * Add the files added in #4485.
  * Change to deal all messages in one loop
  * Fix php conformance test.
  * Add __init__.py files to compiler and util subpackages (#4117)
  * Updated .gitignore to exclude downloaded gmock/ directory
  * Fix error in Clang UndefinedBehaviorSanitizer
  * Work around MSVC issue with std::atomic initialization (#4777)
  * Updated conformance failure lists
  * Add back GeneratedClassName to public (#4686)
  * Add continuous test for ruby 2.3, 2.4 and 2.5 (#4829)
  * Throw error if user want to access message properties (#4603)
  * fix json_decode call parameters (#4381)
  * Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources.
  * PHP: fixed typo in message.c
  * Add go benchmark
  * Allow list values to be null when parsing
  * Added instruction for existing ZLIB configuration
  * Fix 32bit php tests
  * Removed javanano from post_process_dist.sh
  * Don't generate imports for the WKTs unless generating the WKTs.
  * For encoding upb needs descriptor type instead of type. (#4354)
  * Include googletest as a submodule (#3993)
  * Write messages to backing field in generated C# cloning code (#4440)
  * Integrated internal changes from Google
- Drop adding-Release_CompareAndSwap-64-bit-variant.patch . Applied
  upstream.
- bump soname version</changelog>
  <changelog author="fstrba@suse.com" date="1545048000">- Add maven pom files to the protobuf-java package</changelog>
  <changelog author="mrostecki@suse.de" date="1546948800">- Add protobuf-source package - some programs using gRPC and
  protobuf need protobuf definitions which are included inside the
  source code, but are not included in the devel package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1550664000">- Add upstream patch which fixes build with Bazel 0.22.0.
  * 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch</changelog>
  <changelog author="mliska@suse.cz" date="1556107200">- Disable LTO (boo#1133277).</changelog>
  <changelog author="jengelh@inai.de" date="1559736000">- Update to new upstream release 3.8.0
  * Introduced new MOMI (maybe-outside-memory-interval) parser.
  * Added use of C++ override keyword where appropriate.
  * Always declare enums to be int-sized.
  * Append '_' to C++ reserved keywords for message, enum, extension.
- Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch
  (upstreamed)</changelog>
  <changelog author="fstrba@suse.com" date="1559995200">- Specify java source and target levels in order to build
  compatible protobuf-java binaries</changelog>
  <changelog author="jengelh@inai.de" date="1566475200">- Update to new upstream release 3.9.1
  * Optimized the implementation of RepeatedPtrFieldBase.
  * Added delimited parse and serialize util.
  * Added FieldDescriptor::PrintableNameForExtension() and
    DescriptorPool::FindExtensionByPrintableName(). The latter
    will replace Reflection::FindKnownExtensionByName().
  * Created a new Add method in repeated field that allows adding
    a range of elements all at once.
  * Drop building wheel for Python 3.4.</changelog>
  <changelog author="fstrba@suse.com" date="1569585600">- Package also the protobuf-bom pom file</changelog>
  <changelog author="mmnelemane@suse.com" date="1576756800">- Updated to version 3.9.2 (bsc#1162343)
  (Objective-C)
  * Remove OSReadLittle* due to alignment requirements. (#6678)
  * Don't use unions and instead use memcpy for the type swaps. (#6672)</changelog>
  <changelog author="mpluskal@suse.com" date="1576843200">- Use tarball provided by upstream
- Small package cleanup</changelog>
  <changelog author="mcepl@suse.com" date="1610539200">- Add missing dependency of python subpackages on python-six
  (bsc#1177127).</changelog>
  <changelog author="mcepl@suse.com" date="1612958400">- Fix Requires for python3 to python3-six.</changelog>
  <changelog author="mlin@suse.com" date="1647000000">- Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570,
  bsc#1195258
  * Add protobuf-CVE-2021-22570.patch</changelog>
  <changelog author="mlin@suse.com" date="1664884800">- Fix potential Denial of Service in protobuf-java in the parsing procedure
  for binary data, CVE-2021-22569, bsc#1194530
  * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch</changelog>
  <changelog author="mlin@suse.com" date="1666267200">- Fix a potential DoS issue in protobuf-cpp and protobuf-python,
  CVE-2022-1941, bsc#1203681
  * Add protobuf-CVE-2022-1941.patch
- Fix a potential DoS issue when parsing with binary data in
  protobuf-java, CVE-2022-3171, bsc#1204256
  * Add protobuf-CVE-2022-3171.patch
- Refresh protobuf-CVE-2021-22570.patch
- Backport changes from 3.16.x tree for apply recent CVE patches
  * Add protobuf-51026d922970e06475f005b39287963594134b96.patch
  * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch
  * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch
  * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch
  * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch
  * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch
  * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch
  * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch
  * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch
- Reorganize patch set ordering</changelog>
</package>
<package pkgid="8a2bf2df5aed462da115f7e31568455a70b0cba45e9f973c49c3ad2a0dbc9892" name="libprotobuf-lite20" arch="x86_64">
  <version epoch="0" ver="3.9.2" rel="150200.4.19.2"/>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new upstream release 3.5.0
  * Proto3 messages are now preserving unknown fields by default.
    If you rely on unknowns fields being dropped, use
    DiscardUnknownFields() explicitly.
  * Deprecated the unsafe_arena_release_* and
    unsafe_arena_add_allocated_* methods for string fields.
  * Added move constructor and move assignment to RepeatedField,
    RepeatedPtrField and google::protobuf::Any.
  * Added perfect forwarding in Arena::CreateMessage.
  * In-progress experimental support for implicit weak fields
    with lite protos. This feature allows the linker to strip out
    more unused messages and reduce binary size.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Conditionalize python2 and python3 in order to be able to build
  without python2 present in distribution
  * Use singlespec macros to simplify the logic
- Run fdupes on python modules to avoid duplicates
- Remove shebangs from import-only code</changelog>
  <changelog author="mlin@suse.com" date="1519387200">- Add adding-Release_CompareAndSwap-64-bit-variant.patch
  * Fix compile error undefined reference to
    `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)'
    on s390x https://github.com/google/protobuf/issues/3937</changelog>
  <changelog author="tbechtold@suse.com" date="1526299200">update to version v3.5.2:
  * Update release date
  * Disable pip cache when testing uploaded packages
  * Replace private timelib_update_ts with public date_timestamp_get
  * Remove py2.6 support.
  * Cherrypick for csharp, including:
  * Update changelog
  * Update changelog for 3.5.1
  * Fix uploading binary wheel.
  * Fix memory leak when creating map field via array.
  * Update rake file to build of 2.1.6.
  * Avoid using php_date_get_date_ce() in case date extension is not
  * Update protoc-artfacts
  * Fix string::back() usage in googletest.cc
  * Fix memory leak in php7
  * Support ruby2.5
  * io_win32: support non-ASCII paths
  * Explicitly propagate the status of Flush().
  * Add discard unknown API in ruby. (#3990)
  * Update version for 3.5.0.post1
  * remove nullptr
  * Fix more memory leak for php c extension (#4211)
  * Bumping number to fix ruby 2.1 on mac
  * io_win32_unittest: remove incorrect error check
  * Fix memory leak when creating repeated field via array.
  * Update version number for php c extension (#3896)
  * Fix file permission for python package.
  * Create containing directory before generating well_known_types_embed.cc
  * Replace C++11 only method std::map::at
  * Recursively clear unknown fields in submessages. (#3982)
  * Update version number to 3.5.1
  * io_win32_unittest: fix condition in GetCwdAsUtf8
  * Add release log
  * io_win32_unittest: use CWD as last tempdir
  * Add PROTOBUF_ENABLE_TIMESTAMP to let user decide whether timestamp util
  * Add support for Windows ARM64 build
  * Add protobuf-all in post release
  * Use fully qualifed name for DescriptorPool in Any.php to avoid name (#3886)
  * Add _file_desc_by_toplevel_extension back
  * Fix setup.py for windows build.
  * io_win32_unittest: make //:win32_test run again
  * Provide discardUnknonwnFields API in php (#3976)
  * Update php c extension version number to 3.5.0.1
  * Fix ruby gc_test in ruby 2.4 (#4011)
  * Remove duplicate typedef. (#3975)
  * Accept DatetimeInterface in fromDatetime
  * io_win32: add more encoding-related tests
  * Bump version number to 3.5.2
  * Bump protoc-artifact version for a patch rebuild
  * Call php method via function name instead of calling directly.
  * Well known types are not initialized properly. (#4139)
  * Use matching enum type for IsPOD.
  * Fix several more memory leak
  * Fix for php5.5
  * Add backslach to make class explict in global namespace</changelog>
  <changelog author="tbechtold@suse.com" date="1536753600">- update to version v3.6.1:
  * PHP namespaces for nested messages and enums (#4536)
  * Allows the json marshaller to be passed json marshal options (#4252)
  * Make sure to delete temporary maps used by FileDescriptorTables
  * fix python cpp kokoro build
  * Change C# reflection to avoid using expression trees
  * Updated checked-in generated code
  * Removed unused variables in repeated_scalar_container.cc
  * Removed unused code pertaining to shared_ptr
  * Include no_package.proto in Python test
  * Only check filenames when end with .py in _CalledFromGeneratedFile() (#4262)
  * Convert descriptortype to type for upb_msgval_sizeof (#4357)
  * Removed duplicate using statement from ReflectionUtil.cs
  * Add support for power ppc64le
  * Cat the test-suite.log on errors for presubits
  * Address review comments
  * Add third-party RPC implementation: raster - a network framework supports pbrpc by 'service' keyword.
  * Delete javanano kokoro build configs.
  * Updated Ruby conformance test failure list
  * Removed use of some type traits
  * Adopt php_metadata_namespace in php code generator (#4622)
  * Move to Xcode 9.3 which also means a High Sierra image.
  * Add protoc release script for Linux build.
  * protoc-artifacts: Avoid storing temporary files and use fewer layers
  * Rewrite go_benchmark
  * Add files to build ruby artifact for mac on kokoro (#4814)
  * Remove javanano.
  * Comment out unused command from release script.
  * Avoid direct check of class name (#4601)
  * The JsonParseOptions::ignore_unknown_fields option behavior treats
  * Fix php memory leak test (#4692)
  * Fix benchmark build
  * Add VS2017 optional component dependency details to the C# readme (#4128)
  * Fix initialization with Visual Studio
  * For windows, all python version should use /MT (#4468)
  * use brew install instead of easy_install in OSX (#4537)
  * Sync upb change (#4373)
  * Always add -std=c++11 for mac (#4684)
  * Add kokoro build status badges.
  * Removed unrecognized option from no_package.proto
  * Fixed up proto3_lite_unittest.cc
  * Update Xcode settings
  * Cleanup LICENSE file.
  * Remove js_embed binary. (#4709)
  * Fixed JS parsing of unspecified map keys
  * Update version number to 3.6.0
  * Deliberately call simple code to avoid Unity linker pruning
  * Revert "Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources."
  * protoc-artifacts: Use ENTRYPOINT to enable devtoolset-1.1
  * MinGW build failed
  * Support using MSVC intrinsics in Log2FloorNonZero
  * Fix array constructor in c extension for compatibility (#4667)
  * Add space between class name and concat message (#4577)
  * fix python
  * Add performance.md and add instruction for linking tcmalloc
  * Add script for run and upload the benchmark result to bq
  * Add test for failing write of raw pointer to output stream
  * [objectivec] Fix memory leak of exceptions raised by RaiseException() (#4556)
  * Remove stray indent on normal imports.
  * Fix python ext build on kokoro (#4527)
  * Add compile test sources for to test include order.
  * Fixed a Visual Studio 2017 build error. (#4488)
  * fix linux kokoro build in docker
  * Fixes MSVC compiler warning C4800 "Forcing value to bool 'true' or 'false'" (#4350)
  * Updated Docker setup to use GCC 4.8
  * Remove broken build status icons.
  * Run autogen.sh in release script.
  * Output *_pb2_grpc.py when use_grpc_plugin=True
  * Adopt ruby_package in ruby generated code. (#4627)
  * Cygwin build failed
  * Work around an "old runtime" issue with reflection
  * Added Kokoro protoc release build for OS X (#4770)
  * Updated change log for 3.6.1 release
  * Move methods out of class (#4697)
  * Fix to allow AOT compilers to play nicely with reflection
  * Update Makefile.am for Java lite files.
  * Added map_lite_test.proto to fix LiteTest
  * Introduce a compatiblity shim to support .NET 3.5 delegate creation
  * Revert "Removed mention of Buffer in byteSourceToUint8Array"
  * Add gogo benchmark
  * Set ext.no_native = true for non mac platform
  * Removed atomicops.h since it is no longer used
  * Rename a shadowed variable.
  * Add kokoro bazel configs for 3.6.x branch.
  * Deleted scoped_ptr.h
  * Check the message to be encoded is the wrong type. (#4885) (#4949)
  * protoc-artifacts: Avoid checking out protobuf code
  * Add conformance test for null value in list JSON
  * Build ruby gem on kokoro (#4819)
  * Try using a new version of Visual Studio on AppVeyor
  * Make ruby release configs consistent with protoc.
  * fix for API change in PHP 7.3 (#4898)
  * Add .proto files to extract_includes.bat
  * Update protoc build scripts.
  * Blacklist all WELL_KNOWN_PROTOS from Bazel C++ code generation.
  * Additional support for building and deploying ppcle_64 artifacts
  * Fix php tests
  * Cleanup + documentation for Java Lite runtime.
  * Added Kokoro Windows release build config for protoc (#4766)
  * typo
  * fix golang kokoro linux build
  * Fix spelling error of __GNUC_MINOR__
  * Update code to work for Xcode 10b1 (#4729)
  * Added pyext/thread_unsafe_shared_ptr.h
  * Added missing .inc files to BUILD
  * js message support for jstype string on integers (#4332)
  * Improve error message when googletest is missing.
  * Make assertEquals pass for message (#4947)
  * Sync internal benchmark changes
  * Removed some unused C++ source files
  * Fix missing LIBPROTOC_EXPORT.
  * Added new test source files to Makefile.am
  * Update php version to 3.6.0 (#4736)
  * Fix RepeatedField#delete_if (#4292)
  * Merge branch (#4466)
  * Implement array constructor in php c extension.
  * protoc-artifacts: Update centos base from 6.6 to 6.9
  * PHP array constructors for protobuf messages (#4530)
  * Fix problem: cmake build failed in c++11  by clang
  * Don't assume Windows builds use MSVC.
  * Use legacy name in php runtime (#4741)
  * Add file option php_metadata_namespace and ruby_package (#4609)
  * Fix cpp benchmark dependency on mac
  * Use the first enum value instead of 0 in DefaultValueObjectWriter::FindEnumDefault
  * Check return value on write of raw pointer
  * Delete unused directories.
  * Replace //:protoc and similar default macro arguments with
  * Add extra C# file to Makefile.am
  * includes the expected class in the exception, otherwise the error is harder to track down (#3371)
  * Update instructions about getting protobuf source.
  * Add cpp tests under release docker image.
  * fix java benchmark, fix dashboard build
  * `update_file_lists.sh` depends on Bash features, thus needs Bash sebang.
  * Rename build_artifacts.cfg to release.cfg (#4818)
  * Fix bug: whether always_print_enums_as_ints is true or false, it always print the default value of enums as strings
  * source code info for interpreted options; fix source code info for extension range options (#4342)
  * Updated version numbers to 3.6.1
  * Trim imports for bundled generated protos.
  * Require C++11 and pass -std=c++11
  * Remove the iOS Test App.
  * fix duplicate mkdir in update_file_lists.sh
  * Updated csharp/README.md to reflect testing changes
  * Fix bazel build of examples.
  * Add missing ruby/tests/test_ruby_package.proto
  * Fix cpp_distcheck
  * Updated the change log with changes for 3.6.0
  * some fix
  * CMake: Update CXX Standard management
  * Add the files added in #4485.
  * Change to deal all messages in one loop
  * Fix php conformance test.
  * Add __init__.py files to compiler and util subpackages (#4117)
  * Updated .gitignore to exclude downloaded gmock/ directory
  * Fix error in Clang UndefinedBehaviorSanitizer
  * Work around MSVC issue with std::atomic initialization (#4777)
  * Updated conformance failure lists
  * Add back GeneratedClassName to public (#4686)
  * Add continuous test for ruby 2.3, 2.4 and 2.5 (#4829)
  * Throw error if user want to access message properties (#4603)
  * fix json_decode call parameters (#4381)
  * Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources.
  * PHP: fixed typo in message.c
  * Add go benchmark
  * Allow list values to be null when parsing
  * Added instruction for existing ZLIB configuration
  * Fix 32bit php tests
  * Removed javanano from post_process_dist.sh
  * Don't generate imports for the WKTs unless generating the WKTs.
  * For encoding upb needs descriptor type instead of type. (#4354)
  * Include googletest as a submodule (#3993)
  * Write messages to backing field in generated C# cloning code (#4440)
  * Integrated internal changes from Google
- Drop adding-Release_CompareAndSwap-64-bit-variant.patch . Applied
  upstream.
- bump soname version</changelog>
  <changelog author="fstrba@suse.com" date="1545048000">- Add maven pom files to the protobuf-java package</changelog>
  <changelog author="mrostecki@suse.de" date="1546948800">- Add protobuf-source package - some programs using gRPC and
  protobuf need protobuf definitions which are included inside the
  source code, but are not included in the devel package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1550664000">- Add upstream patch which fixes build with Bazel 0.22.0.
  * 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch</changelog>
  <changelog author="mliska@suse.cz" date="1556107200">- Disable LTO (boo#1133277).</changelog>
  <changelog author="jengelh@inai.de" date="1559736000">- Update to new upstream release 3.8.0
  * Introduced new MOMI (maybe-outside-memory-interval) parser.
  * Added use of C++ override keyword where appropriate.
  * Always declare enums to be int-sized.
  * Append '_' to C++ reserved keywords for message, enum, extension.
- Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch
  (upstreamed)</changelog>
  <changelog author="fstrba@suse.com" date="1559995200">- Specify java source and target levels in order to build
  compatible protobuf-java binaries</changelog>
  <changelog author="jengelh@inai.de" date="1566475200">- Update to new upstream release 3.9.1
  * Optimized the implementation of RepeatedPtrFieldBase.
  * Added delimited parse and serialize util.
  * Added FieldDescriptor::PrintableNameForExtension() and
    DescriptorPool::FindExtensionByPrintableName(). The latter
    will replace Reflection::FindKnownExtensionByName().
  * Created a new Add method in repeated field that allows adding
    a range of elements all at once.
  * Drop building wheel for Python 3.4.</changelog>
  <changelog author="fstrba@suse.com" date="1569585600">- Package also the protobuf-bom pom file</changelog>
  <changelog author="mmnelemane@suse.com" date="1576756800">- Updated to version 3.9.2 (bsc#1162343)
  (Objective-C)
  * Remove OSReadLittle* due to alignment requirements. (#6678)
  * Don't use unions and instead use memcpy for the type swaps. (#6672)</changelog>
  <changelog author="mpluskal@suse.com" date="1576843200">- Use tarball provided by upstream
- Small package cleanup</changelog>
  <changelog author="mcepl@suse.com" date="1610539200">- Add missing dependency of python subpackages on python-six
  (bsc#1177127).</changelog>
  <changelog author="mcepl@suse.com" date="1612958400">- Fix Requires for python3 to python3-six.</changelog>
  <changelog author="mlin@suse.com" date="1647000000">- Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570,
  bsc#1195258
  * Add protobuf-CVE-2021-22570.patch</changelog>
  <changelog author="mlin@suse.com" date="1664884800">- Fix potential Denial of Service in protobuf-java in the parsing procedure
  for binary data, CVE-2021-22569, bsc#1194530
  * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch</changelog>
  <changelog author="mlin@suse.com" date="1666267200">- Fix a potential DoS issue in protobuf-cpp and protobuf-python,
  CVE-2022-1941, bsc#1203681
  * Add protobuf-CVE-2022-1941.patch
- Fix a potential DoS issue when parsing with binary data in
  protobuf-java, CVE-2022-3171, bsc#1204256
  * Add protobuf-CVE-2022-3171.patch
- Refresh protobuf-CVE-2021-22570.patch
- Backport changes from 3.16.x tree for apply recent CVE patches
  * Add protobuf-51026d922970e06475f005b39287963594134b96.patch
  * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch
  * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch
  * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch
  * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch
  * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch
  * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch
  * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch
  * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch
- Reorganize patch set ordering</changelog>
</package>
<package pkgid="ab7fa5af3cf1b10698722e63d1a0b122ea67c399599710913647da0e84bba857" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="f2eead501ecf53d21ba809a274e2931f26a6d22efb16b00a779cde7e101137af" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="f23fd705778fbbb88de3cd1f4681291e31ec249598a814dd0b21e6f7673daa67" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="3f9d8f05788ca498d8b96658189eaf4e3e102022d329331752ea468b135b1cb0" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="49902fcb5e9f25f24df32042872e6b6e98bfbf7a299de05a77aec1650023bc36" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="2749258afbcbadc7f896d6a46ed3481034b6e9df19264462f8749e2337c1a886" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="548e35746a4da58adc29a1926c15260c1dc22041096c8caa27a73098d2578d59" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="d2405f2bf2822f171d52444d62e864c3c20a9a80076ca7944772418d45602044" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="8b3279ecfde2305f7e82716217cd31b6fd60e9a9810dbca9e3551a7982047172" name="librados2" arch="aarch64">
  <version epoch="0" ver="16.2.9.536+g41a9f9a5573" rel="150300.6.3.1"/>
  <changelog author="ncutler@suse.com" date="1626955200">- Update to 16.2.5-110-gc5d9c915c46:
  + rebased on top of upstream commit SHA1 7feddc9819ca05586f230accd67b4e26a328e618
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path</changelog>
  <changelog author="ncutler@suse.com" date="1627387200">- Update to 16.2.5-111-ga5b472dfcf8:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9</changelog>
  <changelog author="ncutler@suse.com" date="1627646400">- Update to 16.2.5-113-g8b5bda7684e:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9
    improved version of patch that did not work as intended</changelog>
  <changelog author="ncutler@suse.com" date="1630584000">- Update to 16.2.5-504-g6a3a59bd19e:
  + rebased on top of upstream commit SHA1 0d1e1f2973cae7645126fc88a72743367c790d9d
  + (bsc#1189605) cmake: exclude "grafonnet-lib" target from "all"</changelog>
  <changelog author="sallen@suse.com" date="1632139200">- Update to Version: 16.2.6.45+g8fda9838398:
  + rebased on top of upstream commit SHA1 dbc87327c37d0f305c2107e487cb98a072ae858b
    upstream 16.2.6 release
    https://ceph.io/releases/v16-2-6-pacific-released/</changelog>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)</changelog>
</package>
<package pkgid="153f0ece285470da7f1c2eaeece26a97d7db03e461296a4a24a617bf389eda23" name="librados2" arch="x86_64">
  <version epoch="0" ver="16.2.9.536+g41a9f9a5573" rel="150300.6.3.1"/>
  <changelog author="ncutler@suse.com" date="1626955200">- Update to 16.2.5-110-gc5d9c915c46:
  + rebased on top of upstream commit SHA1 7feddc9819ca05586f230accd67b4e26a328e618
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path</changelog>
  <changelog author="ncutler@suse.com" date="1627387200">- Update to 16.2.5-111-ga5b472dfcf8:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9</changelog>
  <changelog author="ncutler@suse.com" date="1627646400">- Update to 16.2.5-113-g8b5bda7684e:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9
    improved version of patch that did not work as intended</changelog>
  <changelog author="ncutler@suse.com" date="1630584000">- Update to 16.2.5-504-g6a3a59bd19e:
  + rebased on top of upstream commit SHA1 0d1e1f2973cae7645126fc88a72743367c790d9d
  + (bsc#1189605) cmake: exclude "grafonnet-lib" target from "all"</changelog>
  <changelog author="sallen@suse.com" date="1632139200">- Update to Version: 16.2.6.45+g8fda9838398:
  + rebased on top of upstream commit SHA1 dbc87327c37d0f305c2107e487cb98a072ae858b
    upstream 16.2.6 release
    https://ceph.io/releases/v16-2-6-pacific-released/</changelog>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)</changelog>
</package>
<package pkgid="cb4701bb6894a82dbe028f217ed8141d4f75823bfea44784b15e38025017d6a0" name="librbd1" arch="aarch64">
  <version epoch="0" ver="16.2.9.536+g41a9f9a5573" rel="150300.6.3.1"/>
  <changelog author="ncutler@suse.com" date="1626955200">- Update to 16.2.5-110-gc5d9c915c46:
  + rebased on top of upstream commit SHA1 7feddc9819ca05586f230accd67b4e26a328e618
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path</changelog>
  <changelog author="ncutler@suse.com" date="1627387200">- Update to 16.2.5-111-ga5b472dfcf8:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9</changelog>
  <changelog author="ncutler@suse.com" date="1627646400">- Update to 16.2.5-113-g8b5bda7684e:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9
    improved version of patch that did not work as intended</changelog>
  <changelog author="ncutler@suse.com" date="1630584000">- Update to 16.2.5-504-g6a3a59bd19e:
  + rebased on top of upstream commit SHA1 0d1e1f2973cae7645126fc88a72743367c790d9d
  + (bsc#1189605) cmake: exclude "grafonnet-lib" target from "all"</changelog>
  <changelog author="sallen@suse.com" date="1632139200">- Update to Version: 16.2.6.45+g8fda9838398:
  + rebased on top of upstream commit SHA1 dbc87327c37d0f305c2107e487cb98a072ae858b
    upstream 16.2.6 release
    https://ceph.io/releases/v16-2-6-pacific-released/</changelog>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)</changelog>
</package>
<package pkgid="47b000f909ed54f812b12c13234b0441426de11049dbcf8ab0dc89e47a3087c8" name="librbd1" arch="x86_64">
  <version epoch="0" ver="16.2.9.536+g41a9f9a5573" rel="150300.6.3.1"/>
  <changelog author="ncutler@suse.com" date="1626955200">- Update to 16.2.5-110-gc5d9c915c46:
  + rebased on top of upstream commit SHA1 7feddc9819ca05586f230accd67b4e26a328e618
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path</changelog>
  <changelog author="ncutler@suse.com" date="1627387200">- Update to 16.2.5-111-ga5b472dfcf8:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9</changelog>
  <changelog author="ncutler@suse.com" date="1627646400">- Update to 16.2.5-113-g8b5bda7684e:
  + (bsc#1188741) compression/snappy: use uint32_t to be compatible with 1.1.9
    improved version of patch that did not work as intended</changelog>
  <changelog author="ncutler@suse.com" date="1630584000">- Update to 16.2.5-504-g6a3a59bd19e:
  + rebased on top of upstream commit SHA1 0d1e1f2973cae7645126fc88a72743367c790d9d
  + (bsc#1189605) cmake: exclude "grafonnet-lib" target from "all"</changelog>
  <changelog author="sallen@suse.com" date="1632139200">- Update to Version: 16.2.6.45+g8fda9838398:
  + rebased on top of upstream commit SHA1 dbc87327c37d0f305c2107e487cb98a072ae858b
    upstream 16.2.6 release
    https://ceph.io/releases/v16-2-6-pacific-released/</changelog>
  <changelog author="ncutler@suse.com" date="1636113600">- Update to 16.2.6-462-g5fefbbf8888:
  + rebased on top of upstream commit SHA1 dd7139c66c1d36da50475ec97d8d6b54b07d1dea
  * (bsc#1191751) rgw/tracing: unify SO version numbers within librgw2 package
  * spec: make selinux scriptlets respect CEPH_AUTO_RESTART_ON_UPGRADE</changelog>
  <changelog author="ncutler@suse.com" date="1636545600">- Preservation of Bugzilla, Jira and CVE citations from earlier incarnations of
  this changes file after double-checking that none of these fixes got lost in
  the pacific rebase:
  + bsc#1163764 (--container-init feature cherry-picked to octopus)
  + bsc#1170200 (mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically)
  + bsc#1172926 (mgr/orchestrator: Sort 'ceph orch device ls' by host)
  + bsc#1173079 (mgr/devicehealth: device_health_metrics pool gets created even without any OSDs in the cluster)
  + bsc#1174466 (mon: have 'mon stat' output json as well)
  + bsc#1174526 (mgr/dashboard: allow getting fresh inventory data from the orchestrator)
  + bsc#1174529 (rpm: on SUSE, podman is required for cephadm to work)
  + bsc#1174644 (cephadm: log to file)
  + bsc#1175120 (downstream branding)
  + bsc#1175161 (downstream branding)
  + bsc#1175169 (downstream branding)
  + bsc#1176390 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176451 (Drop patch "rpm: on SUSE, podman is required for cephadm to work")
  + bsc#1176489 (mgr/cephadm: lock multithreaded access to OSDRemovalQueue)
  + bsc#1176499 (mgr/cephadm: fix RemoveUtil.load_from_store())
  + bsc#1176638 (ceph-volume: batch: call the right prepare method)
  + bsc#1176679 (mgr/dashboard: enable different URL for users of browser to Grafana)
  + bsc#1176828 (cephadm: command_unit: call systemctl with verbose=True)
  + bsc#1177078 (mgr/dashboard: Fix bugs in a unit test and i18n translation)
  + bsc#1177151 (python-common: do not skip unavailable devices)
  + bsc#1177319 (--container-init feature cherry-picked to octopus)
  + bsc#1177344 (mgr/dashboard: support Orchestrator and user-defined Ganesha cluster)
  + bsc#1177360 (cephadm: silence "Failed to evict container" log msg)
  + bsc#1177450 (ceph-volume: don't exit before empty report can be printed)
  + bsc#1177643 (Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse")
  + bsc#1177676 (cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files)
  + bsc#1177843 (CVE-2020-25660)
  + bsc#1177857 (mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails)
  + bsc#1177933 (cephadm: configure journald as the logdriver)
  + bsc#1178531 (cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph)
  + bsc#1178837 (rgw: cls/user: set from_index for reset stats calls)
  + bsc#1178860 (mgr/dashboard: Disable TLS 1.0 and 1.1)
  + bsc#1178905 (CVE-2020-25678)
  + bsc#1178932 (cephadm: reference the last local image by digest)
  + bsc#1179016 (rpm: require smartmontools on SUSE)
  + bsc#1179452 (mgr/insights: Test environment requires 'six')
  + bsc#1179526 (rgw: during GC defer, prevent new GC enqueue)
  + bsc#1179569 (cephadm: reference the last local image by digest)
  + bsc#1179802 (CVE-2020-27781)
  + bsc#1179997 (CVE-2020-27839)
  + bsc#1180107 (ceph-volume: pass --filter-for-batch from drive-group subcommand)
  + bsc#1180155 (CVE-2020-27781)
  + bsc#1181291 (mgr/cephadm: alias rgw-nfs -&gt; nfs)
  + bsc#1182766 (cephadm: fix 'inspect' and 'pull')
  + bsc#1183074 (CVE-2021-20288)
  + bsc#1183561 (mgr/cephadm: on ssh connection error, advice chmod 0600)
  + bsc#1183899 (bluestore: fix huge reads/writes at BlueFS)
  + bsc#1184231 (cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections)
  + bsc#1184517 (cls/rgw: look for plane entries in non-ascii plain namespace too)
  + bsc#1185246 (rgw: check object locks in multi-object delete)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1185619 (CVE-2021-3524)
  + bsc#1186020 (CVE-2021-3531)
  + bsc#1186021 (CVE-2021-3509)
  + bsc#1186348 (mgr/zabbix: adapt zabbix_sender default path)
  + bsc#1188979 ("mgr/cephadm: pass --container-init to "cephadm deploy" if specified" and "Revert "cephadm: default container_init to False")
  + bsc#1189173 (downstream branding)
  + jsc#SES-1071 (ceph-volume: major batch refactor - upstream PR#34740)
  + jsc#SES-185 (SES support with cache software)
  + jsc#SES-704 (mgr/snap_schedule)</changelog>
  <changelog author="ncutler@suse.com" date="1637582400">- Update to 16.2.6-463-g22e7612f9ad:
  + (bsc#1178073) mgr/dashboard: fix downstream NFS doc links</changelog>
  <changelog author="stefen.allen@suse.com" date="1641816000">- Update to 16.2.7-37-gb3be69440db:
  + (bsc#1194353) Downstream branding breaks dashboard npm build</changelog>
  <changelog author="stefen.allen@suse.com" date="1646395200">- Update to 16.2.7-577-g3e3603b5dd1
  + Update prometheus-server version</changelog>
  <changelog author="stefen.allen@suse.com" date="1646740800">- Update to 16.2.7-596-g7d574789716
  + Update Prometheus Container image paths (pr #459)
  + mgr/dashboard: Fix documentation URL (pr #456)
  + mgr/dashboard: Adapt downstream branded navigation page (pr #454)</changelog>
  <changelog author="stefen.allen@suse.com" date="1647345600">- Update to 16.2.7-640-gceb23c7491b
  + (bsc#1194875) common: fix FTBFS due to dout &amp; need_dynamic on GCC-12
  + (bsc#1196938) cephadm: preserve authorized_keys file during upgrade</changelog>
  <changelog author="stefen.allen@suse.com" date="1648123200">- Update to 16.2.7-650-gd083eaa3886
  + (pr#469) cephadm: update image paths to registry.suse.com
  + (pr#468) cephadm: use snmp-notifier image from registry.suse.de
  + (pr#467) cephadm: infer the default container image during pull
  + (pr#465) mgr/cephadm: try to get FQDN for inventory address
  + Sync _constaints file for IBS and OBS</changelog>
  <changelog author="stefen.allen@suse.com" date="1648641600">- Update to v16.2.7-652-gf5dc462fdb5
  + (bsc#1194875) [SES7P] include/buffer: include &lt;memory&gt;</changelog>
  <changelog author="stefen.allen@suse.com" date="1648728000">- Update to v16.2.7-654-gd5a90ff46f0
  + (bsc#1196733) remove build directory during %clean</changelog>
  <changelog author="michael.fritch@suse.com" date="1650369600">- Update to 16.2.7-969-g6195a460d89
  + (jsc#SES-2515) High-availability NFS export</changelog>
  <changelog author="michael.fritch@suse.com" date="1653307200">- Update to 16.2.9.50-g7d9f12156fb:
  + (jsc#SES-2515) High-availability NFS export
  + (bsc#1196044) cephadm: prometheus: The generatorURL in alerts is only using hostname
  + (bsc#1196785) cephadm: avoid crashing on expected non-zero exit</changelog>
  <changelog author="stefen.allen@suse.com" date="1654171200">- Update to ceph-16.2.9-58-ge2e5cb80063:
  + (bsc#1200064, pr#480) Remove last vestiges of docker.io image paths</changelog>
  <changelog author="tserong@suse.com" date="1654776000">- Update to 16.2.9-158-gd93952c7eea:
  + cmake: check for python(\d)\.(\d+) when building boost
  + make-dist: patch boost source to support python 3.10</changelog>
  <changelog author="tserong@suse.com" date="1657713600">- Update to 16.2.9-536-g41a9f9a5573:
  + (bsc#1195359, bsc#1200553) rgw: check bucket shard init status in RGWRadosBILogTrimCR
  + (bsc#1194131) ceph-volume: honour osd_dmcrypt_key_size option (CVE-2021-3979)</changelog>
</package>
<package pkgid="43543d6c47ec3366dff0df8c8f4c81e7147b6e542d0487a134c5a7b8f022b4c0" name="libsgutils2-1_43-2" arch="aarch64">
  <version epoch="0" ver="1.44~763+22.a121545" rel="150300.16.5.1"/>
  <changelog author="hare@suse.de" date="1455796800">- Update to new upstream release 1.42:
  * sg_timestamp: new, to report or set timestamp
  * sg_read_attr: new, supported by tape drives
  * sg_stpg: fix truncation of target port field
  * sg_inq: cope with unicode strings, udev fixes
  - update version descriptor list to 20160125
  - '--export': new entries for UUID descriptor
  * sg_ses: add more field acronyms (ses3r11)
  8 sg_logs: add Utilization lpage (sbc4r07)
  - add Background operation lpage
  - add Pending defects lpage
  - add LPS misalignment lpage (sbc4r10)
  - document '--All' ('-A') option
  - rework lto tape vendor lpages
  * sg_vpd: add Block limits extension VPD page
  - add Device constituents VPD page
  - add LB Protection VPD page (ssc 15-296r1)
  - LB provisioning VPD page: expand LBPRZ, add
    Minimum and Threshold percentage fields
  - rework lto tape vendor VPD pages
  * sg_inq+sg_vpd+sg_xcopy: add support for locally
    assigned UUIDs in VPD page 0x83 (15-267r2)
  * sg_sanitize: add --znr option (sbc4r07)
  * sg_rep_zones: add --partial option (zbc-r04)
  * sg_format: add ffmt option (sbc4r10)
  - add support for FORMAT MEDIUM (for tape)
  * sg_raw: document length relationships
  * rescan-scsi-bus.sh: updates from Suse
  * sg_lib_data: sync asc/ascq codes with T10 20151126
  * sg_lib: add 'sense' categories for SCSI statuses:
    condition met, busy, task set full, ACA active and
    task aborted
  - add pr2serr() extern
  - change sg_get_sense_str() and dStrHexStr(), return
    chars written (returned void previously)
  - add sg_get_sense_descriptors_str() function
  - add sg_get_designation_descriptor_str() function
  - sg_get_desig_type_str()+sg_get_desig_assoc_str()
    and sg_get_desig_code_set_str() added
  - sg_get_opcode_sa_name() break out zoning in/out,
    read attribute and read position service actions
  * sg_cmds_extra: add sg_ll_format_unit2() for FFMT
  * sg_pr2serr.h: new, to shorten fprintf(stderr, ...)
  * sg_io_linux, sg_pt_linux: drop SUGGEST_* decoding
  * sg_unaligned.h: add 48 bit support and gets for
    variable length unsigned integers
- Delete sg3_utils-sg_inq-blacklist.diff; solved differently
- Added 40-usb-blacklist.rules (bsc#840054)
- Delete sg3_utils-58-scsi-sg3_symlink-fixup.patch;
  merged with upstream
- Delete sg3_utils-flush-fixup.patch; merged with upstream</changelog>
  <changelog author="hare@suse.de" date="1461844800">- sg_inq,sg_vpd: Safe VPD page access (bsc#945094)
  * Add 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch</changelog>
  <changelog author="hare@suse.de" date="1461931200">- Update to new upstream release 1.43:
  * sg_senddiag: add --timeout=SEC option
  * sg_sanitize: add --timeout=SEC option
  * sg_format: add --timeout=SEC option
  * sg_decode sense: add --cdb option
  * sg_ses: handle 2 bit EIIOE field in aes dpage
  - expand join handling of SAS connectors and others
  - expand join debug code
  * sg_logs: fix volume statistics lpage when subpage
    is zero (ssc5r02a); decode mount history log parameter
  - decode Requested recovery, TapeAlert response, and
    Service buffer information lpages for tape
  - add '--pdt=DT' option
  * sg_inq: fix potential unbounded loop in --export
  - update version descriptor list to 20160420
  * sg_inq+sg_vpd: update Extended inquiry data vpd
    page (spc5r09)
  - add --force option to bypass checking supported
    vpd pages page and fetch requested page directly
  * sg_reassign+sg_write_same: fix ULONG_MAX problem
  * sg_turs+sg_requests: make both accept '--num=NUM'
    and '--number=NUM' for mutual compatibility
  * sg_zone: fix debug cdb naming
  * sg_opcode: add '--enumerate' and '--pdt=' options
  * sg_raw: add '--enumerate' option
  * sg_lib: add SSC maintenance in/out sa names
  - add read buffer(16) command mode names
  - add sg_decode_transportid_str()
  * sg_lib_data: sync asc/ascq codes with T10 20160425
  * rescan-scsi-bus.sh: harden code
  * clang --analyze static checker clean ups
  * shellcheck cleanup on scripts
  * automake: add AM_PROG_AR to configure.ac
  - upgrade to version 1.15
- Include patches from upstream:
  * sg_inq+sg_vpd: add --force option to bypass checking
    of supported vpd pages
  * sg_lib_data: add Bind and Unbind to service action out(16)
- Remove 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch; merged
  with upstream.</changelog>
  <changelog author="sparschauer@suse.de" date="1473249600">- using "--lun" now works correctly (bsc#981452), adding patch:
  * add-lunsearch-filter-to-searchexisting.patch</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Remove superfluous insserv PreReq.</changelog>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- Use separate repository for SLE15</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Spec file: add fc_wwpn_id to generate by-path links for
  fibrechannel (bsc#1005063)
- Update to version 1.44~763+17.35f525b:
  * Changed versioning scheme (svn r763, pre-release of
    upstream 1.44, plus 16 SUSE patches, SUSE git commit b2fedfa)
  * Code-identical to previous release except for the following:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)</changelog>
  <changelog author="mwilck@suse.com" date="1556625600">- Update to version 1.44~763+19.1ed0757:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
  (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.44~763+20.81dc714:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1657800000">- Update to version 1.44~763+21.3d16f61:
  * sg_turs: fix exit status when not ready in single case
    (boo#1095671)</changelog>
  <changelog author="mwilck@suse.com" date="1657800001">- Update to version 1.44~763+22.a121545:
  * Add systemd service files for LUN masking
  (bsc#1099278, bsc#954600)</changelog>
</package>
<package pkgid="7d9f03d497be65d5cd9c68b97c6a730fb6267f866ca88a0e269725ad452040b7" name="libsgutils2-1_43-2" arch="x86_64">
  <version epoch="0" ver="1.44~763+22.a121545" rel="150300.16.5.1"/>
  <changelog author="hare@suse.de" date="1455796800">- Update to new upstream release 1.42:
  * sg_timestamp: new, to report or set timestamp
  * sg_read_attr: new, supported by tape drives
  * sg_stpg: fix truncation of target port field
  * sg_inq: cope with unicode strings, udev fixes
  - update version descriptor list to 20160125
  - '--export': new entries for UUID descriptor
  * sg_ses: add more field acronyms (ses3r11)
  8 sg_logs: add Utilization lpage (sbc4r07)
  - add Background operation lpage
  - add Pending defects lpage
  - add LPS misalignment lpage (sbc4r10)
  - document '--All' ('-A') option
  - rework lto tape vendor lpages
  * sg_vpd: add Block limits extension VPD page
  - add Device constituents VPD page
  - add LB Protection VPD page (ssc 15-296r1)
  - LB provisioning VPD page: expand LBPRZ, add
    Minimum and Threshold percentage fields
  - rework lto tape vendor VPD pages
  * sg_inq+sg_vpd+sg_xcopy: add support for locally
    assigned UUIDs in VPD page 0x83 (15-267r2)
  * sg_sanitize: add --znr option (sbc4r07)
  * sg_rep_zones: add --partial option (zbc-r04)
  * sg_format: add ffmt option (sbc4r10)
  - add support for FORMAT MEDIUM (for tape)
  * sg_raw: document length relationships
  * rescan-scsi-bus.sh: updates from Suse
  * sg_lib_data: sync asc/ascq codes with T10 20151126
  * sg_lib: add 'sense' categories for SCSI statuses:
    condition met, busy, task set full, ACA active and
    task aborted
  - add pr2serr() extern
  - change sg_get_sense_str() and dStrHexStr(), return
    chars written (returned void previously)
  - add sg_get_sense_descriptors_str() function
  - add sg_get_designation_descriptor_str() function
  - sg_get_desig_type_str()+sg_get_desig_assoc_str()
    and sg_get_desig_code_set_str() added
  - sg_get_opcode_sa_name() break out zoning in/out,
    read attribute and read position service actions
  * sg_cmds_extra: add sg_ll_format_unit2() for FFMT
  * sg_pr2serr.h: new, to shorten fprintf(stderr, ...)
  * sg_io_linux, sg_pt_linux: drop SUGGEST_* decoding
  * sg_unaligned.h: add 48 bit support and gets for
    variable length unsigned integers
- Delete sg3_utils-sg_inq-blacklist.diff; solved differently
- Added 40-usb-blacklist.rules (bsc#840054)
- Delete sg3_utils-58-scsi-sg3_symlink-fixup.patch;
  merged with upstream
- Delete sg3_utils-flush-fixup.patch; merged with upstream</changelog>
  <changelog author="hare@suse.de" date="1461844800">- sg_inq,sg_vpd: Safe VPD page access (bsc#945094)
  * Add 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch</changelog>
  <changelog author="hare@suse.de" date="1461931200">- Update to new upstream release 1.43:
  * sg_senddiag: add --timeout=SEC option
  * sg_sanitize: add --timeout=SEC option
  * sg_format: add --timeout=SEC option
  * sg_decode sense: add --cdb option
  * sg_ses: handle 2 bit EIIOE field in aes dpage
  - expand join handling of SAS connectors and others
  - expand join debug code
  * sg_logs: fix volume statistics lpage when subpage
    is zero (ssc5r02a); decode mount history log parameter
  - decode Requested recovery, TapeAlert response, and
    Service buffer information lpages for tape
  - add '--pdt=DT' option
  * sg_inq: fix potential unbounded loop in --export
  - update version descriptor list to 20160420
  * sg_inq+sg_vpd: update Extended inquiry data vpd
    page (spc5r09)
  - add --force option to bypass checking supported
    vpd pages page and fetch requested page directly
  * sg_reassign+sg_write_same: fix ULONG_MAX problem
  * sg_turs+sg_requests: make both accept '--num=NUM'
    and '--number=NUM' for mutual compatibility
  * sg_zone: fix debug cdb naming
  * sg_opcode: add '--enumerate' and '--pdt=' options
  * sg_raw: add '--enumerate' option
  * sg_lib: add SSC maintenance in/out sa names
  - add read buffer(16) command mode names
  - add sg_decode_transportid_str()
  * sg_lib_data: sync asc/ascq codes with T10 20160425
  * rescan-scsi-bus.sh: harden code
  * clang --analyze static checker clean ups
  * shellcheck cleanup on scripts
  * automake: add AM_PROG_AR to configure.ac
  - upgrade to version 1.15
- Include patches from upstream:
  * sg_inq+sg_vpd: add --force option to bypass checking
    of supported vpd pages
  * sg_lib_data: add Bind and Unbind to service action out(16)
- Remove 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch; merged
  with upstream.</changelog>
  <changelog author="sparschauer@suse.de" date="1473249600">- using "--lun" now works correctly (bsc#981452), adding patch:
  * add-lunsearch-filter-to-searchexisting.patch</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Remove superfluous insserv PreReq.</changelog>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- Use separate repository for SLE15</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Spec file: add fc_wwpn_id to generate by-path links for
  fibrechannel (bsc#1005063)
- Update to version 1.44~763+17.35f525b:
  * Changed versioning scheme (svn r763, pre-release of
    upstream 1.44, plus 16 SUSE patches, SUSE git commit b2fedfa)
  * Code-identical to previous release except for the following:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)</changelog>
  <changelog author="mwilck@suse.com" date="1556625600">- Update to version 1.44~763+19.1ed0757:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
  (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.44~763+20.81dc714:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1657800000">- Update to version 1.44~763+21.3d16f61:
  * sg_turs: fix exit status when not ready in single case
    (boo#1095671)</changelog>
  <changelog author="mwilck@suse.com" date="1657800001">- Update to version 1.44~763+22.a121545:
  * Add systemd service files for LUN masking
  (bsc#1099278, bsc#954600)</changelog>
</package>
<package pkgid="4bd1b7079ea3a6674f389a2fedcfb2fad99a99cedca5a5ff981d728dd8408f9a" name="libslirp" arch="src">
  <version epoch="0" ver="4.3.1" rel="150300.11.1"/>
  <changelog author="appleonkel@opensuse.org" date="1587470400">- Initial package, adapted specfile from Fedora to work on openSUSE</changelog>
  <changelog author="rbrown@suse.com" date="1588593600">- Update to 4.3.0
- Fix use-afte-free in ip_reass() (CVE-2020-1983)</changelog>
  <changelog author="rhafer@suse.com" date="1594209600">- Update to 4.3.1 (bsc#1172380)
  - A silent truncation could occur in `slirp_fmt()`, which will
    now print a critical message. See also #22.
  - CVE-2020-10756 - Drop bogus IPv6 messages that could lead to
    data leakage.  See !44 and !42.
  - Fix win32 builds by using the SLIRP_PACKED definition.
  - Various coverity scan errors fixed. !41
  - Fix new GCC warnings. !43
- Packaging changes
  - Enable "set_version" source service in _service file
  - Move "tar" and "recompress" service to "buildtime" as outlined
    in the OBS user guide
  - Enable "package-meta" as the libslirp build process now
    requires access to the git metadata.</changelog>
  <changelog author="pgajdos@suse.com" date="1645617600">- security update
- added patches
  fix CVE-2021-3592 [bsc#1187364], invalid pointer initialization may lead to information disclosure (bootp)
  + libslirp-CVE-2021-3592.patch
  fix CVE-2021-3594 [bsc#1187367], invalid pointer initialization may lead to information disclosure (udp)
  + libslirp-CVE-2021-3594.patch
  fix CVE-2021-3595 [bsc#1187366], invalid pointer initialization may lead to information disclosure (tftp)
  + libslirp-CVE-2021-3595.patch</changelog>
  <changelog author="sflees@suse.de" date="1650888000">- Fix a dhcp regression [bsc#1198773]
  +libslirp-fix-dhcp-1.patch
  +libslirp-fix-dhcp-2.patch</changelog>
  <changelog author="fvogt@suse.com" date="1658145600">- Add patch to fix the version header (bsc#1201551):
  * 0001-meson-remove-meson-dist-script.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661256000">- security update
- added patches
  fix CVE-2021-3593 [bsc#1187365], invalid pointer initialization may lead to information disclosure (udp6)
  + libslirp-CVE-2021-3593.patch</changelog>
</package>
<package pkgid="77ebc5198c45018e78fe758824531644e6b2e8297cb4cde3b7749c1c0ba5ebfd" name="libslirp0" arch="aarch64">
  <version epoch="0" ver="4.3.1" rel="150300.11.1"/>
  <changelog author="appleonkel@opensuse.org" date="1587470400">- Initial package, adapted specfile from Fedora to work on openSUSE</changelog>
  <changelog author="rbrown@suse.com" date="1588593600">- Update to 4.3.0
- Fix use-afte-free in ip_reass() (CVE-2020-1983)</changelog>
  <changelog author="rhafer@suse.com" date="1594209600">- Update to 4.3.1 (bsc#1172380)
  - A silent truncation could occur in `slirp_fmt()`, which will
    now print a critical message. See also #22.
  - CVE-2020-10756 - Drop bogus IPv6 messages that could lead to
    data leakage.  See !44 and !42.
  - Fix win32 builds by using the SLIRP_PACKED definition.
  - Various coverity scan errors fixed. !41
  - Fix new GCC warnings. !43
- Packaging changes
  - Enable "set_version" source service in _service file
  - Move "tar" and "recompress" service to "buildtime" as outlined
    in the OBS user guide
  - Enable "package-meta" as the libslirp build process now
    requires access to the git metadata.</changelog>
  <changelog author="pgajdos@suse.com" date="1645617600">- security update
- added patches
  fix CVE-2021-3592 [bsc#1187364], invalid pointer initialization may lead to information disclosure (bootp)
  + libslirp-CVE-2021-3592.patch
  fix CVE-2021-3594 [bsc#1187367], invalid pointer initialization may lead to information disclosure (udp)
  + libslirp-CVE-2021-3594.patch
  fix CVE-2021-3595 [bsc#1187366], invalid pointer initialization may lead to information disclosure (tftp)
  + libslirp-CVE-2021-3595.patch</changelog>
  <changelog author="sflees@suse.de" date="1650888000">- Fix a dhcp regression [bsc#1198773]
  +libslirp-fix-dhcp-1.patch
  +libslirp-fix-dhcp-2.patch</changelog>
  <changelog author="fvogt@suse.com" date="1658145600">- Add patch to fix the version header (bsc#1201551):
  * 0001-meson-remove-meson-dist-script.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661256000">- security update
- added patches
  fix CVE-2021-3593 [bsc#1187365], invalid pointer initialization may lead to information disclosure (udp6)
  + libslirp-CVE-2021-3593.patch</changelog>
</package>
<package pkgid="ea50d18111b9fed243d1e876fe41cb4c8f4ceb41a178ccd64d7f48d512589adc" name="libslirp0" arch="x86_64">
  <version epoch="0" ver="4.3.1" rel="150300.11.1"/>
  <changelog author="appleonkel@opensuse.org" date="1587470400">- Initial package, adapted specfile from Fedora to work on openSUSE</changelog>
  <changelog author="rbrown@suse.com" date="1588593600">- Update to 4.3.0
- Fix use-afte-free in ip_reass() (CVE-2020-1983)</changelog>
  <changelog author="rhafer@suse.com" date="1594209600">- Update to 4.3.1 (bsc#1172380)
  - A silent truncation could occur in `slirp_fmt()`, which will
    now print a critical message. See also #22.
  - CVE-2020-10756 - Drop bogus IPv6 messages that could lead to
    data leakage.  See !44 and !42.
  - Fix win32 builds by using the SLIRP_PACKED definition.
  - Various coverity scan errors fixed. !41
  - Fix new GCC warnings. !43
- Packaging changes
  - Enable "set_version" source service in _service file
  - Move "tar" and "recompress" service to "buildtime" as outlined
    in the OBS user guide
  - Enable "package-meta" as the libslirp build process now
    requires access to the git metadata.</changelog>
  <changelog author="pgajdos@suse.com" date="1645617600">- security update
- added patches
  fix CVE-2021-3592 [bsc#1187364], invalid pointer initialization may lead to information disclosure (bootp)
  + libslirp-CVE-2021-3592.patch
  fix CVE-2021-3594 [bsc#1187367], invalid pointer initialization may lead to information disclosure (udp)
  + libslirp-CVE-2021-3594.patch
  fix CVE-2021-3595 [bsc#1187366], invalid pointer initialization may lead to information disclosure (tftp)
  + libslirp-CVE-2021-3595.patch</changelog>
  <changelog author="sflees@suse.de" date="1650888000">- Fix a dhcp regression [bsc#1198773]
  +libslirp-fix-dhcp-1.patch
  +libslirp-fix-dhcp-2.patch</changelog>
  <changelog author="fvogt@suse.com" date="1658145600">- Add patch to fix the version header (bsc#1201551):
  * 0001-meson-remove-meson-dist-script.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1661256000">- security update
- added patches
  fix CVE-2021-3593 [bsc#1187365], invalid pointer initialization may lead to information disclosure (udp6)
  + libslirp-CVE-2021-3593.patch</changelog>
</package>
<package pkgid="0f3f9889a3bcda504d54f0042ed96a824c77de453ce1fad40afe4208ac398afc" name="libsmartcols1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="cb58435483c00cdc815d2b51e1d3a06e04e00d27f604de9ab06334ead24185c1" name="libsmartcols1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="d32ca5a5c1954e639fffc309b3b7b250ceb417007a18445a5a576d900e9affec" name="libsmartcols1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="5dd59b18fd66e110cdec52ec82a8994efec5c74707aef9cad3880c1c3f954eca" name="libsmartcols1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="6cc7eb2e66c52e8a273e387c78c77ad4a1b3287ef42feeeed4d4d6461c5e51cf" name="libsmartcols1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="7ee07d7cb711d6c9ad865697dbf20f78dbf230441f5134bc49ba6224b6014e8f" name="libsmartcols1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="a3e74a28cb1d57073795088832a03f08390b23e9e1305c353b37b1a9acff2eed" name="libsodium" arch="src">
  <version epoch="0" ver="1.0.18" rel="150000.4.6.1"/>
  <changelog author="idonmez@suse.com" date="1445428800">- Now that gcc 5.2 is available on TW, remove the ARMv7 workaround.</changelog>
  <changelog author="idonmez@suse.com" date="1446465600">- Update to 1.0.6
  * Optimized implementations of Blake2 have been added for modern
    Intel platforms. crypto_generichash() is now faster than MD5 and
    SHA1 implementations while being far more secure.
  * The crypto_sign_edwards25519sha512batch_*() functions have been
    tagged as deprecated.
  * sodium_compare() now works as documented, and compares numbers
    in little-endian format instead of behaving like memcmp().
  * sodium_runtime_has_ssse3() and sodium_runtime_has_sse41() have
    been added.</changelog>
  <changelog author="idonmez@suse.com" date="1448971200">- Follow upstream's lead and compile with -flto for &gt; 13.2 on x86
  and x86-64.</changelog>
  <changelog author="idonmez@suse.com" date="1449576000">- Update to version 1.0.7
  * Sandy2x, the fastest Curve25519 implementation ever,
    has been merged in, and is automatically used on CPUs
    supporting the AVX instructions set.
  * An SSE2 optimized implementation of Poly1305 was added,
    and is twice as fast as the portable one.
  * An SSSE3 optimized implementation of ChaCha20 was added,
    and is twice as fast as the portable one.
  * Faster sodium_increment() for common nonce sizes.
  * New helper functions have been added: sodium_is_zero()
    and sodium_add().</changelog>
  <changelog author="idonmez@suse.com" date="1451044800">- Update to version 1.0.8
  * Handle the case where the CPU supports AVX, but we are running
    on an hypervisor with AVX disabled/not supported.
  * Faster (2x) scalarmult_base() when using the ref10 implementation.</changelog>
  <changelog author="idonmez@suse.com" date="1459598400">- Update to version 1.0.9
  * A detached API was added to the ChaCha20-Poly1305 and AES256-GCM
    implementations.
  * The Argon2i password hashing function was added, and is accessible
    directly and through a new, high-level crypto_pwhash API.
    The scrypt function remains available as well.
  * A speed-record AVX2 implementation of BLAKE2b was added.
  * Countermeasures for Ed25519 signatures malleability have been
    added to match the irtf-cfrg-eddsa draft.
  * The HChaCha20 core function was implemented (crypto_core_hchacha20()).
  * No-op stubs were added for all AES256-GCM public functions even
    when compiled on non-Intel platforms.
  * crypt_generichash_blake2b_statebytes() was added.
  * New macros were added for the IETF variant of the ChaCha20-Poly1305
    construction.</changelog>
  <changelog author="idonmez@suse.com" date="1459857600">- Update to version 1.0.10
  * Compile fix update for older GCCs</changelog>
  <changelog author="i@marguerite.su" date="1470484800">- update version 1.0.11
  * sodium_init() is now thread-safe, and can be safely called
    multiple times.
  * Better support for old gcc versions.
  * AVX2 detection was fixed, resulting in faster BLAKE2b hashing
    on platforms where it was not properly detected.
  * The Sandy2x Curve25519 implementation was not as fast as
    expected on some platforms. This has been fixed.
  * The NativeClient target was improved. Most notably, it now
    supports optimized implementations, and uses pepper_49 by default.
  * The library can be compiled with recent Emscripten versions.
    Changes have been made to produce smaller code, and the default
    heap size was reduced in the standard version.
  * Decryption functions can now accept a NULL pointer for the output.
    This checks the MAC without writing the decrypted message.
  * crypto_generichash_final() now returns -1 if called twice.</changelog>
  <changelog author="idonmez@suse.com" date="1489406400">- Update to version 1.0.12
  * Ed25519ph was implemented, adding a multi-part signature API
    (crypto_sign_init(), crypto_sign_update(), crypto_sign_final_*()).
  * New constants and related accessors have been added for Scrypt
    and Argon2.
  * XChaCha20 has been implemented. Like XSalsa20, this construction
    extends the ChaCha20 cipher to accept a 192-bit nonce. This
    makes it safe to use ChaCha20 with random nonces.
  * crypto_secretbox, crypto_box and crypto_aead now offer variants
    leveraging XChaCha20.
  * SHA-2 is about 20% faster, which also gives a speed boost to
    signature and signature verification.
  * AVX2 implementations of Salsa20 and ChaCha20 have been added.
    They are twice as fast as the SSE2 implementations. The speed
    gain is even more significant on Windows, that previously
    didn't use vectorized implementations.
  * New high-level API: crypto_kdf, to easily derive one or more
    subkeys from a master key.
  * Siphash with a 128-bit output has been implemented, and is
    available as crypto_shorthash_siphashx_*.
  * New *_keygen() helpers functions have been added to create
    secret keys for all constructions. This improves code clarity
    and can prevent keys from being partially initialized.
  * A new randombytes_buf_deterministic() function was added to
    deterministically fill a memory region with pseudorandom data.
    This function can especially be useful to write reproducible tests.
  * A preliminary crypto_kx_*() API was added to compute shared
    session keys.
  * AVX2 detection is more reliable.</changelog>
  <changelog author="idonmez@suse.com" date="1506600000">- Update to version 1.0.14
  * Internal consistency checks failing and primitives used with
    dangerous/out-of-bounds/invalid parameters used to call abort(3).
    Now, a custom handler that doesn't return can be set with the
    set_sodium_misuse() function. It still aborts by default or if
    the handler ever returns. This is not a replacement for non-fatal,
    expected runtime errors. This handler will be only called in
    unexpected situations due to potential bugs in the library or in
    language bindings.
  * *_MESSAGEBYTES_MAX macros (and the corresponding _messagebytes_max()
    symbols) have been added to represent the maximum message size that
    can be safely handled by a primitive. Language bindings are
    encouraged to check user inputs against these maximum lengths.
  * The test suite has been extended to cover more edge cases.
  * crypto_sign_ed25519_pk_to_curve25519() now rejects points that
    are not on the curve, or not in the main subgroup.
  * Further changes have been made to ensure that smart compilers
    will not optimize out code that we don't want to be optimized.
  * The sodium_runtime_has_* symbols for CPU features detection are
    now defined as weak symbols, i.e. they can be replaced with an
    application-defined implementation. This can be useful to
    disable AVX* when temperature/power consumption is a concern.
  * crypto_kx_*() now aborts if called with no non-NULL pointers
    to store keys to.
  * SSE2 implementations of crypto_verify_*() have been added.
  * Passwords can be hashed using a specific algorithm with the new
    crypto_pwhash_str_alg() function.
  * Due to popular demand, base64 encoding (sodium_bin2base64())
    and decoding (sodium_base642bin()) have been implemented.
  * A new crypto_secretstream_*() API was added to safely encrypt
    files and multi-part messages.
  * The sodium_pad() and sodium_unpad() helper functions have been
    added in order to add &amp; remove padding.
  * An AVX512 optimized implementation of Argon2 has been added.
  * The crypto_pwhash_str_needs_rehash() function was added to check
    if a password hash string matches the given parameters, or if it
    needs an update.
  Updates from 1.0.13
  * An AVX2 optimized implementation of the Argon2 round function was added.
  * The Argon2id variant of Argon2 has been implemented. The high-level
    crypto_pwhash_str_verify() function automatically detects the
    algorithm and can verify both Argon2i and Argon2id hashed passwords.
    The default algorithm for newly hashed passwords remains Argon2i
    in this version to avoid breaking compatibility with verifiers
    running libsodium &lt;= 1.0.12.
  * A crypto_box_curve25519xchacha20poly1305_seal*() function set was implemented.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1507464000">- Refresh spec-file.
- Update to 1.0.15.
  * Release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.15
  * The default password hashing algorithm is now Argon2id.
  * The pwhash_str_verify() function can still verify Argon2i hashes without any changes,
    and pwhash() can still compute Argon2i hashes as well.
  * The aes128ctr primitive was removed. It was slow, non-standard, not authenticated,
    and didn't seem to be used by any opensource project.
  * Argon2id required at least 3 passes like Argon2i, despite a minimum of 1
    as defined by the OPSLIMIT_MIN constant. This has been fixed.
  * The secretstream construction was slightly changed to be consistent with forthcoming variants.
  * The Javascript and Webassembly versions have been merged, and the module now returns
    a .ready promise that will resolve after the Webassembly code is loaded and compiled.
  * Note that due to these incompatible changes, the library version major was bumped up.</changelog>
  <changelog author="idonmez@suse.com" date="1513166400">- Update to 1.0.16
  * Signatures computations and verifications are now way faster
    on 64-bit platforms with compilers supporting 128-bit
    arithmetic (gcc, clang, icc). This includes the WebAssembly
    target.
  * New low-level APIs for computations over edwards25519:
    crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(),
    crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(),
    crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform()
    (elligator representative to point).
  * crypto_sign_open(), crypto_sign_verify_detached() and
    crypto_sign_edwards25519sha512batch_open` now reject public
    keys in non-canonical form in addition to low-order points.
  * The library can be built with ED25519_NONDETERMINISTIC defined
    in order to use synthetic nonces for EdDSA. This is disabled
    by default.
  * sodium_stackzero() was added to wipe content off the stack.
  * The Salsa20-based PRNG example is now thread-safe on platforms
    with support for thread-local storage, optionally mixes bits
    from RDRAND.
  * Argon2 and scrypt are slightly faster on Linux.</changelog>
  <changelog author="adam.majer@suse.de" date="1514548800">- Enable verbose make output when building tests</changelog>
  <changelog author="mpluskal@suse.com" date="1531396800">- Add gpg signature
- Modernise spec file with spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1531483200">- Add baselibs.conf: build libsodium23-32bit, which is required by
  zeromq's -32bit packages.</changelog>
  <changelog author="ecsos@opensuse.org" date="1549108800">- Update to 1.0.17
  - Bug fix: sodium_pad() didn't properly support block sizes
    &gt;= 256 bytes.
  - JS/WebAssembly: some old iOS versions can't instantiate the
    WebAssembly module; fall back to Javascript on these.
  - JS/WebAssembly: compatibility with newer Emscripten versions.
  - Bug fix: crypto_pwhash_scryptsalsa208sha256_str_verify() and
    crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't
    returnEINVAL` on input strings with a short length, unlike
    their high-level counterpart.
  - Added a workaround for Visual Studio 2010 bug causing CPU
    features not to be detected.
  - Portability improvements.
  - Test vectors from Project Wycheproof have been added.
  - New low-level APIs for arithmetic mod the order of the prime
    order group:
  - crypto_core_ed25519_scalar_random(),
    crypto_core_ed25519_scalar_reduce(),
  - crypto_core_ed25519_scalar_invert(),
    crypto_core_ed25519_scalar_negate(),
  - crypto_core_ed25519_scalar_complement(),
    crypto_core_ed25519_scalar_add() and
    crypto_core_ed25519_scalar_sub().
  - New low-level APIs for scalar multiplication without clamping:
    crypto_scalarmult_ed25519_base_noclamp() and
    crypto_scalarmult_ed25519_noclamp().
    These new APIs are especially useful for blinding.
  - sodium_sub() has been implemented.
  - Support for WatchOS has been added.
  - getrandom(2) is now used on FreeBSD 12+.
  - The nonnull attribute has been added to all relevant
    prototypes.
  - More reliable AVX512 detection.
  - Javascript/Webassembly builds now use dynamic memory growth.</changelog>
  <changelog author="ecsos@opensuse.org" date="1560686400">- Update to 1.0.18
  - Enterprise versions of Visual Studio are now supported.
  - Visual Studio 2019 is now supported.
  - 32-bit binaries for Visual Studio 2010 are now provided.
  - A test designed to trigger an OOM condition didn't work on
    Linux systems with memory overcommit turned on. It has been
    removed in order to fix Ansible builds.
  - Emscripten: print and printErr functions are overridden to send
    errors to the console, if there is one.
  - Emscripten: UTF8ToString() is now exported since
    Pointer_stringify() has been deprecated.
  - Libsodium version detection has been fixed in the CMake recipe.
  - Generic hashing got a 10% speedup on AVX2.
  - New target: WebAssembly/WASI
    (compile with dist-builds/wasm32-wasi.sh).
  - New functions to map a hash to an edwards25519 point
    or get a random point:
    core_ed25519_from_hash() and core_ed25519_random().
  - crypto_core_ed25519_scalar_mul() has been implemented for
    scalar*scalar (mod L) multiplication.
  - Support for the Ristretto group has been implemented for
    interoperability with wasm-crypto.
  - Improvements have been made to the test suite.
  - Portability improvements have been made.
  - getentropy() is now used on systems providing this system call.
  - randombytes_salsa20 has been renamed to randombytes_internal.
  - Support for NativeClient has been removed.
  - Most ((nonnull)) attributes have been relaxed to allow 0-length
    inputs to be NULL.
  - The -ftree-vectorize and -ftree-slp-vectorize compiler switches
    are now used, if available, for optimized builds.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1565956800">-  Add libsodium_configure_cpuid_chg.patch and call autoconf
  to regenerate configure script with proper CPUID checking.
  Required at least for PowerPC and ARM now that LTO enabled.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1566820800">-  Revert previous change about cpuid as previous change rejected
  in https://build.opensuse.org/request/show/724809
-  Disable LTO as bypass boo#1148184</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1658404800">- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)</changelog>
</package>
<package pkgid="05dd8e3c4f45621dd9b86982b7f1789c01cee18663da0f8239638a19341d5d01" name="libsodium23" arch="aarch64">
  <version epoch="0" ver="1.0.18" rel="150000.4.6.1"/>
  <changelog author="idonmez@suse.com" date="1445428800">- Now that gcc 5.2 is available on TW, remove the ARMv7 workaround.</changelog>
  <changelog author="idonmez@suse.com" date="1446465600">- Update to 1.0.6
  * Optimized implementations of Blake2 have been added for modern
    Intel platforms. crypto_generichash() is now faster than MD5 and
    SHA1 implementations while being far more secure.
  * The crypto_sign_edwards25519sha512batch_*() functions have been
    tagged as deprecated.
  * sodium_compare() now works as documented, and compares numbers
    in little-endian format instead of behaving like memcmp().
  * sodium_runtime_has_ssse3() and sodium_runtime_has_sse41() have
    been added.</changelog>
  <changelog author="idonmez@suse.com" date="1448971200">- Follow upstream's lead and compile with -flto for &gt; 13.2 on x86
  and x86-64.</changelog>
  <changelog author="idonmez@suse.com" date="1449576000">- Update to version 1.0.7
  * Sandy2x, the fastest Curve25519 implementation ever,
    has been merged in, and is automatically used on CPUs
    supporting the AVX instructions set.
  * An SSE2 optimized implementation of Poly1305 was added,
    and is twice as fast as the portable one.
  * An SSSE3 optimized implementation of ChaCha20 was added,
    and is twice as fast as the portable one.
  * Faster sodium_increment() for common nonce sizes.
  * New helper functions have been added: sodium_is_zero()
    and sodium_add().</changelog>
  <changelog author="idonmez@suse.com" date="1451044800">- Update to version 1.0.8
  * Handle the case where the CPU supports AVX, but we are running
    on an hypervisor with AVX disabled/not supported.
  * Faster (2x) scalarmult_base() when using the ref10 implementation.</changelog>
  <changelog author="idonmez@suse.com" date="1459598400">- Update to version 1.0.9
  * A detached API was added to the ChaCha20-Poly1305 and AES256-GCM
    implementations.
  * The Argon2i password hashing function was added, and is accessible
    directly and through a new, high-level crypto_pwhash API.
    The scrypt function remains available as well.
  * A speed-record AVX2 implementation of BLAKE2b was added.
  * Countermeasures for Ed25519 signatures malleability have been
    added to match the irtf-cfrg-eddsa draft.
  * The HChaCha20 core function was implemented (crypto_core_hchacha20()).
  * No-op stubs were added for all AES256-GCM public functions even
    when compiled on non-Intel platforms.
  * crypt_generichash_blake2b_statebytes() was added.
  * New macros were added for the IETF variant of the ChaCha20-Poly1305
    construction.</changelog>
  <changelog author="idonmez@suse.com" date="1459857600">- Update to version 1.0.10
  * Compile fix update for older GCCs</changelog>
  <changelog author="i@marguerite.su" date="1470484800">- update version 1.0.11
  * sodium_init() is now thread-safe, and can be safely called
    multiple times.
  * Better support for old gcc versions.
  * AVX2 detection was fixed, resulting in faster BLAKE2b hashing
    on platforms where it was not properly detected.
  * The Sandy2x Curve25519 implementation was not as fast as
    expected on some platforms. This has been fixed.
  * The NativeClient target was improved. Most notably, it now
    supports optimized implementations, and uses pepper_49 by default.
  * The library can be compiled with recent Emscripten versions.
    Changes have been made to produce smaller code, and the default
    heap size was reduced in the standard version.
  * Decryption functions can now accept a NULL pointer for the output.
    This checks the MAC without writing the decrypted message.
  * crypto_generichash_final() now returns -1 if called twice.</changelog>
  <changelog author="idonmez@suse.com" date="1489406400">- Update to version 1.0.12
  * Ed25519ph was implemented, adding a multi-part signature API
    (crypto_sign_init(), crypto_sign_update(), crypto_sign_final_*()).
  * New constants and related accessors have been added for Scrypt
    and Argon2.
  * XChaCha20 has been implemented. Like XSalsa20, this construction
    extends the ChaCha20 cipher to accept a 192-bit nonce. This
    makes it safe to use ChaCha20 with random nonces.
  * crypto_secretbox, crypto_box and crypto_aead now offer variants
    leveraging XChaCha20.
  * SHA-2 is about 20% faster, which also gives a speed boost to
    signature and signature verification.
  * AVX2 implementations of Salsa20 and ChaCha20 have been added.
    They are twice as fast as the SSE2 implementations. The speed
    gain is even more significant on Windows, that previously
    didn't use vectorized implementations.
  * New high-level API: crypto_kdf, to easily derive one or more
    subkeys from a master key.
  * Siphash with a 128-bit output has been implemented, and is
    available as crypto_shorthash_siphashx_*.
  * New *_keygen() helpers functions have been added to create
    secret keys for all constructions. This improves code clarity
    and can prevent keys from being partially initialized.
  * A new randombytes_buf_deterministic() function was added to
    deterministically fill a memory region with pseudorandom data.
    This function can especially be useful to write reproducible tests.
  * A preliminary crypto_kx_*() API was added to compute shared
    session keys.
  * AVX2 detection is more reliable.</changelog>
  <changelog author="idonmez@suse.com" date="1506600000">- Update to version 1.0.14
  * Internal consistency checks failing and primitives used with
    dangerous/out-of-bounds/invalid parameters used to call abort(3).
    Now, a custom handler that doesn't return can be set with the
    set_sodium_misuse() function. It still aborts by default or if
    the handler ever returns. This is not a replacement for non-fatal,
    expected runtime errors. This handler will be only called in
    unexpected situations due to potential bugs in the library or in
    language bindings.
  * *_MESSAGEBYTES_MAX macros (and the corresponding _messagebytes_max()
    symbols) have been added to represent the maximum message size that
    can be safely handled by a primitive. Language bindings are
    encouraged to check user inputs against these maximum lengths.
  * The test suite has been extended to cover more edge cases.
  * crypto_sign_ed25519_pk_to_curve25519() now rejects points that
    are not on the curve, or not in the main subgroup.
  * Further changes have been made to ensure that smart compilers
    will not optimize out code that we don't want to be optimized.
  * The sodium_runtime_has_* symbols for CPU features detection are
    now defined as weak symbols, i.e. they can be replaced with an
    application-defined implementation. This can be useful to
    disable AVX* when temperature/power consumption is a concern.
  * crypto_kx_*() now aborts if called with no non-NULL pointers
    to store keys to.
  * SSE2 implementations of crypto_verify_*() have been added.
  * Passwords can be hashed using a specific algorithm with the new
    crypto_pwhash_str_alg() function.
  * Due to popular demand, base64 encoding (sodium_bin2base64())
    and decoding (sodium_base642bin()) have been implemented.
  * A new crypto_secretstream_*() API was added to safely encrypt
    files and multi-part messages.
  * The sodium_pad() and sodium_unpad() helper functions have been
    added in order to add &amp; remove padding.
  * An AVX512 optimized implementation of Argon2 has been added.
  * The crypto_pwhash_str_needs_rehash() function was added to check
    if a password hash string matches the given parameters, or if it
    needs an update.
  Updates from 1.0.13
  * An AVX2 optimized implementation of the Argon2 round function was added.
  * The Argon2id variant of Argon2 has been implemented. The high-level
    crypto_pwhash_str_verify() function automatically detects the
    algorithm and can verify both Argon2i and Argon2id hashed passwords.
    The default algorithm for newly hashed passwords remains Argon2i
    in this version to avoid breaking compatibility with verifiers
    running libsodium &lt;= 1.0.12.
  * A crypto_box_curve25519xchacha20poly1305_seal*() function set was implemented.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1507464000">- Refresh spec-file.
- Update to 1.0.15.
  * Release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.15
  * The default password hashing algorithm is now Argon2id.
  * The pwhash_str_verify() function can still verify Argon2i hashes without any changes,
    and pwhash() can still compute Argon2i hashes as well.
  * The aes128ctr primitive was removed. It was slow, non-standard, not authenticated,
    and didn't seem to be used by any opensource project.
  * Argon2id required at least 3 passes like Argon2i, despite a minimum of 1
    as defined by the OPSLIMIT_MIN constant. This has been fixed.
  * The secretstream construction was slightly changed to be consistent with forthcoming variants.
  * The Javascript and Webassembly versions have been merged, and the module now returns
    a .ready promise that will resolve after the Webassembly code is loaded and compiled.
  * Note that due to these incompatible changes, the library version major was bumped up.</changelog>
  <changelog author="idonmez@suse.com" date="1513166400">- Update to 1.0.16
  * Signatures computations and verifications are now way faster
    on 64-bit platforms with compilers supporting 128-bit
    arithmetic (gcc, clang, icc). This includes the WebAssembly
    target.
  * New low-level APIs for computations over edwards25519:
    crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(),
    crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(),
    crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform()
    (elligator representative to point).
  * crypto_sign_open(), crypto_sign_verify_detached() and
    crypto_sign_edwards25519sha512batch_open` now reject public
    keys in non-canonical form in addition to low-order points.
  * The library can be built with ED25519_NONDETERMINISTIC defined
    in order to use synthetic nonces for EdDSA. This is disabled
    by default.
  * sodium_stackzero() was added to wipe content off the stack.
  * The Salsa20-based PRNG example is now thread-safe on platforms
    with support for thread-local storage, optionally mixes bits
    from RDRAND.
  * Argon2 and scrypt are slightly faster on Linux.</changelog>
  <changelog author="adam.majer@suse.de" date="1514548800">- Enable verbose make output when building tests</changelog>
  <changelog author="mpluskal@suse.com" date="1531396800">- Add gpg signature
- Modernise spec file with spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1531483200">- Add baselibs.conf: build libsodium23-32bit, which is required by
  zeromq's -32bit packages.</changelog>
  <changelog author="ecsos@opensuse.org" date="1549108800">- Update to 1.0.17
  - Bug fix: sodium_pad() didn't properly support block sizes
    &gt;= 256 bytes.
  - JS/WebAssembly: some old iOS versions can't instantiate the
    WebAssembly module; fall back to Javascript on these.
  - JS/WebAssembly: compatibility with newer Emscripten versions.
  - Bug fix: crypto_pwhash_scryptsalsa208sha256_str_verify() and
    crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't
    returnEINVAL` on input strings with a short length, unlike
    their high-level counterpart.
  - Added a workaround for Visual Studio 2010 bug causing CPU
    features not to be detected.
  - Portability improvements.
  - Test vectors from Project Wycheproof have been added.
  - New low-level APIs for arithmetic mod the order of the prime
    order group:
  - crypto_core_ed25519_scalar_random(),
    crypto_core_ed25519_scalar_reduce(),
  - crypto_core_ed25519_scalar_invert(),
    crypto_core_ed25519_scalar_negate(),
  - crypto_core_ed25519_scalar_complement(),
    crypto_core_ed25519_scalar_add() and
    crypto_core_ed25519_scalar_sub().
  - New low-level APIs for scalar multiplication without clamping:
    crypto_scalarmult_ed25519_base_noclamp() and
    crypto_scalarmult_ed25519_noclamp().
    These new APIs are especially useful for blinding.
  - sodium_sub() has been implemented.
  - Support for WatchOS has been added.
  - getrandom(2) is now used on FreeBSD 12+.
  - The nonnull attribute has been added to all relevant
    prototypes.
  - More reliable AVX512 detection.
  - Javascript/Webassembly builds now use dynamic memory growth.</changelog>
  <changelog author="ecsos@opensuse.org" date="1560686400">- Update to 1.0.18
  - Enterprise versions of Visual Studio are now supported.
  - Visual Studio 2019 is now supported.
  - 32-bit binaries for Visual Studio 2010 are now provided.
  - A test designed to trigger an OOM condition didn't work on
    Linux systems with memory overcommit turned on. It has been
    removed in order to fix Ansible builds.
  - Emscripten: print and printErr functions are overridden to send
    errors to the console, if there is one.
  - Emscripten: UTF8ToString() is now exported since
    Pointer_stringify() has been deprecated.
  - Libsodium version detection has been fixed in the CMake recipe.
  - Generic hashing got a 10% speedup on AVX2.
  - New target: WebAssembly/WASI
    (compile with dist-builds/wasm32-wasi.sh).
  - New functions to map a hash to an edwards25519 point
    or get a random point:
    core_ed25519_from_hash() and core_ed25519_random().
  - crypto_core_ed25519_scalar_mul() has been implemented for
    scalar*scalar (mod L) multiplication.
  - Support for the Ristretto group has been implemented for
    interoperability with wasm-crypto.
  - Improvements have been made to the test suite.
  - Portability improvements have been made.
  - getentropy() is now used on systems providing this system call.
  - randombytes_salsa20 has been renamed to randombytes_internal.
  - Support for NativeClient has been removed.
  - Most ((nonnull)) attributes have been relaxed to allow 0-length
    inputs to be NULL.
  - The -ftree-vectorize and -ftree-slp-vectorize compiler switches
    are now used, if available, for optimized builds.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1565956800">-  Add libsodium_configure_cpuid_chg.patch and call autoconf
  to regenerate configure script with proper CPUID checking.
  Required at least for PowerPC and ARM now that LTO enabled.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1566820800">-  Revert previous change about cpuid as previous change rejected
  in https://build.opensuse.org/request/show/724809
-  Disable LTO as bypass boo#1148184</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1658404800">- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)</changelog>
</package>
<package pkgid="8e7474a7c41f9ddfec91e3302c1c6bce53619d1a13054941f29682501f35061e" name="libsodium23" arch="x86_64">
  <version epoch="0" ver="1.0.18" rel="150000.4.6.1"/>
  <changelog author="idonmez@suse.com" date="1445428800">- Now that gcc 5.2 is available on TW, remove the ARMv7 workaround.</changelog>
  <changelog author="idonmez@suse.com" date="1446465600">- Update to 1.0.6
  * Optimized implementations of Blake2 have been added for modern
    Intel platforms. crypto_generichash() is now faster than MD5 and
    SHA1 implementations while being far more secure.
  * The crypto_sign_edwards25519sha512batch_*() functions have been
    tagged as deprecated.
  * sodium_compare() now works as documented, and compares numbers
    in little-endian format instead of behaving like memcmp().
  * sodium_runtime_has_ssse3() and sodium_runtime_has_sse41() have
    been added.</changelog>
  <changelog author="idonmez@suse.com" date="1448971200">- Follow upstream's lead and compile with -flto for &gt; 13.2 on x86
  and x86-64.</changelog>
  <changelog author="idonmez@suse.com" date="1449576000">- Update to version 1.0.7
  * Sandy2x, the fastest Curve25519 implementation ever,
    has been merged in, and is automatically used on CPUs
    supporting the AVX instructions set.
  * An SSE2 optimized implementation of Poly1305 was added,
    and is twice as fast as the portable one.
  * An SSSE3 optimized implementation of ChaCha20 was added,
    and is twice as fast as the portable one.
  * Faster sodium_increment() for common nonce sizes.
  * New helper functions have been added: sodium_is_zero()
    and sodium_add().</changelog>
  <changelog author="idonmez@suse.com" date="1451044800">- Update to version 1.0.8
  * Handle the case where the CPU supports AVX, but we are running
    on an hypervisor with AVX disabled/not supported.
  * Faster (2x) scalarmult_base() when using the ref10 implementation.</changelog>
  <changelog author="idonmez@suse.com" date="1459598400">- Update to version 1.0.9
  * A detached API was added to the ChaCha20-Poly1305 and AES256-GCM
    implementations.
  * The Argon2i password hashing function was added, and is accessible
    directly and through a new, high-level crypto_pwhash API.
    The scrypt function remains available as well.
  * A speed-record AVX2 implementation of BLAKE2b was added.
  * Countermeasures for Ed25519 signatures malleability have been
    added to match the irtf-cfrg-eddsa draft.
  * The HChaCha20 core function was implemented (crypto_core_hchacha20()).
  * No-op stubs were added for all AES256-GCM public functions even
    when compiled on non-Intel platforms.
  * crypt_generichash_blake2b_statebytes() was added.
  * New macros were added for the IETF variant of the ChaCha20-Poly1305
    construction.</changelog>
  <changelog author="idonmez@suse.com" date="1459857600">- Update to version 1.0.10
  * Compile fix update for older GCCs</changelog>
  <changelog author="i@marguerite.su" date="1470484800">- update version 1.0.11
  * sodium_init() is now thread-safe, and can be safely called
    multiple times.
  * Better support for old gcc versions.
  * AVX2 detection was fixed, resulting in faster BLAKE2b hashing
    on platforms where it was not properly detected.
  * The Sandy2x Curve25519 implementation was not as fast as
    expected on some platforms. This has been fixed.
  * The NativeClient target was improved. Most notably, it now
    supports optimized implementations, and uses pepper_49 by default.
  * The library can be compiled with recent Emscripten versions.
    Changes have been made to produce smaller code, and the default
    heap size was reduced in the standard version.
  * Decryption functions can now accept a NULL pointer for the output.
    This checks the MAC without writing the decrypted message.
  * crypto_generichash_final() now returns -1 if called twice.</changelog>
  <changelog author="idonmez@suse.com" date="1489406400">- Update to version 1.0.12
  * Ed25519ph was implemented, adding a multi-part signature API
    (crypto_sign_init(), crypto_sign_update(), crypto_sign_final_*()).
  * New constants and related accessors have been added for Scrypt
    and Argon2.
  * XChaCha20 has been implemented. Like XSalsa20, this construction
    extends the ChaCha20 cipher to accept a 192-bit nonce. This
    makes it safe to use ChaCha20 with random nonces.
  * crypto_secretbox, crypto_box and crypto_aead now offer variants
    leveraging XChaCha20.
  * SHA-2 is about 20% faster, which also gives a speed boost to
    signature and signature verification.
  * AVX2 implementations of Salsa20 and ChaCha20 have been added.
    They are twice as fast as the SSE2 implementations. The speed
    gain is even more significant on Windows, that previously
    didn't use vectorized implementations.
  * New high-level API: crypto_kdf, to easily derive one or more
    subkeys from a master key.
  * Siphash with a 128-bit output has been implemented, and is
    available as crypto_shorthash_siphashx_*.
  * New *_keygen() helpers functions have been added to create
    secret keys for all constructions. This improves code clarity
    and can prevent keys from being partially initialized.
  * A new randombytes_buf_deterministic() function was added to
    deterministically fill a memory region with pseudorandom data.
    This function can especially be useful to write reproducible tests.
  * A preliminary crypto_kx_*() API was added to compute shared
    session keys.
  * AVX2 detection is more reliable.</changelog>
  <changelog author="idonmez@suse.com" date="1506600000">- Update to version 1.0.14
  * Internal consistency checks failing and primitives used with
    dangerous/out-of-bounds/invalid parameters used to call abort(3).
    Now, a custom handler that doesn't return can be set with the
    set_sodium_misuse() function. It still aborts by default or if
    the handler ever returns. This is not a replacement for non-fatal,
    expected runtime errors. This handler will be only called in
    unexpected situations due to potential bugs in the library or in
    language bindings.
  * *_MESSAGEBYTES_MAX macros (and the corresponding _messagebytes_max()
    symbols) have been added to represent the maximum message size that
    can be safely handled by a primitive. Language bindings are
    encouraged to check user inputs against these maximum lengths.
  * The test suite has been extended to cover more edge cases.
  * crypto_sign_ed25519_pk_to_curve25519() now rejects points that
    are not on the curve, or not in the main subgroup.
  * Further changes have been made to ensure that smart compilers
    will not optimize out code that we don't want to be optimized.
  * The sodium_runtime_has_* symbols for CPU features detection are
    now defined as weak symbols, i.e. they can be replaced with an
    application-defined implementation. This can be useful to
    disable AVX* when temperature/power consumption is a concern.
  * crypto_kx_*() now aborts if called with no non-NULL pointers
    to store keys to.
  * SSE2 implementations of crypto_verify_*() have been added.
  * Passwords can be hashed using a specific algorithm with the new
    crypto_pwhash_str_alg() function.
  * Due to popular demand, base64 encoding (sodium_bin2base64())
    and decoding (sodium_base642bin()) have been implemented.
  * A new crypto_secretstream_*() API was added to safely encrypt
    files and multi-part messages.
  * The sodium_pad() and sodium_unpad() helper functions have been
    added in order to add &amp; remove padding.
  * An AVX512 optimized implementation of Argon2 has been added.
  * The crypto_pwhash_str_needs_rehash() function was added to check
    if a password hash string matches the given parameters, or if it
    needs an update.
  Updates from 1.0.13
  * An AVX2 optimized implementation of the Argon2 round function was added.
  * The Argon2id variant of Argon2 has been implemented. The high-level
    crypto_pwhash_str_verify() function automatically detects the
    algorithm and can verify both Argon2i and Argon2id hashed passwords.
    The default algorithm for newly hashed passwords remains Argon2i
    in this version to avoid breaking compatibility with verifiers
    running libsodium &lt;= 1.0.12.
  * A crypto_box_curve25519xchacha20poly1305_seal*() function set was implemented.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1507464000">- Refresh spec-file.
- Update to 1.0.15.
  * Release notes: https://github.com/jedisct1/libsodium/releases/tag/1.0.15
  * The default password hashing algorithm is now Argon2id.
  * The pwhash_str_verify() function can still verify Argon2i hashes without any changes,
    and pwhash() can still compute Argon2i hashes as well.
  * The aes128ctr primitive was removed. It was slow, non-standard, not authenticated,
    and didn't seem to be used by any opensource project.
  * Argon2id required at least 3 passes like Argon2i, despite a minimum of 1
    as defined by the OPSLIMIT_MIN constant. This has been fixed.
  * The secretstream construction was slightly changed to be consistent with forthcoming variants.
  * The Javascript and Webassembly versions have been merged, and the module now returns
    a .ready promise that will resolve after the Webassembly code is loaded and compiled.
  * Note that due to these incompatible changes, the library version major was bumped up.</changelog>
  <changelog author="idonmez@suse.com" date="1513166400">- Update to 1.0.16
  * Signatures computations and verifications are now way faster
    on 64-bit platforms with compilers supporting 128-bit
    arithmetic (gcc, clang, icc). This includes the WebAssembly
    target.
  * New low-level APIs for computations over edwards25519:
    crypto_scalarmult_ed25519(), crypto_scalarmult_ed25519_base(),
    crypto_core_ed25519_is_valid_point(), crypto_core_ed25519_add(),
    crypto_core_ed25519_sub() and crypto_core_ed25519_from_uniform()
    (elligator representative to point).
  * crypto_sign_open(), crypto_sign_verify_detached() and
    crypto_sign_edwards25519sha512batch_open` now reject public
    keys in non-canonical form in addition to low-order points.
  * The library can be built with ED25519_NONDETERMINISTIC defined
    in order to use synthetic nonces for EdDSA. This is disabled
    by default.
  * sodium_stackzero() was added to wipe content off the stack.
  * The Salsa20-based PRNG example is now thread-safe on platforms
    with support for thread-local storage, optionally mixes bits
    from RDRAND.
  * Argon2 and scrypt are slightly faster on Linux.</changelog>
  <changelog author="adam.majer@suse.de" date="1514548800">- Enable verbose make output when building tests</changelog>
  <changelog author="mpluskal@suse.com" date="1531396800">- Add gpg signature
- Modernise spec file with spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1531483200">- Add baselibs.conf: build libsodium23-32bit, which is required by
  zeromq's -32bit packages.</changelog>
  <changelog author="ecsos@opensuse.org" date="1549108800">- Update to 1.0.17
  - Bug fix: sodium_pad() didn't properly support block sizes
    &gt;= 256 bytes.
  - JS/WebAssembly: some old iOS versions can't instantiate the
    WebAssembly module; fall back to Javascript on these.
  - JS/WebAssembly: compatibility with newer Emscripten versions.
  - Bug fix: crypto_pwhash_scryptsalsa208sha256_str_verify() and
    crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't
    returnEINVAL` on input strings with a short length, unlike
    their high-level counterpart.
  - Added a workaround for Visual Studio 2010 bug causing CPU
    features not to be detected.
  - Portability improvements.
  - Test vectors from Project Wycheproof have been added.
  - New low-level APIs for arithmetic mod the order of the prime
    order group:
  - crypto_core_ed25519_scalar_random(),
    crypto_core_ed25519_scalar_reduce(),
  - crypto_core_ed25519_scalar_invert(),
    crypto_core_ed25519_scalar_negate(),
  - crypto_core_ed25519_scalar_complement(),
    crypto_core_ed25519_scalar_add() and
    crypto_core_ed25519_scalar_sub().
  - New low-level APIs for scalar multiplication without clamping:
    crypto_scalarmult_ed25519_base_noclamp() and
    crypto_scalarmult_ed25519_noclamp().
    These new APIs are especially useful for blinding.
  - sodium_sub() has been implemented.
  - Support for WatchOS has been added.
  - getrandom(2) is now used on FreeBSD 12+.
  - The nonnull attribute has been added to all relevant
    prototypes.
  - More reliable AVX512 detection.
  - Javascript/Webassembly builds now use dynamic memory growth.</changelog>
  <changelog author="ecsos@opensuse.org" date="1560686400">- Update to 1.0.18
  - Enterprise versions of Visual Studio are now supported.
  - Visual Studio 2019 is now supported.
  - 32-bit binaries for Visual Studio 2010 are now provided.
  - A test designed to trigger an OOM condition didn't work on
    Linux systems with memory overcommit turned on. It has been
    removed in order to fix Ansible builds.
  - Emscripten: print and printErr functions are overridden to send
    errors to the console, if there is one.
  - Emscripten: UTF8ToString() is now exported since
    Pointer_stringify() has been deprecated.
  - Libsodium version detection has been fixed in the CMake recipe.
  - Generic hashing got a 10% speedup on AVX2.
  - New target: WebAssembly/WASI
    (compile with dist-builds/wasm32-wasi.sh).
  - New functions to map a hash to an edwards25519 point
    or get a random point:
    core_ed25519_from_hash() and core_ed25519_random().
  - crypto_core_ed25519_scalar_mul() has been implemented for
    scalar*scalar (mod L) multiplication.
  - Support for the Ristretto group has been implemented for
    interoperability with wasm-crypto.
  - Improvements have been made to the test suite.
  - Portability improvements have been made.
  - getentropy() is now used on systems providing this system call.
  - randombytes_salsa20 has been renamed to randombytes_internal.
  - Support for NativeClient has been removed.
  - Most ((nonnull)) attributes have been relaxed to allow 0-length
    inputs to be NULL.
  - The -ftree-vectorize and -ftree-slp-vectorize compiler switches
    are now used, if available, for optimized builds.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1565956800">-  Add libsodium_configure_cpuid_chg.patch and call autoconf
  to regenerate configure script with proper CPUID checking.
  Required at least for PowerPC and ARM now that LTO enabled.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1566820800">-  Revert previous change about cpuid as previous change rejected
  in https://build.opensuse.org/request/show/724809
-  Disable LTO as bypass boo#1148184</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1658404800">- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)</changelog>
</package>
<package pkgid="6e6ce012590d071b34547ec8fb9978d087fc01d09f3b948be7bc50df4bf66a51" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="2ceddc1d734cd0ff8dbbfc518e41d028695ac317f099d5788ab822dc04d4c303" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="1ac2c8f6386d8f24006e3ed6ba947268dc36da70d201a4d89d6a071b7bd2dcf3" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="3373240f76063ad8849c4bed7bf3d5b880658f80550c04be0584130e81c17ba1" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="eade3da6753b5f68182e91a0f2bbfef59f66c53c61e4c8437dc63e54952c4a51" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="fd1d3dd9f55127ff7e7e414a9db18da80448a53abcd1712afc322260d9294baf" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="92454a63c9b238bb7a043f0254795715691334ee1ff60f3b929fbebbca73d16e" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="017942ec104115060528ad5b290a035782490e9dbd880e2cf0d14a2a4962bc2b" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="a0f44afe2be3573de1fed88fbd06bfc5c49d56de722e39218c6991978b93bc73" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="2a29bcbb41a3ed9ec5da433e2b97a036303ef9ed8f30766d41cff789a0496b90" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="a933a2ff902feed849c4f2542049945b5f8b68c94847f5707337d327de82b9f1" name="libsoftokn3" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="e44282069de567328626e321a658f1c2a37e5a360826fb89fe06d20b464582a5" name="libsoftokn3" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="165f651bc162815f62cfdb5334f2f5a3795cd1cfb4a8faecd9612eba545ff83e" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="1941a3b04e5f860722898105547749c74713e8ea889ff85cbd0d3d24ce5b712b" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="e1c6bfa421ffcf5b35d1d2be49bf451e459d1f6b197d809d57921139dbef374a" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="09e9300c430c734f622daea238d8dea61ad5caf42f04d722ee455acb5a3a85b3" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="689dc37ebe3a3a9a83efab15a116cf4d9eede033f9051fb80f46b00ddb86eacd" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="576161bb0172846e881968f6f0fcb5b3a830665b13328d91440e231af6bbd2e7" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="2a82cc0497a286abe163dcc6901c170a15688f2afc2851f3d7be461840c6add6" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="b6f2afb9ca1bb05ad90919e25cf779c1f9f5f085b753a60c630491c3a6abcd64" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="cc77bfa3f2cca21c6e98234f859d047496d1ef11760c3928d91d3261cbbc4cca" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="7c21e496a09f5e4c9497fbdccd585f69eb7951620facd31105b76e3e8eba625e" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="2ad6b77c36fb3e820a885e6efe6298860d95362d05ee8f723ebc966c807d3743" name="libsoftokn3-hmac" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="1fad3e21c0f09c4df059f2db6168e6b92b7a7fb096c8f3e43a5df23c3f08b43c" name="libsoftokn3-hmac" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="6fcd43a346d4845b2067c6db49feb1421fd5dfa174b3ba67b7a5292c7bf21279" name="libsolv" arch="src">
  <version epoch="0" ver="0.7.22" rel="150200.12.1"/>
  <changelog author="mls@suse.de" date="1574337600">- support conda constrains dependencies
- bump version to 0.7.9</changelog>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
</package>
<package pkgid="23fd1ef571609fa816fafa08c1190ff21c357ad27a7599a5450bb3677d8b9245" name="libsolv-tools" arch="aarch64">
  <version epoch="0" ver="0.7.22" rel="150200.12.1"/>
  <changelog author="mls@suse.de" date="1574337600">- support conda constrains dependencies
- bump version to 0.7.9</changelog>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
</package>
<package pkgid="957d2b25602712806532d78591dcb922725936e7b78f1a805fd419d547a01923" name="libsolv-tools" arch="x86_64">
  <version epoch="0" ver="0.7.22" rel="150200.12.1"/>
  <changelog author="mls@suse.de" date="1574337600">- support conda constrains dependencies
- bump version to 0.7.9</changelog>
  <changelog author="mls@suse.de" date="1575979200">- added two new function to make libzypp independent of the rpm
  database format
- bump version to 0.7.10</changelog>
  <changelog author="mls@suse.de" date="1575979201">- build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
  multiple rpm database backends</changelog>
  <changelog author="mls@suse.de" date="1576756800">- fix solv_zchunk decoding error if large chunks are used
  [bnc#1159314]</changelog>
  <changelog author="mls@suse.de" date="1579694400">- fixed solv_zchunk decoding error if large chunks are used
- treat retracted pathes as irrelevant
- made add_update_target work with multiversion installs
- bump version to 0.7.11</changelog>
  <changelog author="mls@suse.de" date="1587384000">- fix ruleinfo of complex dependencies returning the wrong origin
- bump version to 0.7.12</changelog>
  <changelog author="mls@suse.de" date="1587729600">- Fix solvable swapping messing up idarrays
- bump version to 0.7.13</changelog>
  <changelog author="mls@suse.de" date="1590580800">- Support blacklisted packages in solver_findproblemrule()
  [bnc#1172135]
- Support rules with multiple negative literals in choice rule
  generation
- bump version to 0.7.14</changelog>
  <changelog author="mls@suse.de" date="1590667200">- Enable zstd compression support for sle15-sp2</changelog>
  <changelog author="ma@suse.de" date="1592913600">- Enable zstd compression support for sle15</changelog>
  <changelog author="mls@suse.de" date="1599825600">- fix deduceq2addedmap clearing bits outside of the map
- conda: feature depriorization first
- conda: fix startswith implementation
- move find_update_seeds() call in cleandeps calculation
- set SOLVABLE_BUILDHOST in rpm and rpmmd parsers
- new testcase_mangle_repo_names() function
- new solv_fmemopen() function
- bump version to 0.7.15</changelog>
  <changelog author="mls@suse.de" date="1601899200">- make testcase_mangle_repo_names deal correctly with freed repos
  [bnc#1177238]</changelog>
  <changelog author="mls@suse.de" date="1603195200">- do not ask the namespace callback for splitprovides when writing
  a testcase
- fix add_complex_recommends() selecting conflicted packages in
  rare cases leading to crashes
- improve choicerule generation so that package updates are
  prefered in more cases
- bump version to 0.7.16</changelog>
  <changelog author="mls@suse.de" date="1611057600">- repo_write: fix handling of nested flexarray
- improve choicerule generation a bit more to cover more cases
- harden testcase parser against repos being added too late
- support python-3.10
- check %_dbpath macro in rpmdb code
- handle default/visible/langonly attributes in comps parser
- support multiple collections in updateinfo parser
- add '-D' option in rpmdb2solv to set the dbpath
- bump version to 0.7.17</changelog>
  <changelog author="mls@suse.de" date="1616760000">- fixed regex code on win32
- fixed memory leak in choice rule generation
- repo_add_conda: add flag to skip v2 packages
- bump version to 0.7.18</changelog>
  <changelog author="mls@suse.de" date="1617796800">- fix rare segfault in resolve_jobrules() that could happen
  if new rules are learnt
- fix a couple of memory leaks in error cases
- fix error handling in solv_xfopen_fd()
- bump version to 0.7.19</changelog>
  <changelog author="dimstar@opensuse.org" date="1627646400">- Disable python2 usage on suse_version &gt;= 1550 by default (still
  possible to use osc build --with=python).</changelog>
  <changelog author="mls@suse.de" date="1632571200">- fix misparsing of '&amp;' in attributes with libxml2
- choice rules: treat orphaned packages as newest [bsc#1190465]
- fix compatibility with Python 3.10
- new SOLVER_EXCLUDEFROMWEAK job type
- support for environments in comps parser
- bump version to 0.7.20</changelog>
  <changelog author="mls@suse.de" date="1645790400">- fix segfault on conflict resolution when using bindings
- fix split provides not working if the update includes a forbidden
  vendor change
- support strict repository priorities
  new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
- support zstd compressed control files in debian packages
- add an ifdef allowing to rename Solvable dependency members
  ("requires" is a keyword in C++20)
- support setting/reading userdata in solv files
  new functions: repowriter_set_userdata, solv_read_userdata
- support queying of the custom vendor check function
  new function: pool_get_custom_vendorcheck
- support solv files with an idarray block
- allow accessing the toolversion at runtime
- bump version to 0.7.21</changelog>
  <changelog author="mls@suse.de" date="1647864000">- reworked choice rule generation to cover more usecases
- support SOLVABLE_PREREQ_IGNOREINST in the ordering code
  [bsc#1196514]
- support parsing of Debian's Multi-Arch indicator
- bump version to 0.7.22</changelog>
</package>
<package pkgid="58bf35aee45e3256e6f331538de03273a264511d7efe10fe289c884a665f2df6" name="libspice-server1" arch="aarch64">
  <version epoch="0" ver="0.14.3" rel="150300.3.3.1"/>
  <changelog author="astieger@suse.com" date="1482408000">- restrict suppression of obsoletes-not-provided warning to
  spice-client bsc#1013916</changelog>
  <changelog author="cbosdonnat@suse.com" date="1486036800">- Synchronize with SLES (fate#322402):
  + bnc#894069: disable smartcard support for SLES
  + merge changelog</changelog>
  <changelog author="psimons@suse.com" date="1486036801">- Added patches to fix two security vulnerabilities.
  * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch
    [CVE-2016-9577, bsc#1023078]
  * CVE-2016-9578-remote-dos-via-crafted-message.patch
    [CVE-2016-9578, bsc#1023079]</changelog>
  <changelog author="cbosdonnat@suse.com" date="1509019200">- Release 0.14.0
  * fix client mouse with virgl
  * fix frozen display after seamless migration
  * set human-readable name on spice threads
  * add sanity-checks for ORC library as it can abort spice-server
    when selinux is in use
  * Close TCP connection early when client did not send the correct
    SPICE magic bytes: this allows VNC clients to gracefully fail
    when connecting to a SPICE port
  * Add VP9 encoding support when GStreamer is being used and misc
    streaming/encoding improvements
  * Improvements to replay utility
  * Limit (deprecated/unusud) QXLMessage size to 100,000 characters
    for improved safety
  * Improve image quality in low bitrate situation when using the
    GStreamer backend
  * Added GStreamer support to the video streaming code
  * Fix old migration bug causing migration to never end in some cases
  * Added lz4 compression to the spicevmc channel
  * Ongoing code cleanups
  * add spice_qxl_gl_scanout() spice_qxl_gl_draw_async() for local
    virgl support
  * spice_server_set_keepalive_timeout() has been removed in favour of
    unconditionally sending keepalive probes every 10 minutes
  * Added public spice_server_set_keepalive_timeout() to make it possible
    to tweak keepalive on all SPICE connection. This can prevent unwanted
    idle disconnections if proxies are used between the client and the host.
  * Fix important memory usage when the webdav channel is used
  * Do not disconnect when the client requests an unsupported compression type
  * Fix potential race condition when using multiple QXL devices
  * Fix display glitch when using XSpice
  * Improve help string for 'replay -s'
  * Fix small leak in MJPEG code
- Removed patches:
  * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch
  * CVE-2016-9578-remote-dos-via-crafted-message.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Enable smartcards on sle15 as the supportlib is available
  * Condition it using name everywhere instead of suse versions
    and join together with lz4
- Format with spec-cleaner
- Convert dependencies to pkgconfig style
- Install documentation and license file
- Add configure arguments to most of the options to not rely on
  autotools automatic behavior
  * Also enable gstreamer and lz4 options
- Drop the not needed python dependencies, they are needed only
  when building from git snapshot</changelog>
  <changelog author="tchvatal@suse.com" date="1517313600">- Split the sle condition again for exact features to allow their
  override</changelog>
  <changelog author="jengelh@inai.de" date="1517313601">- Correct RPM group for shared library.</changelog>
  <changelog author="cbosdonnat@suse.com" date="1531742400">- Avoid buffer overflow on image lz cheks (CVE-2018-10893, bsc#1101295)
  Added patches:
    0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch
    0002-lz-More-checks-on-image-sizes.patch</changelog>
  <changelog author="cbosdonnat@suse.com" date="1534766400">- Fix potential heap corruption when demarshalling (CVE-2018-10873,
  bsc#1104448)
  Added patch:
    bb15d481-Fix-flexible-array-buffer-overflow.patch</changelog>
  <changelog author="brogers@suse.com" date="1537358400">- Update to v0.14.1 stable release
  The announcement email describes this release as follows:
  The main change in this release is the addition of a new protocol
  extension in order to support streaming the remote display as a
  video stream rather than going through the QXL protocol. Together
  with spice-streaming-agent, and/or with more work on the qemu/
  spice-server side, this should allow streaming of 3D accelerated
  VMs in the future. At this point, this part of spice-server is
  still a work in progress (multi-monitor support and various
  features are missing).
  * avoid performance issues on Windows 10 KVM guests (boo#1109044)
  * add new org.spice-space.stream.0 channel used for passing an
    encoded video stream from the guest to the client
  * add support for TCP_CORK to reduce the amount of packets that
    we send
  * fix CVE-2018-10873 (maintainer note: we already carried fix)
  * fix cursor related migration crash
  * fix regression causing sound recording to be muted after client
    disconnection/reconnection (introduced in 0.13.90)
  * fix regression in corner cases where images could be sent
    uncompressed when they used to be compressed with QUIC
  * disable TLS 1.0 support
  * CELT 0.5.1 support is now disabled by default. If celt051-devel
    is installed at build-time, --enable-celt051/--disable-celt051
    must be explicitly specified
  * drop support for unsupported OpenSSL version. OpenSSL 1.0.0 or
    newer is now required
  * bumped minimum required glib version to 2.32
  * endianness fixes
  * (small) leak fixes
  * usual round of code cleanups
  * not directly related to this release, but the upstream git
    repository is now hosted on gitlab.freedesktop.org
- Removed patches:
    bb15d481-Fix-flexible-array-buffer-overflow.patch</changelog>
  <changelog author="astieger@suse.com" date="1537358401">- Upstream disabled support for the celt051 audio codec by default,
  do likewise in the spec
- Note updated 0.14.1 build dependencies in the spec:
  * OpenSSL 1.0.0 or newer is now required
  * glib 2.32 required
- add upstream signing key and verify source signature</changelog>
  <changelog author="brogers@suse.com" date="1548676800">- Fix OOB memory access in internal tracking of slot_ids and
  group_ids. (CVE-2019-3813 bsc#1122706)
  * 0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch
- Remove celt051 Requires directive</changelog>
  <changelog author="olaf@aepfle.de" date="1551441600">- Use plain python2 for SLE12 builds
- Remove PYTHON=python3, configure will find and use the python3</changelog>
  <changelog author="brogers@suse.com" date="1558008000">- Update to v0.14.2 stable release
  The main changes are support for Meson build and graphic device
  info messages allowing to better support multi-monitor
  configurations.
  * support H265 in stream-channel
  * add support for building with meson/ninja
  * minor tests fixes improving CI
  * set char device state for smartcard, allowing Qemu optimization
  * improve red-parse-qxl.c interface making it more consistent
  * add some instrumentation for streaming device
  * QXL interface: add a function to identify monitors in the guest
    (spice_qxl_set_device_info)
  * add support for GraphicsDeviceInfo messages
  * video-stream: prevent crash on stream reattach
  * make channel client callbacks virtual functions
  * bumped minimum required glib version to 2.38
  * attempt to have a reliable led state for keyboard modifiers
- Removed patches:
  (The first two are altered versions of what is carried upstream.
  I think we're fine with what upstream does here)
  0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch
  0002-lz-More-checks-on-image-sizes.patch
  0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch</changelog>
  <changelog author="9+suse@cirno.systems" date="1578657600">- Enable video codec support (VPX and MJPEG)</changelog>
  <changelog author="brogers@suse.com" date="1582891200">- Update to v0.14.3 release
  The main changes are WebSocket and support for Windows.
  * Add support for WebSocket, this will allow to use spice-html5
    without proxy
  * Support Windows, now Qemu Windows can be build enabling Spice
  * Fix some alignment problem
  * Converted some documentation to Asciidoc format to make easier
    to update, updated some
  * Minor compatibility fix for PPC64EL and ARMHF
  * Minor fixes for big endian machines like MIPS
  * Avoid some crashes with some buggy guest drivers, simply
    ignore the invalid request
  * Fix for old OpenSSL versions
  * Minor fix for Windows clients and brushes, fixed an issue with
    Photoshop under Windows 7
  * Add ability to query video-codecs
  * Small use-after-free fix
  * Fix for debugging recording/replaying using QUIC images
  * Fix a regression where spice reported no monitors to the client
  * Fix DoS in spicevmc if WebDAV used
  * Updated and improved test migration script
  * Some minor fixes to smartcard support
  * Avoid possible disconnection using proxies using a in-flow
    keepalive mechanism
- The NEWS file is now named CHANGELOG.md, and the previously
  provided ChangeLog, which was a summary of the git log is no
  longer provided</changelog>
  <changelog author="brogers@suse.com" date="1583755200">- Clean up some spec file conditionals that are no longer helpful</changelog>
  <changelog author="brogers@suse.com" date="1601899200">- Fix buffer overflow vunerabilities in QUIC image decoding
  (CVE-2020-14355 bsc#1177158)
  0001-quic-Check-we-have-some-data-to-start-decoding-quic-.patch
  0002-quic-Check-image-size-in-quic_decode_begin.patch
  0003-quic-Check-RLE-lengths.patch
  0004-quic-Avoid-possible-buffer-overflow-in-find_bucket.patch</changelog>
  <changelog author="brogers@suse.com" date="1602244800">- Note: The Mar 9, 2020 spec file cleanup and the following change
  satisfy jsc#SLE-15520
- Remove gstreamer-plugins-libav and gstreamer-plugins-good as
  BuildRequires. Even though the configure step of the package
  build does report detection of features from these packages, the
  build is actually not otherwise influenced by the presence of
  these packages. It is at runtime when these plugin packages are
  utilized, so leave the Recommends for these in the package spec,
  so that if the packages are available in a distro they can get
  installed and utilized.</changelog>
  <changelog author="carnold@suse.com" date="1622116800">- bsc#1181686 - VUL-0: CVE-2021-20201: spice,spice-gtk: client
  initiated renegotiation denial of service
  0001-With-OpenSSL-1.1-Disable-client-initiated-renegotiation.patch
  0002-With-OpenSSL-1.0.2-and-earlier-disable-client-side-renegotiation.patch</changelog>
</package>
<package pkgid="0042bb1c747fc223119ddd5cf92496d877ac61b39d4cbf37ec239f2d58a78ff8" name="libspice-server1" arch="x86_64">
  <version epoch="0" ver="0.14.3" rel="150300.3.3.1"/>
  <changelog author="astieger@suse.com" date="1482408000">- restrict suppression of obsoletes-not-provided warning to
  spice-client bsc#1013916</changelog>
  <changelog author="cbosdonnat@suse.com" date="1486036800">- Synchronize with SLES (fate#322402):
  + bnc#894069: disable smartcard support for SLES
  + merge changelog</changelog>
  <changelog author="psimons@suse.com" date="1486036801">- Added patches to fix two security vulnerabilities.
  * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch
    [CVE-2016-9577, bsc#1023078]
  * CVE-2016-9578-remote-dos-via-crafted-message.patch
    [CVE-2016-9578, bsc#1023079]</changelog>
  <changelog author="cbosdonnat@suse.com" date="1509019200">- Release 0.14.0
  * fix client mouse with virgl
  * fix frozen display after seamless migration
  * set human-readable name on spice threads
  * add sanity-checks for ORC library as it can abort spice-server
    when selinux is in use
  * Close TCP connection early when client did not send the correct
    SPICE magic bytes: this allows VNC clients to gracefully fail
    when connecting to a SPICE port
  * Add VP9 encoding support when GStreamer is being used and misc
    streaming/encoding improvements
  * Improvements to replay utility
  * Limit (deprecated/unusud) QXLMessage size to 100,000 characters
    for improved safety
  * Improve image quality in low bitrate situation when using the
    GStreamer backend
  * Added GStreamer support to the video streaming code
  * Fix old migration bug causing migration to never end in some cases
  * Added lz4 compression to the spicevmc channel
  * Ongoing code cleanups
  * add spice_qxl_gl_scanout() spice_qxl_gl_draw_async() for local
    virgl support
  * spice_server_set_keepalive_timeout() has been removed in favour of
    unconditionally sending keepalive probes every 10 minutes
  * Added public spice_server_set_keepalive_timeout() to make it possible
    to tweak keepalive on all SPICE connection. This can prevent unwanted
    idle disconnections if proxies are used between the client and the host.
  * Fix important memory usage when the webdav channel is used
  * Do not disconnect when the client requests an unsupported compression type
  * Fix potential race condition when using multiple QXL devices
  * Fix display glitch when using XSpice
  * Improve help string for 'replay -s'
  * Fix small leak in MJPEG code
- Removed patches:
  * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch
  * CVE-2016-9578-remote-dos-via-crafted-message.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Enable smartcards on sle15 as the supportlib is available
  * Condition it using name everywhere instead of suse versions
    and join together with lz4
- Format with spec-cleaner
- Convert dependencies to pkgconfig style
- Install documentation and license file
- Add configure arguments to most of the options to not rely on
  autotools automatic behavior
  * Also enable gstreamer and lz4 options
- Drop the not needed python dependencies, they are needed only
  when building from git snapshot</changelog>
  <changelog author="tchvatal@suse.com" date="1517313600">- Split the sle condition again for exact features to allow their
  override</changelog>
  <changelog author="jengelh@inai.de" date="1517313601">- Correct RPM group for shared library.</changelog>
  <changelog author="cbosdonnat@suse.com" date="1531742400">- Avoid buffer overflow on image lz cheks (CVE-2018-10893, bsc#1101295)
  Added patches:
    0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch
    0002-lz-More-checks-on-image-sizes.patch</changelog>
  <changelog author="cbosdonnat@suse.com" date="1534766400">- Fix potential heap corruption when demarshalling (CVE-2018-10873,
  bsc#1104448)
  Added patch:
    bb15d481-Fix-flexible-array-buffer-overflow.patch</changelog>
  <changelog author="brogers@suse.com" date="1537358400">- Update to v0.14.1 stable release
  The announcement email describes this release as follows:
  The main change in this release is the addition of a new protocol
  extension in order to support streaming the remote display as a
  video stream rather than going through the QXL protocol. Together
  with spice-streaming-agent, and/or with more work on the qemu/
  spice-server side, this should allow streaming of 3D accelerated
  VMs in the future. At this point, this part of spice-server is
  still a work in progress (multi-monitor support and various
  features are missing).
  * avoid performance issues on Windows 10 KVM guests (boo#1109044)
  * add new org.spice-space.stream.0 channel used for passing an
    encoded video stream from the guest to the client
  * add support for TCP_CORK to reduce the amount of packets that
    we send
  * fix CVE-2018-10873 (maintainer note: we already carried fix)
  * fix cursor related migration crash
  * fix regression causing sound recording to be muted after client
    disconnection/reconnection (introduced in 0.13.90)
  * fix regression in corner cases where images could be sent
    uncompressed when they used to be compressed with QUIC
  * disable TLS 1.0 support
  * CELT 0.5.1 support is now disabled by default. If celt051-devel
    is installed at build-time, --enable-celt051/--disable-celt051
    must be explicitly specified
  * drop support for unsupported OpenSSL version. OpenSSL 1.0.0 or
    newer is now required
  * bumped minimum required glib version to 2.32
  * endianness fixes
  * (small) leak fixes
  * usual round of code cleanups
  * not directly related to this release, but the upstream git
    repository is now hosted on gitlab.freedesktop.org
- Removed patches:
    bb15d481-Fix-flexible-array-buffer-overflow.patch</changelog>
  <changelog author="astieger@suse.com" date="1537358401">- Upstream disabled support for the celt051 audio codec by default,
  do likewise in the spec
- Note updated 0.14.1 build dependencies in the spec:
  * OpenSSL 1.0.0 or newer is now required
  * glib 2.32 required
- add upstream signing key and verify source signature</changelog>
  <changelog author="brogers@suse.com" date="1548676800">- Fix OOB memory access in internal tracking of slot_ids and
  group_ids. (CVE-2019-3813 bsc#1122706)
  * 0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch
- Remove celt051 Requires directive</changelog>
  <changelog author="olaf@aepfle.de" date="1551441600">- Use plain python2 for SLE12 builds
- Remove PYTHON=python3, configure will find and use the python3</changelog>
  <changelog author="brogers@suse.com" date="1558008000">- Update to v0.14.2 stable release
  The main changes are support for Meson build and graphic device
  info messages allowing to better support multi-monitor
  configurations.
  * support H265 in stream-channel
  * add support for building with meson/ninja
  * minor tests fixes improving CI
  * set char device state for smartcard, allowing Qemu optimization
  * improve red-parse-qxl.c interface making it more consistent
  * add some instrumentation for streaming device
  * QXL interface: add a function to identify monitors in the guest
    (spice_qxl_set_device_info)
  * add support for GraphicsDeviceInfo messages
  * video-stream: prevent crash on stream reattach
  * make channel client callbacks virtual functions
  * bumped minimum required glib version to 2.38
  * attempt to have a reliable led state for keyboard modifiers
- Removed patches:
  (The first two are altered versions of what is carried upstream.
  I think we're fine with what upstream does here)
  0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch
  0002-lz-More-checks-on-image-sizes.patch
  0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch</changelog>
  <changelog author="9+suse@cirno.systems" date="1578657600">- Enable video codec support (VPX and MJPEG)</changelog>
  <changelog author="brogers@suse.com" date="1582891200">- Update to v0.14.3 release
  The main changes are WebSocket and support for Windows.
  * Add support for WebSocket, this will allow to use spice-html5
    without proxy
  * Support Windows, now Qemu Windows can be build enabling Spice
  * Fix some alignment problem
  * Converted some documentation to Asciidoc format to make easier
    to update, updated some
  * Minor compatibility fix for PPC64EL and ARMHF
  * Minor fixes for big endian machines like MIPS
  * Avoid some crashes with some buggy guest drivers, simply
    ignore the invalid request
  * Fix for old OpenSSL versions
  * Minor fix for Windows clients and brushes, fixed an issue with
    Photoshop under Windows 7
  * Add ability to query video-codecs
  * Small use-after-free fix
  * Fix for debugging recording/replaying using QUIC images
  * Fix a regression where spice reported no monitors to the client
  * Fix DoS in spicevmc if WebDAV used
  * Updated and improved test migration script
  * Some minor fixes to smartcard support
  * Avoid possible disconnection using proxies using a in-flow
    keepalive mechanism
- The NEWS file is now named CHANGELOG.md, and the previously
  provided ChangeLog, which was a summary of the git log is no
  longer provided</changelog>
  <changelog author="brogers@suse.com" date="1583755200">- Clean up some spec file conditionals that are no longer helpful</changelog>
  <changelog author="brogers@suse.com" date="1601899200">- Fix buffer overflow vunerabilities in QUIC image decoding
  (CVE-2020-14355 bsc#1177158)
  0001-quic-Check-we-have-some-data-to-start-decoding-quic-.patch
  0002-quic-Check-image-size-in-quic_decode_begin.patch
  0003-quic-Check-RLE-lengths.patch
  0004-quic-Avoid-possible-buffer-overflow-in-find_bucket.patch</changelog>
  <changelog author="brogers@suse.com" date="1602244800">- Note: The Mar 9, 2020 spec file cleanup and the following change
  satisfy jsc#SLE-15520
- Remove gstreamer-plugins-libav and gstreamer-plugins-good as
  BuildRequires. Even though the configure step of the package
  build does report detection of features from these packages, the
  build is actually not otherwise influenced by the presence of
  these packages. It is at runtime when these plugin packages are
  utilized, so leave the Recommends for these in the package spec,
  so that if the packages are available in a distro they can get
  installed and utilized.</changelog>
  <changelog author="carnold@suse.com" date="1622116800">- bsc#1181686 - VUL-0: CVE-2021-20201: spice,spice-gtk: client
  initiated renegotiation denial of service
  0001-With-OpenSSL-1.1-Disable-client-initiated-renegotiation.patch
  0002-With-OpenSSL-1.0.2-and-earlier-disable-client-side-renegotiation.patch</changelog>
</package>
<package pkgid="dda27c08ee37cbde5ba7db26ea604e813f5cfbf4b40f1d384d208529c95a9b12" name="libsqlite3-0" arch="aarch64">
  <version epoch="0" ver="3.39.3" rel="150000.3.17.1"/>
  <changelog author="astieger@suse.com" date="1517486400">- update to 3.22.0:
  * Add Zipfile virtual table to read and write a ZIP Archive.
  * Improved handling of WAL mode databases
  * various improvements, optimizations and bug fixes</changelog>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
</package>
<package pkgid="ae17e14016c27a5725d4f4f90095e95dd1d05e65e451be3c98dec1803bdd3196" name="libsqlite3-0" arch="x86_64">
  <version epoch="0" ver="3.39.3" rel="150000.3.17.1"/>
  <changelog author="astieger@suse.com" date="1517486400">- update to 3.22.0:
  * Add Zipfile virtual table to read and write a ZIP Archive.
  * Improved handling of WAL mode databases
  * various improvements, optimizations and bug fixes</changelog>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
</package>
<package pkgid="49127c76cee5a1ab716cef66765fea53e3bdf408db27da954c5ef4d073b2cc69" name="libsqlite3-0" arch="aarch64">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="080705e1063195761109850ea4f8e30bb24e92906e5c9cec76399cb898f4eb96" name="libsqlite3-0" arch="x86_64">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="b13908bb553f597b734912413f6aaf1f06f7e59a0142a648d930b4cc2083f346" name="libsss_certmap0" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="69f5c19b4b4a99c98a79feebea85ccd6132c5dc7f756e8227350de33c9bc9a11" name="libsss_certmap0" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="cea94f728c68d90b00c591498f908e77d2a1f32bf20a6c21a4a98851b64fe576" name="libsss_certmap0" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="08db0ce1d745f91a4c594b5df158478d1c3e2f9194853603e174c148af679756" name="libsss_certmap0" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="d98f1fa8bf54fdc3839435a67fd0aa0b0128f842984cb760c985701fdb0a914d" name="libsss_idmap0" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="209d007eeca91a89e3661f0f04df293b2a9bd3c50d4a19a3c1de5442d22874b8" name="libsss_idmap0" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="2f0ff26f7bdbfb1a2c8e01ecd260cb24751fec5ec51b90580d0592c4ea672446" name="libsss_idmap0" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="772bd412c9f401c2857382dde9d502e63d74ab1f2d31baa9950973504668a475" name="libsss_idmap0" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="2e1e03cd42675749bbfd0851de49a919c63c1e62f974c8ebb64e0a9c24541b33" name="libsss_nss_idmap0" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="6b3b058b50d11acb8b6365942b0c706adefdca02cffad51447d510ed444d38a4" name="libsss_nss_idmap0" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="3930a73df6baf7acdc9e3e7d9450dc6dc226a94474f10df627577f75e5382216" name="libsss_nss_idmap0" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="4c7e97e355c005c62aaee4cb4fd6daa84fafa41c44221a4414ec2e7a955a91c2" name="libsss_nss_idmap0" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="331062ff45347e9995b741044db841daeec34abbadf68513da0012c56cafa80b" name="libstdc++6" arch="aarch64">
  <version epoch="0" ver="11.3.0+git1637" rel="150000.1.11.2"/>
  <changelog author="rguenther@suse.com" date="1625832000">- Add BuildRequires on netcfg for the testsuite when testing Go.</changelog>
  <changelog author="schwab@suse.de" date="1626696000">- Remove bits/unistd_ext.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1626868800">- Properly adjust GPL-3.0 WITH GCC-exception-3.1 to
  GPL-3.0-or-later WITH GCC-exception-3.1</changelog>
  <changelog author="rguenther@suse.com" date="1626868801">- Update to gcc-11 branch head (076930b9690ac3564638636f6b), git536
  * Includes GCC 11.2 RC1.
- Refresh gcc10-foffload-default.patch</changelog>
  <changelog author="rguenther@suse.com" date="1629115200">- Update to gcc-11 branch head (056e324ce46a7924b5cf10f610), git610
  * Includes GCC 11.2 release
  * Includes fix for opie build with glibc 2.34  [boo#1188623]</changelog>
  <changelog author="schwab@suse.de" date="1629288000">- Require libgccjit%{libgccjit_sover}%{libgccjit_suffix} from
  libgccjit%{libgccjit_sover}-devel%{libdevel_suffix}.</changelog>
  <changelog author="matz@suse.com" date="1632139200">- Enable the full cross compiler, cross-aarch64-gcc11 and
  cross-riscv64-gcc11 now provide a fully hosted C (and C++)
  cross compiler, not just a freestanding one.  I.e. with a cross
  glibc.  They don't yet support the sanitizer libraries.
  Part of [jsc#OBS-124].</changelog>
  <changelog author="rguenther@suse.com" date="1634731200">- Remove spurious exit from change_spec.</changelog>
  <changelog author="rguenther@suse.com" date="1637755200">- Update to gcc-11 branch head (7510c23c1ec53aa4a62705f03), git1018
  * fixes issue with debug dumping together with -o /dev/null
  * fixes libgccjit issue showing up in emacs build  [boo#1192951]
- Package mwaitintrin.h</changelog>
  <changelog author="matz@suse.com" date="1637928000">- Enable the cross compilers also on i586
- Enable some cross compilers also in rings
- Remove cross compilers for i386 target</changelog>
  <changelog author="mliska@suse.cz" date="1639569600">- Update to gcc-11 branch head (d4a1d3c4b377f1d4acb), git1173
  * Fix D memory corruption in -M output.
  * Fix ICE in is_this_parameter with coroutines.  [boo#1193659]</changelog>
  <changelog author="schwab@suse.de" date="1642507200">- Remove sys/rseq.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1644408000">- Put libstdc++6-pp Requires on the shared library and drop
  to Recoomends.</changelog>
  <changelog author="rguenther@suse.com" date="1644494400">- Add gcc11-PIE, similar to gcc-PIE but affecting gcc11 [bsc#1195628]</changelog>
  <changelog author="rguenther@suse.com" date="1646222400">- Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
  packages provided by older GCC work.  Add a requires from that
  package to the corresponding libstc++6 package to keep those
  at the same version.  [bsc#1196107]</changelog>
  <changelog author="dmueller@suse.com" date="1646654400">- drop armv5tel, merge arm and armv6hl
- use --with-cpu rather than specifying --with-arch/--with-tune</changelog>
  <changelog author="rguenther@suse.com" date="1647432000">- Update to gcc-11 branch head (6a1150d1524aeda3381b21717), git1406
  * includes change to adjust gnats idea of the target, fixing
    the build of gprbuild.  [bsc#1196861]
- Add gcc11-pr104931.patch to fix miscompile of embedded premake
  in 0ad on i586.  [bsc#1197065]</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit.</changelog>
  <changelog author="rguenther@suse.com" date="1650456000">- Update to gcc-11 branch head (691af15031e00227ba6d5935c), git1635
  * includes gcc11-pr104931.patch
  * includes fix for Firefox ICE  [gcc#105256]</changelog>
  <changelog author="rguenther@suse.com" date="1650542400">- Update to the GCC 11.3.0 release.
  * includes SLS hardening backport on x86_64.  [bsc#1195283]</changelog>
</package>
<package pkgid="ba0a6150183d657f41faf068fb52e2e2a0655b687e7a0441b08faab732082518" name="libstdc++6" arch="x86_64">
  <version epoch="0" ver="11.3.0+git1637" rel="150000.1.11.2"/>
  <changelog author="rguenther@suse.com" date="1625832000">- Add BuildRequires on netcfg for the testsuite when testing Go.</changelog>
  <changelog author="schwab@suse.de" date="1626696000">- Remove bits/unistd_ext.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1626868800">- Properly adjust GPL-3.0 WITH GCC-exception-3.1 to
  GPL-3.0-or-later WITH GCC-exception-3.1</changelog>
  <changelog author="rguenther@suse.com" date="1626868801">- Update to gcc-11 branch head (076930b9690ac3564638636f6b), git536
  * Includes GCC 11.2 RC1.
- Refresh gcc10-foffload-default.patch</changelog>
  <changelog author="rguenther@suse.com" date="1629115200">- Update to gcc-11 branch head (056e324ce46a7924b5cf10f610), git610
  * Includes GCC 11.2 release
  * Includes fix for opie build with glibc 2.34  [boo#1188623]</changelog>
  <changelog author="schwab@suse.de" date="1629288000">- Require libgccjit%{libgccjit_sover}%{libgccjit_suffix} from
  libgccjit%{libgccjit_sover}-devel%{libdevel_suffix}.</changelog>
  <changelog author="matz@suse.com" date="1632139200">- Enable the full cross compiler, cross-aarch64-gcc11 and
  cross-riscv64-gcc11 now provide a fully hosted C (and C++)
  cross compiler, not just a freestanding one.  I.e. with a cross
  glibc.  They don't yet support the sanitizer libraries.
  Part of [jsc#OBS-124].</changelog>
  <changelog author="rguenther@suse.com" date="1634731200">- Remove spurious exit from change_spec.</changelog>
  <changelog author="rguenther@suse.com" date="1637755200">- Update to gcc-11 branch head (7510c23c1ec53aa4a62705f03), git1018
  * fixes issue with debug dumping together with -o /dev/null
  * fixes libgccjit issue showing up in emacs build  [boo#1192951]
- Package mwaitintrin.h</changelog>
  <changelog author="matz@suse.com" date="1637928000">- Enable the cross compilers also on i586
- Enable some cross compilers also in rings
- Remove cross compilers for i386 target</changelog>
  <changelog author="mliska@suse.cz" date="1639569600">- Update to gcc-11 branch head (d4a1d3c4b377f1d4acb), git1173
  * Fix D memory corruption in -M output.
  * Fix ICE in is_this_parameter with coroutines.  [boo#1193659]</changelog>
  <changelog author="schwab@suse.de" date="1642507200">- Remove sys/rseq.h from include-fixed</changelog>
  <changelog author="rguenther@suse.com" date="1644408000">- Put libstdc++6-pp Requires on the shared library and drop
  to Recoomends.</changelog>
  <changelog author="rguenther@suse.com" date="1644494400">- Add gcc11-PIE, similar to gcc-PIE but affecting gcc11 [bsc#1195628]</changelog>
  <changelog author="rguenther@suse.com" date="1646222400">- Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
  packages provided by older GCC work.  Add a requires from that
  package to the corresponding libstc++6 package to keep those
  at the same version.  [bsc#1196107]</changelog>
  <changelog author="dmueller@suse.com" date="1646654400">- drop armv5tel, merge arm and armv6hl
- use --with-cpu rather than specifying --with-arch/--with-tune</changelog>
  <changelog author="rguenther@suse.com" date="1647432000">- Update to gcc-11 branch head (6a1150d1524aeda3381b21717), git1406
  * includes change to adjust gnats idea of the target, fixing
    the build of gprbuild.  [bsc#1196861]
- Add gcc11-pr104931.patch to fix miscompile of embedded premake
  in 0ad on i586.  [bsc#1197065]</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit.</changelog>
  <changelog author="rguenther@suse.com" date="1650456000">- Update to gcc-11 branch head (691af15031e00227ba6d5935c), git1635
  * includes gcc11-pr104931.patch
  * includes fix for Firefox ICE  [gcc#105256]</changelog>
  <changelog author="rguenther@suse.com" date="1650542400">- Update to the GCC 11.3.0 release.
  * includes SLS hardening backport on x86_64.  [bsc#1195283]</changelog>
</package>
<package pkgid="18595e81cfb9405bbecc25003bb613a45f004daf3718de179b69ee6ebb86f19f" name="libstdc++6" arch="aarch64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="197c563089dffd20d5b42ea8272f3f8ee5ebcad40de443745061607ba236e355" name="libstdc++6" arch="x86_64">
  <version epoch="0" ver="12.2.1+git416" rel="150000.1.5.1"/>
  <changelog author="mliska@suse.cz" date="1648468800">- Bump to 9f37d31324f89d0b7b2abac988a976d121ae29c6, git192251.</changelog>
  <changelog author="rguenther@suse.com" date="1648814400">- Add provides/conflicts to glibc crosses since only one GCC version
  for the same target can be installed at the same time.
- Add provides/conflicts to libgccjit</changelog>
  <changelog author="mliska@suse.cz" date="1649246400">- Bump to 86242eb1bd03eba82d8e22b01b16925d43bcc539, git192423.
  Fixes aarch64 bootstrap issue (PR105144).</changelog>
  <changelog author="schwab@suse.de" date="1649246401">- On SLE15 and later, use make -Oline to synchronize configure output by
  lines</changelog>
  <changelog author="mliska@suse.cz" date="1650369600">- Bump to b85abacd902813daec5e44b97f275eb88caaf715, git192607.</changelog>
  <changelog author="rguenther@suse.com" date="1651060800">- Drop no longer necessary gcc12-d-workaround.patch</changelog>
  <changelog author="rguenther@suse.com" date="1651147200">- Bump to f27848a5dc4d3b16cd4112bddcb59e0916eba623, git192706.
- Switch ppc64le to the IEEE long double ABI by default in Factory.
- Separate ppc64le from ppc/ppc64 specific configury.
- Add _multibuild to gather all .spec files and reduce the number
  of .changes files to one, autogenerated by change_spec.
- Drop %ringdisabled handling.
- Ada bootstrap now requires at least GCC 5, use GCC 7 on SLES 12
  instead of GCC 4.8.</changelog>
  <changelog author="rguenther@suse.com" date="1651233600">- Bump to 621650f64fb6679c457c33abf27c925f28bddc62, git9
  * GCC 12.1 release candidate</changelog>
  <changelog author="rguenther@suse.com" date="1651838400">- Update to GCC 12.1 release, 1ea978e3066ac565a1ec28a96a4d61, git27</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1652184000">- Enable PRU architecture for AM335x platforms</changelog>
  <changelog author="rguenther@suse.com" date="1652788800">- Update to gcc-12 branch head, 325d82b08696da17fb26bd2e1b6b, git78</changelog>
  <changelog author="rguenther@suse.com" date="1656504000">- Update to gcc-12 branch head, 7811663964aa7e31c3939b859bb, git215
  * includes libgomp mold linker detection fix
  * includes nvptx offload compiler build fix
  * includes s390x tsan executable stack fix</changelog>
  <changelog author="rguenther@suse.com" date="1658404800">- Update to gcc-12 branch head, 4f15d2234608e82159d030dadb1, git287
  * includes build fixes when building against glibc 2.33.</changelog>
  <changelog author="rguenther@suse.com" date="1658836800">- Add Provides of libstdc++6-pp-gccN to libstdc++6-pp.  [bsc#1201848]</changelog>
  <changelog author="mliska@suse.cz" date="1659960000">- Remove workaround for obs-service-format_spec_file.</changelog>
  <changelog author="rguenther@suse.com" date="1660305600">- Update to gcc-12 branch head, 6b7d570a5001bb79e34c0d1626a, git372
  * includes release candidate for GCC 12.2</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1661083200">- Allow cross-pru-gcc12-bootstrap for armv7l architecture.
  PRU architecture is used for real-time MCUs embedded into TI
  armv7l and aarch64 SoCs. We need to have cross-pru-gcc12 for
  armv7l in order to build both host applications and PRU firmware
  during the same build.</changelog>
  <changelog author="mliska@suse.cz" date="1661774400">- Add gcc12-fifo-jobserver-support.patch that adds support
  for FIFO jobserver for make.</changelog>
  <changelog author="rguenther@suse.com" date="1661860800">- Update to gcc-12 branch head, e927d1cf141f221c5a32574bde0, git416
  * includes GCC 12.2 release
  * includes recent fixes backported from trunk</changelog>
  <changelog author="rguenther@suse.com" date="1661947200">- Prune invalid-license rpmlint warnings, the SLE12 codestream
  doesn't get fixed but FF applies there, too.  [bsc#1185337]</changelog>
</package>
<package pkgid="f71e886ae0e6c31264ade16ab115dfc95fd76a643c0aff72cf665eecee937133" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="41c1531c60f7a42a6ba075c3c058563cd745e240c9d390410ab1f472dd13a638" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="68b1dbba4e5fad3ac3663990c73845b21338ea3d2d4545b3fc5e29014cf41131" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="6f4f5fec41235252919e6df6f51b1e100d14be68909d6f46bb72198a3b82a913" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="a2c4ac51fab4da5923e379b0204e45fcdfbadf61ebfcefc2a7a4cf71b68aeb3f" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="9952e169da02dfde3c51c3719ab038520e6296fc74d9e114163e24d060b6f5f9" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="12487efb518ccd90687dbe916c154681c9ee24003422a0fe4f731a77b650b80c" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="4b76b9e25b8cc51e76a9a802b13468a364e4444875dcc59b8c45d61af40945e4" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="2bef162503293fd82559f3b50dc7e5cdb6621b9de76edafc87be57ef8bff8a02" name="libtasn1" arch="aarch64">
  <version epoch="0" ver="4.13" rel="150000.4.8.1"/>
  <changelog author="jengelh@inai.de" date="1423915200">- Put C API documentation into -devel package.
  Use modern %make_install. Description fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1427025600">- Update project url
- Cleanup spec-file with spec-cleaner
- Add info preun and post dependencies
- Update to 4.3
  * Added asn1_decode_simple_ber()
  * Only assign a value if the previous node has one (bsc#961491).</changelog>
  <changelog author="astieger@suse.com" date="1427630400">- update to libtasn1 4.4 [bsc#924828]:
  * Corrected a two-byte stack overflow in asn1_der_decoding.
    CVE-2015-2806</changelog>
  <changelog author="astieger@suse.com" date="1430481600">- update libtasn1 4.5:
  * Corrected an invalid memory access in octet string decoding.
    CVE-2015-3622 [boo#929414]</changelog>
  <changelog author="astieger@suse.com" date="1441627200">- libtasn1 4.6:
  * Allow decoding OCTET STRINGs with multi-byte tags.
  * Add asn1_get_object_id_der</changelog>
  <changelog author="zaitor@opensuse.org" date="1442404800">- Update to version 4.7:
  * Fixed regression introduced in the decoding of multi-byte tags
    fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1460376000">- Update to 4.8
  * Fixes to avoid reliance on C undefined behavior.
  * Fixes to avoid an infinite recursion when decoding without the
    ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.
    (CVE-2016-4008 / bsc#982779)
  * Combined all the BER octet string decoding functions to a
    single one based on asn1_decode_simple_ber().</changelog>
  <changelog author="astieger@suse.com" date="1470830400">- update to 4.9:
  * Fix OID encoding of OIDs which have elements which exceed 2^32
- Do not treat i586 warning as error, adding upstream
  0001-configure-don-t-add-Werror-to-build-flags.patch
- fate#322523</changelog>
  <changelog author="astieger@suse.com" date="1496577600">- libtasn1 4.12:
  * Corrected so-name version
- includes changes in 4.11:
  * Introduce the ASN1_TIME_ENCODING_ERROR error code to indicate
    an invalid encoding in the DER time fields.
  * Introduced flag ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME. This flag
    allows decoding errors in time fields even when in strict DER mode.
    That is introduced in order to allow toleration of invalid times in
    X.509 certificates (which are common) even though strict DER adherence
    is enforced in other fields.
  * Added safety check in asn1_find_node(). That prevents a crash
    when a very long variable name is provided by the developer.
    Note that this to be exploited requires controlling the ASN.1
    definitions used by the developer, i.e., the 'name' parameter of
    asn1_write_value() or asn1_read_value(). The library is
    not designed to protect against malicious manipulation of the
    developer assigned variable names
- includes changes from 4.10:
  * Updated gnulib
  * Removed -Werror from default compiler flags
    (drop patch 0001-configure-don-t-add-Werror-to-build-flags.patch)
  * Fixed undefined behavior when negating integers in _asn1_ltostr().
  * Pass the correct length to _asn1_get_indefinite_length_string in
    asn1_get_length_ber. This addresses reading 1-byte past the end
    of data.</changelog>
  <changelog author="kbabioch@suse.com" date="1516363200">- update to 4.13
  * On indefinite string decoding, set a maximum level of allowed
    recursions (3) to protect the BER decoder from a stack exhaustion.
    (CVE-2018-6003 boo#1076832)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mgorse@suse.com" date="1556539200">- Add libtasn1-object-id-recursion.patch: limit recursion in
  _asn1_expand_object_id (boo#1105435 CVE-2018-1000654
  (https://gitlab.com/gnutls/libtasn1/merge_requests/8)</changelog>
  <changelog author="abergmann@suse.com" date="1666699200">- Add libtasn1-CVE-2021-46848.patch: Fixed off-by-one array size check
  that affects asn1_encode_simple_der (CVE-2021-46848, bsc#1204690).</changelog>
</package>
<package pkgid="6ce3156155fe97aec51c9fdfe6ced761dcb1f808f153ef6e592cbad6cad2352d" name="libtasn1" arch="src">
  <version epoch="0" ver="4.13" rel="150000.4.8.1"/>
  <changelog author="meissner@suse.com" date="1348833600">- updated to version 2.14
  This release adds asn1_read_node_value() to obtain a node's value. This
  is to deprecate the export of the node_asn internal structure for the
  upcoming 3.x release. The ASN1_DATA_NODE type and the ASN1_ETYPE_*
  constants were added to support the new function.
- removed upstreamed libtasn1-stdio.h patch
- make check</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1353153600">- update to libtasn1 3.0, SONAME libtasn1.so.6
  - Added tool in tests/ to benchmark X.509 structure decoding.
  - Added asn1_read_node_value() to obtain a node's value.
  - Optimizations in internal tree allocation.
  - Optimizations in tree search.
  - libtasn1.h no longer exports internal structures.
  - Types were renamed for consistency:
    ASN1_DATA_NODE -&gt; asn1_data_node_st
    ASN1_ARRAY_TYPE -&gt; asn1_static_node
    ASN1_TYPE -&gt; asn1_node
    ASN1_TYPE_EMPTY -&gt; NULL
    static_struct_asn -&gt; asn1_static_node_st
    node_asn_struct -&gt; asn1_node_st
    node_asn -&gt; asn1_node_st
    (the old types are still available as definitions)
- fix W: devel-package-with-non-devel-group</changelog>
  <changelog author="meissner@suse.com" date="1371729600">- updated to libtasn1 3.3
  * Noteworthy changes in release 3.3 (released 2013-03-23) [stable]
  - More precise overflow checks using gnulib's intprops module.
  - Updates to compile in Android systems.
  * Noteworthy changes in release 3.2 (released 2012-11-30) [stable]
  - Corrected buffer overflow in the error reporting of the parser (reported
    by Andreas Metzler).
  * Noteworthy changes in release 3.1 (released 2012-11-24) [stable]
  - Completed rename of types:
    ASN1_ARRAY_TYPE -&gt; asn1_static_node (was asn1_static_node_t)
  - Added new types: VisibleString, NumericString, IA5String, TeletexString,
    PrintableString, UniversalString, BMPString, UTF8String. When re-defined
    a warning is being print instead of failing.
  - Parser outputs more detailed syntax error messages.
  - Added asn1_decode_simple_der() and asn1_encode_simple_der().
  - Added asn1_read_value_type() to return value and type.
  - Introduced ASN1_ETYPE_UTC_TIME and ASN1_ETYPE_GENERALIZED_TIME
- added gpg source checking</changelog>
  <changelog author="coolo@suse.com" date="1372161600">- remove gpg source checking again to avoid this cycle:
  libtasn1 -&gt; libssh2_org -&gt; openssh -&gt; krb5 -&gt; python-Jinja2 -&gt; vim -&gt; libtasn1</changelog>
  <changelog author="meissner@suse.com" date="1401796800">- libtasn1.keyring: added Nikos Mavrogiannopoulos &lt;nmav@gnutls.org&gt;
  key, who did this release (and shares responsibility with Simon).
- updated to libtasn1 3.6
  * Noteworthy changes in release 3.6 (released 2014-05-25) [stable]
  - Corrected an off-by-one error in ASN.1 DER tag decoding. (CVE-2014-3468/bnc#880735)
  - Several improvements and new safety checks on DER decoding;
    issues found using Codenomicon TLS test suite. (CVE-2014-3469/bnc#880738,
    CVE-2014-3467/bnc#880737)
  - Marked asn1_der_decoding_element() as deprecated. Use
    asn1_der_decoding() instead.
  * Noteworthy changes in release 3.5 (released 2014-05-01) [stable]
  - Correctly handle decoding of recursive CHOICE options.
  - Allow deleting elements of SET OF. Patch by Jean-Louis Thekekara.
  - Several small bug fixes found by coverity.
  - Code improvements contributed by Kurt Roeckx.
  * Noteworthy changes in release 3.4 (released 2013-11-25) [stable]
  - Added asn1_delete_structure2() which allows zeroizing the contents
    of all values in the structure prior to deinitialization.
  - The parser accepts negative numbers in an INTEGER range (but
    still does no enforce them).</changelog>
  <changelog author="mgorse@suse.com" date="1406289600">- updated to libtasn1 3.7:
  * Noteworthy changes in release 3.7 (released 2014-06-26) [stable]
  - Fixes in length calculation in _asn1_extract_der_octet().
  - Fixes in DER decoding.
  - Fixes: CVE-2014-3468 CVE-2014-3467 CVE-2014-3469 bnc#880738
    bnc#880737 bnc#880735</changelog>
  <changelog author="tabraham@suse.com" date="1412769600">- updated to libtasn1 4.2:
  * Noteworthy changes in release 4.2 (released 2014-09-15) [stable]
  - Added sanity checks in the decoding of time when
    ASN1_DECODE_FLAG_STRICT_DER is used.
  - Fixes in the decoding of OCTET STRING when close to the end
    of the structure.
  * Noteworthy changes in release 4.1 (released 2014-08-23) [stable]
  - Corrected indefinite tag check in ANY constructions. That allows
    the decoding of BER-encoded structures that contain indefinite
    encoding within an ANY element.
  - Added DER decoding flag ASN1_DECODE_FLAG_STRICT_DER. Over the
    years BER functionality was added to the decoder and this flag
    provides the way to disable it.
  - API and ABI changes since last version:
    ASN1_DECODE_FLAG_STRICT_DER: New definition
  * Noteworthy changes in release 4.0 (released 2014-06-26) [stable]
  - Optimized asn1_der_decoding_startEnd(). It no longer requires the
    additional decoding step.
  - asn1_read_value() understands the ?CURRENT keyword, which can be used
    to indicate the current element of a sequence, when the provided node
    is a sequence element.
  - Several optimizations in DER decoding of structures with sequences
    containing many elements.
  - asn1_der_decoding2() is introduced and allows flags to be passed on
    the decoding process. Currently only ASN1_DECODE_FLAG_ALLOW_PADDING is
    defined and that allows decoding DER structures that contain arbitrary
    data past their end. Contributed by Karel Slany.
  - API and ABI changes since last version:
    ASN1_DECODE_FLAG_ALLOW_PADDING: New definition
    asn1_dup_node: New function
    asn1_der_decoding2: New function
    asn1_der_decoding_element: It is now an alias to asn1_der_decoding</changelog>
  <changelog author="jengelh@inai.de" date="1423915200">- Put C API documentation into -devel package.
  Use modern %make_install. Description fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1427025600">- Update project url
- Cleanup spec-file with spec-cleaner
- Add info preun and post dependencies
- Update to 4.3
  * Added asn1_decode_simple_ber()
  * Only assign a value if the previous node has one (bsc#961491).</changelog>
  <changelog author="astieger@suse.com" date="1427630400">- update to libtasn1 4.4 [bsc#924828]:
  * Corrected a two-byte stack overflow in asn1_der_decoding.
    CVE-2015-2806</changelog>
  <changelog author="astieger@suse.com" date="1430481600">- update libtasn1 4.5:
  * Corrected an invalid memory access in octet string decoding.
    CVE-2015-3622 [boo#929414]</changelog>
  <changelog author="astieger@suse.com" date="1441627200">- libtasn1 4.6:
  * Allow decoding OCTET STRINGs with multi-byte tags.
  * Add asn1_get_object_id_der</changelog>
  <changelog author="zaitor@opensuse.org" date="1442404800">- Update to version 4.7:
  * Fixed regression introduced in the decoding of multi-byte tags
    fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1460376000">- Update to 4.8
  * Fixes to avoid reliance on C undefined behavior.
  * Fixes to avoid an infinite recursion when decoding without the
    ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.
    (CVE-2016-4008 / bsc#982779)
  * Combined all the BER octet string decoding functions to a
    single one based on asn1_decode_simple_ber().</changelog>
  <changelog author="astieger@suse.com" date="1470830400">- update to 4.9:
  * Fix OID encoding of OIDs which have elements which exceed 2^32
- Do not treat i586 warning as error, adding upstream
  0001-configure-don-t-add-Werror-to-build-flags.patch
- fate#322523</changelog>
  <changelog author="astieger@suse.com" date="1496577600">- libtasn1 4.12:
  * Corrected so-name version
- includes changes in 4.11:
  * Introduce the ASN1_TIME_ENCODING_ERROR error code to indicate
    an invalid encoding in the DER time fields.
  * Introduced flag ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME. This flag
    allows decoding errors in time fields even when in strict DER mode.
    That is introduced in order to allow toleration of invalid times in
    X.509 certificates (which are common) even though strict DER adherence
    is enforced in other fields.
  * Added safety check in asn1_find_node(). That prevents a crash
    when a very long variable name is provided by the developer.
    Note that this to be exploited requires controlling the ASN.1
    definitions used by the developer, i.e., the 'name' parameter of
    asn1_write_value() or asn1_read_value(). The library is
    not designed to protect against malicious manipulation of the
    developer assigned variable names
- includes changes from 4.10:
  * Updated gnulib
  * Removed -Werror from default compiler flags
    (drop patch 0001-configure-don-t-add-Werror-to-build-flags.patch)
  * Fixed undefined behavior when negating integers in _asn1_ltostr().
  * Pass the correct length to _asn1_get_indefinite_length_string in
    asn1_get_length_ber. This addresses reading 1-byte past the end
    of data.</changelog>
  <changelog author="kbabioch@suse.com" date="1516363200">- update to 4.13
  * On indefinite string decoding, set a maximum level of allowed
    recursions (3) to protect the BER decoder from a stack exhaustion.
    (CVE-2018-6003 boo#1076832)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mgorse@suse.com" date="1556539200">- Add libtasn1-object-id-recursion.patch: limit recursion in
  _asn1_expand_object_id (boo#1105435 CVE-2018-1000654
  (https://gitlab.com/gnutls/libtasn1/merge_requests/8)</changelog>
  <changelog author="abergmann@suse.com" date="1666699200">- Add libtasn1-CVE-2021-46848.patch: Fixed off-by-one array size check
  that affects asn1_encode_simple_der (CVE-2021-46848, bsc#1204690).</changelog>
</package>
<package pkgid="fee265d27b14ca138b7fdcc3f9f71cb6b7c35bc11e42f41d1fd32ef4d7df2394" name="libtasn1" arch="x86_64">
  <version epoch="0" ver="4.13" rel="150000.4.8.1"/>
  <changelog author="jengelh@inai.de" date="1423915200">- Put C API documentation into -devel package.
  Use modern %make_install. Description fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1427025600">- Update project url
- Cleanup spec-file with spec-cleaner
- Add info preun and post dependencies
- Update to 4.3
  * Added asn1_decode_simple_ber()
  * Only assign a value if the previous node has one (bsc#961491).</changelog>
  <changelog author="astieger@suse.com" date="1427630400">- update to libtasn1 4.4 [bsc#924828]:
  * Corrected a two-byte stack overflow in asn1_der_decoding.
    CVE-2015-2806</changelog>
  <changelog author="astieger@suse.com" date="1430481600">- update libtasn1 4.5:
  * Corrected an invalid memory access in octet string decoding.
    CVE-2015-3622 [boo#929414]</changelog>
  <changelog author="astieger@suse.com" date="1441627200">- libtasn1 4.6:
  * Allow decoding OCTET STRINGs with multi-byte tags.
  * Add asn1_get_object_id_der</changelog>
  <changelog author="zaitor@opensuse.org" date="1442404800">- Update to version 4.7:
  * Fixed regression introduced in the decoding of multi-byte tags
    fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1460376000">- Update to 4.8
  * Fixes to avoid reliance on C undefined behavior.
  * Fixes to avoid an infinite recursion when decoding without the
    ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.
    (CVE-2016-4008 / bsc#982779)
  * Combined all the BER octet string decoding functions to a
    single one based on asn1_decode_simple_ber().</changelog>
  <changelog author="astieger@suse.com" date="1470830400">- update to 4.9:
  * Fix OID encoding of OIDs which have elements which exceed 2^32
- Do not treat i586 warning as error, adding upstream
  0001-configure-don-t-add-Werror-to-build-flags.patch
- fate#322523</changelog>
  <changelog author="astieger@suse.com" date="1496577600">- libtasn1 4.12:
  * Corrected so-name version
- includes changes in 4.11:
  * Introduce the ASN1_TIME_ENCODING_ERROR error code to indicate
    an invalid encoding in the DER time fields.
  * Introduced flag ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME. This flag
    allows decoding errors in time fields even when in strict DER mode.
    That is introduced in order to allow toleration of invalid times in
    X.509 certificates (which are common) even though strict DER adherence
    is enforced in other fields.
  * Added safety check in asn1_find_node(). That prevents a crash
    when a very long variable name is provided by the developer.
    Note that this to be exploited requires controlling the ASN.1
    definitions used by the developer, i.e., the 'name' parameter of
    asn1_write_value() or asn1_read_value(). The library is
    not designed to protect against malicious manipulation of the
    developer assigned variable names
- includes changes from 4.10:
  * Updated gnulib
  * Removed -Werror from default compiler flags
    (drop patch 0001-configure-don-t-add-Werror-to-build-flags.patch)
  * Fixed undefined behavior when negating integers in _asn1_ltostr().
  * Pass the correct length to _asn1_get_indefinite_length_string in
    asn1_get_length_ber. This addresses reading 1-byte past the end
    of data.</changelog>
  <changelog author="kbabioch@suse.com" date="1516363200">- update to 4.13
  * On indefinite string decoding, set a maximum level of allowed
    recursions (3) to protect the BER decoder from a stack exhaustion.
    (CVE-2018-6003 boo#1076832)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mgorse@suse.com" date="1556539200">- Add libtasn1-object-id-recursion.patch: limit recursion in
  _asn1_expand_object_id (boo#1105435 CVE-2018-1000654
  (https://gitlab.com/gnutls/libtasn1/merge_requests/8)</changelog>
  <changelog author="abergmann@suse.com" date="1666699200">- Add libtasn1-CVE-2021-46848.patch: Fixed off-by-one array size check
  that affects asn1_encode_simple_der (CVE-2021-46848, bsc#1204690).</changelog>
</package>
<package pkgid="e705f5d13efda546659e52599f349b926c9796d7c347afe46cd3b03682cd0b7c" name="libtasn1-6" arch="aarch64">
  <version epoch="0" ver="4.13" rel="150000.4.8.1"/>
  <changelog author="jengelh@inai.de" date="1423915200">- Put C API documentation into -devel package.
  Use modern %make_install. Description fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1427025600">- Update project url
- Cleanup spec-file with spec-cleaner
- Add info preun and post dependencies
- Update to 4.3
  * Added asn1_decode_simple_ber()
  * Only assign a value if the previous node has one (bsc#961491).</changelog>
  <changelog author="astieger@suse.com" date="1427630400">- update to libtasn1 4.4 [bsc#924828]:
  * Corrected a two-byte stack overflow in asn1_der_decoding.
    CVE-2015-2806</changelog>
  <changelog author="astieger@suse.com" date="1430481600">- update libtasn1 4.5:
  * Corrected an invalid memory access in octet string decoding.
    CVE-2015-3622 [boo#929414]</changelog>
  <changelog author="astieger@suse.com" date="1441627200">- libtasn1 4.6:
  * Allow decoding OCTET STRINGs with multi-byte tags.
  * Add asn1_get_object_id_der</changelog>
  <changelog author="zaitor@opensuse.org" date="1442404800">- Update to version 4.7:
  * Fixed regression introduced in the decoding of multi-byte tags
    fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1460376000">- Update to 4.8
  * Fixes to avoid reliance on C undefined behavior.
  * Fixes to avoid an infinite recursion when decoding without the
    ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.
    (CVE-2016-4008 / bsc#982779)
  * Combined all the BER octet string decoding functions to a
    single one based on asn1_decode_simple_ber().</changelog>
  <changelog author="astieger@suse.com" date="1470830400">- update to 4.9:
  * Fix OID encoding of OIDs which have elements which exceed 2^32
- Do not treat i586 warning as error, adding upstream
  0001-configure-don-t-add-Werror-to-build-flags.patch
- fate#322523</changelog>
  <changelog author="astieger@suse.com" date="1496577600">- libtasn1 4.12:
  * Corrected so-name version
- includes changes in 4.11:
  * Introduce the ASN1_TIME_ENCODING_ERROR error code to indicate
    an invalid encoding in the DER time fields.
  * Introduced flag ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME. This flag
    allows decoding errors in time fields even when in strict DER mode.
    That is introduced in order to allow toleration of invalid times in
    X.509 certificates (which are common) even though strict DER adherence
    is enforced in other fields.
  * Added safety check in asn1_find_node(). That prevents a crash
    when a very long variable name is provided by the developer.
    Note that this to be exploited requires controlling the ASN.1
    definitions used by the developer, i.e., the 'name' parameter of
    asn1_write_value() or asn1_read_value(). The library is
    not designed to protect against malicious manipulation of the
    developer assigned variable names
- includes changes from 4.10:
  * Updated gnulib
  * Removed -Werror from default compiler flags
    (drop patch 0001-configure-don-t-add-Werror-to-build-flags.patch)
  * Fixed undefined behavior when negating integers in _asn1_ltostr().
  * Pass the correct length to _asn1_get_indefinite_length_string in
    asn1_get_length_ber. This addresses reading 1-byte past the end
    of data.</changelog>
  <changelog author="kbabioch@suse.com" date="1516363200">- update to 4.13
  * On indefinite string decoding, set a maximum level of allowed
    recursions (3) to protect the BER decoder from a stack exhaustion.
    (CVE-2018-6003 boo#1076832)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mgorse@suse.com" date="1556539200">- Add libtasn1-object-id-recursion.patch: limit recursion in
  _asn1_expand_object_id (boo#1105435 CVE-2018-1000654
  (https://gitlab.com/gnutls/libtasn1/merge_requests/8)</changelog>
  <changelog author="abergmann@suse.com" date="1666699200">- Add libtasn1-CVE-2021-46848.patch: Fixed off-by-one array size check
  that affects asn1_encode_simple_der (CVE-2021-46848, bsc#1204690).</changelog>
</package>
<package pkgid="c7c9ac76b55aaca9bb09de322ed72cbd24b3f14097ecacd5d402c9b94b0bc3b3" name="libtasn1-6" arch="x86_64">
  <version epoch="0" ver="4.13" rel="150000.4.8.1"/>
  <changelog author="jengelh@inai.de" date="1423915200">- Put C API documentation into -devel package.
  Use modern %make_install. Description fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1427025600">- Update project url
- Cleanup spec-file with spec-cleaner
- Add info preun and post dependencies
- Update to 4.3
  * Added asn1_decode_simple_ber()
  * Only assign a value if the previous node has one (bsc#961491).</changelog>
  <changelog author="astieger@suse.com" date="1427630400">- update to libtasn1 4.4 [bsc#924828]:
  * Corrected a two-byte stack overflow in asn1_der_decoding.
    CVE-2015-2806</changelog>
  <changelog author="astieger@suse.com" date="1430481600">- update libtasn1 4.5:
  * Corrected an invalid memory access in octet string decoding.
    CVE-2015-3622 [boo#929414]</changelog>
  <changelog author="astieger@suse.com" date="1441627200">- libtasn1 4.6:
  * Allow decoding OCTET STRINGs with multi-byte tags.
  * Add asn1_get_object_id_der</changelog>
  <changelog author="zaitor@opensuse.org" date="1442404800">- Update to version 4.7:
  * Fixed regression introduced in the decoding of multi-byte tags
    fix.</changelog>
  <changelog author="mpluskal@suse.com" date="1460376000">- Update to 4.8
  * Fixes to avoid reliance on C undefined behavior.
  * Fixes to avoid an infinite recursion when decoding without the
    ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.
    (CVE-2016-4008 / bsc#982779)
  * Combined all the BER octet string decoding functions to a
    single one based on asn1_decode_simple_ber().</changelog>
  <changelog author="astieger@suse.com" date="1470830400">- update to 4.9:
  * Fix OID encoding of OIDs which have elements which exceed 2^32
- Do not treat i586 warning as error, adding upstream
  0001-configure-don-t-add-Werror-to-build-flags.patch
- fate#322523</changelog>
  <changelog author="astieger@suse.com" date="1496577600">- libtasn1 4.12:
  * Corrected so-name version
- includes changes in 4.11:
  * Introduce the ASN1_TIME_ENCODING_ERROR error code to indicate
    an invalid encoding in the DER time fields.
  * Introduced flag ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME. This flag
    allows decoding errors in time fields even when in strict DER mode.
    That is introduced in order to allow toleration of invalid times in
    X.509 certificates (which are common) even though strict DER adherence
    is enforced in other fields.
  * Added safety check in asn1_find_node(). That prevents a crash
    when a very long variable name is provided by the developer.
    Note that this to be exploited requires controlling the ASN.1
    definitions used by the developer, i.e., the 'name' parameter of
    asn1_write_value() or asn1_read_value(). The library is
    not designed to protect against malicious manipulation of the
    developer assigned variable names
- includes changes from 4.10:
  * Updated gnulib
  * Removed -Werror from default compiler flags
    (drop patch 0001-configure-don-t-add-Werror-to-build-flags.patch)
  * Fixed undefined behavior when negating integers in _asn1_ltostr().
  * Pass the correct length to _asn1_get_indefinite_length_string in
    asn1_get_length_ber. This addresses reading 1-byte past the end
    of data.</changelog>
  <changelog author="kbabioch@suse.com" date="1516363200">- update to 4.13
  * On indefinite string decoding, set a maximum level of allowed
    recursions (3) to protect the BER decoder from a stack exhaustion.
    (CVE-2018-6003 boo#1076832)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mgorse@suse.com" date="1556539200">- Add libtasn1-object-id-recursion.patch: limit recursion in
  _asn1_expand_object_id (boo#1105435 CVE-2018-1000654
  (https://gitlab.com/gnutls/libtasn1/merge_requests/8)</changelog>
  <changelog author="abergmann@suse.com" date="1666699200">- Add libtasn1-CVE-2021-46848.patch: Fixed off-by-one array size check
  that affects asn1_encode_simple_der (CVE-2021-46848, bsc#1204690).</changelog>
</package>
<package pkgid="2c929882e5d0178acae2a8ea79ee5faa2fb75c05ca6de357d813dc4297c53877" name="libtheora" arch="src">
  <version epoch="0" ver="1.1.1" rel="150000.3.3.1"/>
  <changelog author="sbrabec@suse.cz" date="1175083200">- Updated to version 1.0alpha7:
  * Enable mmx assembly by default
  * Avoid some relocations that caused problems on SELinux
  * Other build fixes
  * time testing mode (-f) for the dump_video example
  * Merge theora-mmx simd acceleration (x86_32 and x86_64)
  * Major RTP payload specification update
  * Minor format specification updates
  * Fix some spurious calls to free() instead of _ogg_free()
  * Fix invalid array indexing in PixelLineSearch()
  * Improve robustness against invalid input
  * General warning cleanup
  * The offset_y member meaning fix.
- Use incremental versioning scheme.
- Documentation repackaged.
- Use less vague names for binaries.</changelog>
  <changelog author="crrodriguez@suse.de" date="1186833600">- fix build in x86_64
- use library packaging policy
- run make check in the check section
- add missing call to ldconfig</changelog>
  <changelog author="coolo@suse.de" date="1187179200">- fixing upgrade (#293401)</changelog>
  <changelog author="adrian@suse.de" date="1190808000">- update to 1.0beta1
  From official changelog:
  * Granulepos scheme modified to match other codecs. This bumps
  the bitstream revision to 3.2.1. Bitstreams marked 3.2.0 are
  handled correctly by this decoder. Older decoders will show
  a one frame sync error in the less noticable direction.
  * Switch to new spec compliant decoder from theora-exp branch.
  Written by Dr. Timothy Terriberry.
  * Add support to the encoder for using quantization settings
  provided by the application.
  * more assembly optimizations</changelog>
  <changelog author="adrian@suse.de" date="1194523200">- fix compiling with gcc 4.3 on ia32</changelog>
  <changelog author="crrodriguez@suse.de" date="1197547200">- fix package version numbers 1.0beta1 --&gt; 1.0.beta2
- libtheora 1.0.beta2
  - Fix a crash bug on char-is-unsigned architectures (PowerPC)
  - Fix a buffer sizing issue that caused rare encoder crashes
  - Fix a buffer alignment issue
  - Improved format documentation.
- removed unneeded patch, use --with-pic configure option instead.</changelog>
  <changelog author="ro@suse.de" date="1207828800">- added baselibs.conf file to build xxbit packages
  for multilib support</changelog>
  <changelog author="cthiel@suse.de" date="1211371200">- fix baselibs.conf</changelog>
  <changelog author="olh@suse.de" date="1231329600">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="adrian@suse.de" date="1247832000">- update to version 1.0 final
  * new additional encoder and decoder libs with new api.</changelog>
  <changelog author="adrian@suse.de" date="1251374400">- update to version 1.1 beta 3
  * Much better encoder
    (faster and more details at same compressions level)
  * Playback received speed improvements, but bitstream format is
    untouched
- no package split yet for dec/enc/legacy libs due to 11.2 freeze</changelog>
  <changelog author="adrian@suse.de" date="1253966400">- update to version 1.1.0
  * minor fixes since beta 3</changelog>
  <changelog author="adrian@suse.de" date="1254916800">- update to version 1.1.1
  * minor bugfixes</changelog>
  <changelog author="jengelh@medozas.de" date="1261137600">- add baselibs.conf as a source</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1306152000">- Disable doxygen documentation to avoid build dates in
  - devel packages.
- add missing BuildRequires libpng-devel</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1311768000">- remove fno-strict-aliasing from CFLAGS as it is no longer
  needed and will slow down things.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314619200">- remove examples that fail to build, also SDL and png
  are only needed for those, so remove from buildrequires.</changelog>
  <changelog author="coolo@suse.com" date="1321790400">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="idonmez@suse.com" date="1369310400">- Update descriptions, thanks to Perry Werneck</changelog>
  <changelog author="jengelh@inai.de" date="1409400000">- Split libtheoradec/enc from libtheora0 as they have different
  SO numbers
- Trim huge description; improve on RPM group classificaiton</changelog>
</package>
<package pkgid="b92653451aca28e77fee90880992d18744e535397822de7067cfb2a9e09f0007" name="libtheoradec1" arch="aarch64">
  <version epoch="0" ver="1.1.1" rel="150000.3.3.1"/>
  <changelog author="adrian@suse.de" date="1251374400">- update to version 1.1 beta 3
  * Much better encoder
    (faster and more details at same compressions level)
  * Playback received speed improvements, but bitstream format is
    untouched
- no package split yet for dec/enc/legacy libs due to 11.2 freeze</changelog>
  <changelog author="adrian@suse.de" date="1253966400">- update to version 1.1.0
  * minor fixes since beta 3</changelog>
  <changelog author="adrian@suse.de" date="1254916800">- update to version 1.1.1
  * minor bugfixes</changelog>
  <changelog author="jengelh@medozas.de" date="1261137600">- add baselibs.conf as a source</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1306152000">- Disable doxygen documentation to avoid build dates in
  - devel packages.
- add missing BuildRequires libpng-devel</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1311768000">- remove fno-strict-aliasing from CFLAGS as it is no longer
  needed and will slow down things.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314619200">- remove examples that fail to build, also SDL and png
  are only needed for those, so remove from buildrequires.</changelog>
  <changelog author="coolo@suse.com" date="1321790400">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="idonmez@suse.com" date="1369310400">- Update descriptions, thanks to Perry Werneck</changelog>
  <changelog author="jengelh@inai.de" date="1409400000">- Split libtheoradec/enc from libtheora0 as they have different
  SO numbers
- Trim huge description; improve on RPM group classificaiton</changelog>
</package>
<package pkgid="374b31b31c6ddf6d3fe35e285119f20f6044d1feadda8cddcbc154cfe8cfacce" name="libtheoradec1" arch="x86_64">
  <version epoch="0" ver="1.1.1" rel="150000.3.3.1"/>
  <changelog author="adrian@suse.de" date="1251374400">- update to version 1.1 beta 3
  * Much better encoder
    (faster and more details at same compressions level)
  * Playback received speed improvements, but bitstream format is
    untouched
- no package split yet for dec/enc/legacy libs due to 11.2 freeze</changelog>
  <changelog author="adrian@suse.de" date="1253966400">- update to version 1.1.0
  * minor fixes since beta 3</changelog>
  <changelog author="adrian@suse.de" date="1254916800">- update to version 1.1.1
  * minor bugfixes</changelog>
  <changelog author="jengelh@medozas.de" date="1261137600">- add baselibs.conf as a source</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1306152000">- Disable doxygen documentation to avoid build dates in
  - devel packages.
- add missing BuildRequires libpng-devel</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1311768000">- remove fno-strict-aliasing from CFLAGS as it is no longer
  needed and will slow down things.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314619200">- remove examples that fail to build, also SDL and png
  are only needed for those, so remove from buildrequires.</changelog>
  <changelog author="coolo@suse.com" date="1321790400">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="idonmez@suse.com" date="1369310400">- Update descriptions, thanks to Perry Werneck</changelog>
  <changelog author="jengelh@inai.de" date="1409400000">- Split libtheoradec/enc from libtheora0 as they have different
  SO numbers
- Trim huge description; improve on RPM group classificaiton</changelog>
</package>
<package pkgid="8adcb6e0682ba35c9fcc8a0fe0894aecb59fbab369bd1dee2337497953c17113" name="libtheoraenc1" arch="aarch64">
  <version epoch="0" ver="1.1.1" rel="150000.3.3.1"/>
  <changelog author="adrian@suse.de" date="1251374400">- update to version 1.1 beta 3
  * Much better encoder
    (faster and more details at same compressions level)
  * Playback received speed improvements, but bitstream format is
    untouched
- no package split yet for dec/enc/legacy libs due to 11.2 freeze</changelog>
  <changelog author="adrian@suse.de" date="1253966400">- update to version 1.1.0
  * minor fixes since beta 3</changelog>
  <changelog author="adrian@suse.de" date="1254916800">- update to version 1.1.1
  * minor bugfixes</changelog>
  <changelog author="jengelh@medozas.de" date="1261137600">- add baselibs.conf as a source</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1306152000">- Disable doxygen documentation to avoid build dates in
  - devel packages.
- add missing BuildRequires libpng-devel</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1311768000">- remove fno-strict-aliasing from CFLAGS as it is no longer
  needed and will slow down things.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314619200">- remove examples that fail to build, also SDL and png
  are only needed for those, so remove from buildrequires.</changelog>
  <changelog author="coolo@suse.com" date="1321790400">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="idonmez@suse.com" date="1369310400">- Update descriptions, thanks to Perry Werneck</changelog>
  <changelog author="jengelh@inai.de" date="1409400000">- Split libtheoradec/enc from libtheora0 as they have different
  SO numbers
- Trim huge description; improve on RPM group classificaiton</changelog>
</package>
<package pkgid="ae9fcf6a7b1e0b62e9fba088e8b67949f88a577763eb4ab4abcf5b4c24cf1ff7" name="libtheoraenc1" arch="x86_64">
  <version epoch="0" ver="1.1.1" rel="150000.3.3.1"/>
  <changelog author="adrian@suse.de" date="1251374400">- update to version 1.1 beta 3
  * Much better encoder
    (faster and more details at same compressions level)
  * Playback received speed improvements, but bitstream format is
    untouched
- no package split yet for dec/enc/legacy libs due to 11.2 freeze</changelog>
  <changelog author="adrian@suse.de" date="1253966400">- update to version 1.1.0
  * minor fixes since beta 3</changelog>
  <changelog author="adrian@suse.de" date="1254916800">- update to version 1.1.1
  * minor bugfixes</changelog>
  <changelog author="jengelh@medozas.de" date="1261137600">- add baselibs.conf as a source</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1306152000">- Disable doxygen documentation to avoid build dates in
  - devel packages.
- add missing BuildRequires libpng-devel</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1311768000">- remove fno-strict-aliasing from CFLAGS as it is no longer
  needed and will slow down things.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314619200">- remove examples that fail to build, also SDL and png
  are only needed for those, so remove from buildrequires.</changelog>
  <changelog author="coolo@suse.com" date="1321790400">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="idonmez@suse.com" date="1369310400">- Update descriptions, thanks to Perry Werneck</changelog>
  <changelog author="jengelh@inai.de" date="1409400000">- Split libtheoradec/enc from libtheora0 as they have different
  SO numbers
- Trim huge description; improve on RPM group classificaiton</changelog>
</package>
<package pkgid="3367c401f5898e5d2686ee9a2889c3b4af13c38b0729cd09ae7c40d56f13ca46" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.11.1"/>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
</package>
<package pkgid="a3e1aeef82fb0a8b829d0d75629f5ac3e2b797ee6eddf0845a78a4e522e8cfdd" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.11.1"/>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
</package>
<package pkgid="20a6de769d73bd61baca34a2105ad706e2e33f7977d9bbd4776b78412210e21a" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.16.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
</package>
<package pkgid="26051feac8e0f061bc444a081ac23f42a8ad6d617f8ba7ca0ee22e88eb7be067" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.16.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
</package>
<package pkgid="29b6e4d3fb850f1a0a3a441a81ca49efa270fd9aafa4b3077ddd0f2c92d6b51a" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.19.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
</package>
<package pkgid="15ca697a53b40d8403ecd6f1230ddea99163f4acbf072d17cb1e17fcc2e5ff0b" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.19.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
</package>
<package pkgid="e682e0ec3f1bdfc5a43dedb08ddb4d9d6eff9331056bad0eaa1c061c2a6fa4b0" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.22.1"/>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
</package>
<package pkgid="8c28d4c6ec19ca117886157c99f63be6b1d483a143d5235044a7a5165200cb69" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.22.1"/>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
</package>
<package pkgid="37f1749cba1a0270a391c3cd3091d8337808b4e5a9a8509a4f5121d098958050" name="libtiff5" arch="aarch64">
  <version epoch="0" ver="4.0.9" rel="150000.45.25.1"/>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
</package>
<package pkgid="8757222bff38b9319b0d0f9183d197016315a98101a1a209dbf582c765007d6b" name="libtiff5" arch="x86_64">
  <version epoch="0" ver="4.0.9" rel="150000.45.25.1"/>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
</package>
<package pkgid="ac27215b5721a7a6bdf22fbb9ca714ceb5b4d9769476d6e02bd9a730c00f9f83" name="libtirpc" arch="src">
  <version epoch="0" ver="1.2.6" rel="150300.3.11.1"/>
  <changelog author="kukuk@suse.de" date="1510660800">- 005-missing-includes.patch: add missing includes to make headers
  compatible to sunrpc.</changelog>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
</package>
<package pkgid="243af915f026aad5c79840817b4df08fd9e62f73c6e29e604591897f9d2055ec" name="libtirpc" arch="src">
  <version epoch="0" ver="1.2.6" rel="150300.3.14.1"/>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
</package>
<package pkgid="6fd6c074da7f3c357a85a3685c6937bacfd8c5cd5af1348863113f659b3a44f0" name="libtirpc" arch="src">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="de94ca72df6798f183a6cc96ab2e29b7b5149b0665df070ca266a2a96ecfc8f2" name="libtirpc-netconfig" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.11.1"/>
  <changelog author="kukuk@suse.de" date="1510660800">- 005-missing-includes.patch: add missing includes to make headers
  compatible to sunrpc.</changelog>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
</package>
<package pkgid="043b1e4851a911f497a071334fc1f8bfcd7f66394b9284549eee5dc6619dd7c8" name="libtirpc-netconfig" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.11.1"/>
  <changelog author="kukuk@suse.de" date="1510660800">- 005-missing-includes.patch: add missing includes to make headers
  compatible to sunrpc.</changelog>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
</package>
<package pkgid="dec46b6e298933c776f77295cb8a396ea8818ad8787dfdd9a7101c8e4d09a7f0" name="libtirpc-netconfig" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.14.1"/>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
</package>
<package pkgid="2b386a0ee50bfb6a28d092a6bc604b3c0741aa5d8a9932e63014120d4b32703a" name="libtirpc-netconfig" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.14.1"/>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
</package>
<package pkgid="105e678db838d5add05bf4c831841859aec7944f6d3f107f4da05326d295a63a" name="libtirpc-netconfig" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="b24b3035cc721837279c19e5317b8fb35e9cac47ece226a44d85899d12c0eb94" name="libtirpc-netconfig" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="177663d8131115203a083f86cffb6b2701af658d4a9e4caa1a595ef816a2d58c" name="libtirpc3" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.11.1"/>
  <changelog author="kukuk@suse.de" date="1510660800">- 005-missing-includes.patch: add missing includes to make headers
  compatible to sunrpc.</changelog>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
</package>
<package pkgid="899016788b43baee8cd2263684d2c54afbbe64cad8ce469e09d210a5367946de" name="libtirpc3" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.11.1"/>
  <changelog author="kukuk@suse.de" date="1510660800">- 005-missing-includes.patch: add missing includes to make headers
  compatible to sunrpc.</changelog>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
</package>
<package pkgid="1c31fae72e37662f1fdf68fe56adc3e9d5d879efb3f20275d1a7851c14f96197" name="libtirpc3" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.14.1"/>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
</package>
<package pkgid="775520e25c0143630c74a51beb5a8c3ba6cac541df7f618dbd63a6748fd868a1" name="libtirpc3" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.14.1"/>
  <changelog author="kukuk@suse.de" date="1511784000">- Add COPYING.GPLv2 and install Licenses for GPLv2 code.</changelog>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
</package>
<package pkgid="2cc7f5d3bdb3c1ac57bcd5647390d0a79c4a4beadfdcd0b2b35fee8b936a07bf" name="libtirpc3" arch="aarch64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="2015c0025645729a0ead8fc6880954c055b6200258ca230ea3fdae46f645eb08" name="libtirpc3" arch="x86_64">
  <version epoch="0" ver="1.2.6" rel="150300.3.17.1"/>
  <changelog author="kukuk@suse.de" date="1516017600">- Move /usr/include/tirpc to /usr/include</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
</package>
<package pkgid="32f9ba07a6790b307b81307b10a5f82f56da6903010bb45d53ccec3efda39f3f" name="libtpms" arch="src">
  <version epoch="0" ver="0.8.2" rel="150300.3.6.1"/>
  <changelog author="meissner@suse.com" date="1389700800">- import 0.5.1
  - software TPM driver library for hooking into QEMU</changelog>
  <changelog author="p.drouand@gmail.com" date="1426939200">- Update to version 0.5.2
  * No entry for this release
- Update project home and download Urls
- Add autoconf, automake and libtool build require; the tarball
  comes from git and configure script has to be generated</changelog>
  <changelog author="vcizek@suse.com" date="1516190400">- Update to version 0.6.0-dev1
  * no upstream changelog
  * fix build with openssl 1.1 (bsc#1074801)
- fix rpm group</changelog>
  <changelog author="glin@suse.com" date="1548676800">- Update to version 0.6.0
  * Introduce TPM2 support
- Use %license tag for LICENSE</changelog>
  <changelog author="glin@suse.com" date="1567684800">- Update to version 0.7.0
  * fixes for TPM2
- Add gcc-c++ to BuildRequires</changelog>
  <changelog author="kai.liu@suse.com" date="1595505600">- Update to version 0.7.3
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest `swtpm` (master, stable branches) for test cases to
    succeed there.
- Changes since version 0.7.2
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rathern than
    max. possible
  * Fixes to symmetric decrytion related to input size check, defer
    padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and to
    always use a temporary malloc'ed buffer for decryption
- Changes since version 0.7.1
  * tpm2: Fix TDES key creation by adding missing un-/marshalling
    functions
  * tpm2: Fix a bug in CheckAuthSession
  * compilation fixes for TPM 1.2 &amp; TPM 2 and various architectures
    and gcc versions
  * Fix support for NIST curves P{192,224,521} and SM2 P256 and
    BNP648 that would not work;
  * Runtime filter elliptic curves (that OpenSSL does not support)
    and do not advertise those curves as capabilities
  * Removed unnecessary space in MANUFACTURER "IBM " -&gt; "IBM"</changelog>
  <changelog author="glin@suse.com" date="1606132800">- Update to version 0.7.4
  * Addressed potential constant-time related issues in TPM 1.2 and
    TPM 2 code
    TPM 1.2: RSA decryption
    TPM 2: EcSchnorr and EcSM2 signatures; Ecsda is handled by OpenSSL
  * Fixed some compilation issues</changelog>
  <changelog author="glin@suse.com" date="1616155200">- Update to version 0.7.7
  * CryptSym: fix AES output IV (bsc#1183729, CVE-2021-3446)
  * tpm2: Fix public key context save due to ANY_OBJECT_Marshal usage
  * tpm2: Address some Coverity issues (false positives)
  * tpm1.2: Backported ASAN/UBSAN related fixes
  * tpm2: Return properly sized array for b parameter for NIST P521
    (HLK)
  * tpm2: Addressed issues detected by UBSAN
  * tpm2: Addressed issues detected by cppcheck (false positives)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Update to version 0.8.2
  * NOTE: Downgrade to 0.7.x or below is not possible.
    Due to fixes in the TPM 2 prime number generation code in
    rev155 it is not possible to downgrade from libtpms version
    0.8.0 to some previous version. The seeds are now associated
    with an age so that older seeds use the old TPM 2 prime number
    generation code while newer seed use the newer code.
  * tpm2: rev155: Add new RsaAdjustPrimeCandidate code but do
    not use (bsc#1184939 CVE-2021-3505)
  * tpm2: Activate SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX
    (bsc#1184939 CVE-2021-3505)
  * Update to TPM 2 code release 159
  - X509 support is enabled
    + SM2 signing of ceritificates is NOT supported
  - Authenticated timers are disabled
  * Update to TPM 2 code relase 162
  - ECC encryption / decryption is disabled
  * Fix support for elliptic curve due to missing unmarshalling
    code
  * Runtime filter supported elliptic curves supported by OpenSSL
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rather than
    max
  * Fixes to symmetric decryption related to input size check,
    defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)]
    and to always use a temporary malloc'ed buffer for decryption
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest swtpm for test cases to succeed there.</changelog>
  <changelog author="pgajdos@suse.com" date="1630411200">- security update
- added patches
  fix CVE-2021-3746 [bsc#1189935], out-of-bounds access via specially crafted TPM 2 command packets
  + libtpms-CVE-2021-3746.patch</changelog>
  <changelog author="meissner@suse.com" date="1666353600">- Added patches:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch
- CVE-2021-3623: Fixed out-of-bounds access when trying to resume the
  state of the vTPM (bsc#1187767)</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
</package>
<package pkgid="5791a3b01b09994e8d4d63a6d73602c4ddb843e731599c921fb5c1f678449116" name="libtpms0" arch="aarch64">
  <version epoch="0" ver="0.8.2" rel="150300.3.6.1"/>
  <changelog author="p.drouand@gmail.com" date="1426939200">- Update to version 0.5.2
  * No entry for this release
- Update project home and download Urls
- Add autoconf, automake and libtool build require; the tarball
  comes from git and configure script has to be generated</changelog>
  <changelog author="vcizek@suse.com" date="1516190400">- Update to version 0.6.0-dev1
  * no upstream changelog
  * fix build with openssl 1.1 (bsc#1074801)
- fix rpm group</changelog>
  <changelog author="glin@suse.com" date="1548676800">- Update to version 0.6.0
  * Introduce TPM2 support
- Use %license tag for LICENSE</changelog>
  <changelog author="glin@suse.com" date="1567684800">- Update to version 0.7.0
  * fixes for TPM2
- Add gcc-c++ to BuildRequires</changelog>
  <changelog author="kai.liu@suse.com" date="1595505600">- Update to version 0.7.3
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest `swtpm` (master, stable branches) for test cases to
    succeed there.
- Changes since version 0.7.2
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rathern than
    max. possible
  * Fixes to symmetric decrytion related to input size check, defer
    padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and to
    always use a temporary malloc'ed buffer for decryption
- Changes since version 0.7.1
  * tpm2: Fix TDES key creation by adding missing un-/marshalling
    functions
  * tpm2: Fix a bug in CheckAuthSession
  * compilation fixes for TPM 1.2 &amp; TPM 2 and various architectures
    and gcc versions
  * Fix support for NIST curves P{192,224,521} and SM2 P256 and
    BNP648 that would not work;
  * Runtime filter elliptic curves (that OpenSSL does not support)
    and do not advertise those curves as capabilities
  * Removed unnecessary space in MANUFACTURER "IBM " -&gt; "IBM"</changelog>
  <changelog author="glin@suse.com" date="1606132800">- Update to version 0.7.4
  * Addressed potential constant-time related issues in TPM 1.2 and
    TPM 2 code
    TPM 1.2: RSA decryption
    TPM 2: EcSchnorr and EcSM2 signatures; Ecsda is handled by OpenSSL
  * Fixed some compilation issues</changelog>
  <changelog author="glin@suse.com" date="1616155200">- Update to version 0.7.7
  * CryptSym: fix AES output IV (bsc#1183729, CVE-2021-3446)
  * tpm2: Fix public key context save due to ANY_OBJECT_Marshal usage
  * tpm2: Address some Coverity issues (false positives)
  * tpm1.2: Backported ASAN/UBSAN related fixes
  * tpm2: Return properly sized array for b parameter for NIST P521
    (HLK)
  * tpm2: Addressed issues detected by UBSAN
  * tpm2: Addressed issues detected by cppcheck (false positives)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Update to version 0.8.2
  * NOTE: Downgrade to 0.7.x or below is not possible.
    Due to fixes in the TPM 2 prime number generation code in
    rev155 it is not possible to downgrade from libtpms version
    0.8.0 to some previous version. The seeds are now associated
    with an age so that older seeds use the old TPM 2 prime number
    generation code while newer seed use the newer code.
  * tpm2: rev155: Add new RsaAdjustPrimeCandidate code but do
    not use (bsc#1184939 CVE-2021-3505)
  * tpm2: Activate SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX
    (bsc#1184939 CVE-2021-3505)
  * Update to TPM 2 code release 159
  - X509 support is enabled
    + SM2 signing of ceritificates is NOT supported
  - Authenticated timers are disabled
  * Update to TPM 2 code relase 162
  - ECC encryption / decryption is disabled
  * Fix support for elliptic curve due to missing unmarshalling
    code
  * Runtime filter supported elliptic curves supported by OpenSSL
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rather than
    max
  * Fixes to symmetric decryption related to input size check,
    defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)]
    and to always use a temporary malloc'ed buffer for decryption
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest swtpm for test cases to succeed there.</changelog>
  <changelog author="pgajdos@suse.com" date="1630411200">- security update
- added patches
  fix CVE-2021-3746 [bsc#1189935], out-of-bounds access via specially crafted TPM 2 command packets
  + libtpms-CVE-2021-3746.patch</changelog>
  <changelog author="meissner@suse.com" date="1666353600">- Added patches:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch
- CVE-2021-3623: Fixed out-of-bounds access when trying to resume the
  state of the vTPM (bsc#1187767)</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
</package>
<package pkgid="3f5ecfba3a28cdfa8d9147a4d00cdfb5f479b741486569c7a55ca6193b464312" name="libtpms0" arch="x86_64">
  <version epoch="0" ver="0.8.2" rel="150300.3.6.1"/>
  <changelog author="p.drouand@gmail.com" date="1426939200">- Update to version 0.5.2
  * No entry for this release
- Update project home and download Urls
- Add autoconf, automake and libtool build require; the tarball
  comes from git and configure script has to be generated</changelog>
  <changelog author="vcizek@suse.com" date="1516190400">- Update to version 0.6.0-dev1
  * no upstream changelog
  * fix build with openssl 1.1 (bsc#1074801)
- fix rpm group</changelog>
  <changelog author="glin@suse.com" date="1548676800">- Update to version 0.6.0
  * Introduce TPM2 support
- Use %license tag for LICENSE</changelog>
  <changelog author="glin@suse.com" date="1567684800">- Update to version 0.7.0
  * fixes for TPM2
- Add gcc-c++ to BuildRequires</changelog>
  <changelog author="kai.liu@suse.com" date="1595505600">- Update to version 0.7.3
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest `swtpm` (master, stable branches) for test cases to
    succeed there.
- Changes since version 0.7.2
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rathern than
    max. possible
  * Fixes to symmetric decrytion related to input size check, defer
    padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and to
    always use a temporary malloc'ed buffer for decryption
- Changes since version 0.7.1
  * tpm2: Fix TDES key creation by adding missing un-/marshalling
    functions
  * tpm2: Fix a bug in CheckAuthSession
  * compilation fixes for TPM 1.2 &amp; TPM 2 and various architectures
    and gcc versions
  * Fix support for NIST curves P{192,224,521} and SM2 P256 and
    BNP648 that would not work;
  * Runtime filter elliptic curves (that OpenSSL does not support)
    and do not advertise those curves as capabilities
  * Removed unnecessary space in MANUFACTURER "IBM " -&gt; "IBM"</changelog>
  <changelog author="glin@suse.com" date="1606132800">- Update to version 0.7.4
  * Addressed potential constant-time related issues in TPM 1.2 and
    TPM 2 code
    TPM 1.2: RSA decryption
    TPM 2: EcSchnorr and EcSM2 signatures; Ecsda is handled by OpenSSL
  * Fixed some compilation issues</changelog>
  <changelog author="glin@suse.com" date="1616155200">- Update to version 0.7.7
  * CryptSym: fix AES output IV (bsc#1183729, CVE-2021-3446)
  * tpm2: Fix public key context save due to ANY_OBJECT_Marshal usage
  * tpm2: Address some Coverity issues (false positives)
  * tpm1.2: Backported ASAN/UBSAN related fixes
  * tpm2: Return properly sized array for b parameter for NIST P521
    (HLK)
  * tpm2: Addressed issues detected by UBSAN
  * tpm2: Addressed issues detected by cppcheck (false positives)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Update to version 0.8.2
  * NOTE: Downgrade to 0.7.x or below is not possible.
    Due to fixes in the TPM 2 prime number generation code in
    rev155 it is not possible to downgrade from libtpms version
    0.8.0 to some previous version. The seeds are now associated
    with an age so that older seeds use the old TPM 2 prime number
    generation code while newer seed use the newer code.
  * tpm2: rev155: Add new RsaAdjustPrimeCandidate code but do
    not use (bsc#1184939 CVE-2021-3505)
  * tpm2: Activate SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX
    (bsc#1184939 CVE-2021-3505)
  * Update to TPM 2 code release 159
  - X509 support is enabled
    + SM2 signing of ceritificates is NOT supported
  - Authenticated timers are disabled
  * Update to TPM 2 code relase 162
  - ECC encryption / decryption is disabled
  * Fix support for elliptic curve due to missing unmarshalling
    code
  * Runtime filter supported elliptic curves supported by OpenSSL
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rather than
    max
  * Fixes to symmetric decryption related to input size check,
    defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)]
    and to always use a temporary malloc'ed buffer for decryption
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest swtpm for test cases to succeed there.</changelog>
  <changelog author="pgajdos@suse.com" date="1630411200">- security update
- added patches
  fix CVE-2021-3746 [bsc#1189935], out-of-bounds access via specially crafted TPM 2 command packets
  + libtpms-CVE-2021-3746.patch</changelog>
  <changelog author="meissner@suse.com" date="1666353600">- Added patches:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch
- CVE-2021-3623: Fixed out-of-bounds access when trying to resume the
  state of the vTPM (bsc#1187767)</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
</package>
<package pkgid="6b98a0dd10e3a81a96c5e029d5de8f1586ccf8d6cecf4e09abe3f01c7756d2f3" name="libtukit4" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="4b813d0a9216562dab105cf619af75a0c9e326a311c2e2c9cf95603b3c9863a6" name="libtukit4" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="42ffebbf967417671b2bd3bd467135075d73e38a5cdc161b6efda7f0a1457ff7" name="libtukit4" arch="aarch64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="12747284098ea816edaf24bc7821bee26092f64f20c2d5d0697eeeb24153c0b8" name="libtukit4" arch="x86_64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="0c88c64476bf263682e944b0db3e155e874968164bf2a907b71a92af29696b6d" name="libudev1" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="ff0e3c624ace253887cbbe9fbe1be67e7fe69f605e6c8789b678dd9eeccbeda0" name="libudev1" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="7b6556194b2154b057214114b8cef0d03b2ea75fd512a7142014ac5eda9e0a0a" name="libudev1" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="ef74f48456ecd04d07f2845c702a0d10d0fd0c87ec94a9e0f3b2bc2d2ed3ec8c" name="libudev1" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="25f2c9e5b77a06887b4d5731e9b0e321a0dae7b01722432409a296b65dd35d58" name="libudev1" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="111bd903996dcd04a325f9a89cbbe3da9934e37ec29343e3a8093979a252f9a2" name="libudev1" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="c5a103a9223178059004d6ae00ec0885696860f3e3e6f88319006fb89c9c21fe" name="libudev1" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="5b1f1ad8aa9229f8eb930d875a51aa1ca162575e1d7c7b7bae307d937cefa4b7" name="libudev1" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="1b391ee810679a5ac474e6d2061ae9220ff333145e32fb8ec3282fcc99a24232" name="libuuid1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="cba7d4041b5da63ac9baca73b01ab4c29af9eb33346a652e1849155780fa4d35" name="libuuid1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="76520ad838fc1e5ab10f07f8caa3317dccea47e040e7bf3115b53edb4c6bc507" name="libuuid1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="54b3bd98c6c28aedb2360a88ab3f02da216edee799b6f2e2237dfbb6dc2dc42a" name="libuuid1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="a25aef8b107f1f4e5e7188f2df4a12c74dfd15eef4432db9fe41f0ab83fc536a" name="libuuid1" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="2d2297bc30a26ef9d060eac688f9597a7e4ba7725171bbb6fbc2ce93ce0ed871" name="libuuid1" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="0d7d82eb1e29e2cecb9d3b4aa6ca0577bb4aa66dfc92e7de48782dbe654c1490" name="libvirt" arch="src">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="39f45d91508373c832d1f7a5a46b551d0d5babffa61801afa70c9dfceac7e3fd" name="libvirt-client" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="03131868482a33cfe1cf76e222213f4caa7f0dc44554c82128bf071aa2a3250e" name="libvirt-client" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="9b93d386d74c537a3d9e5be8f910dec16153697d53bd19841daec019590e0268" name="libvirt-daemon" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="9f682ce95539980822a9f2c16225bf117f9a12b481a047565cfd507bf019da98" name="libvirt-daemon" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="9d4cfecbbf3fc6a1512a2750968fe6fa8e274c4188e79516c71a37634e50c395" name="libvirt-daemon-driver-interface" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="9ce010d8645c68ed0b3e45cb3a69dc2fdd268cd746d9a9acb81fbae719d91e63" name="libvirt-daemon-driver-interface" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="6010d4decc0203b08e3719723d6174b4cadf95271cf9d249320d1cefd7dab09a" name="libvirt-daemon-driver-network" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="dfdbe124c76236c29b8efbef4128b613cd39525b2f48f6d33333a4abbf56f64b" name="libvirt-daemon-driver-network" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="d49e06fb1c2f078dbe6dfdff2428bc6d3efa131cbacb45efd80a050eedc4ce3a" name="libvirt-daemon-driver-nodedev" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="701ff781d09ec3791eff47eef3f4a1c63103a6d69f54a5cb445e80dce1be7282" name="libvirt-daemon-driver-nodedev" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="69af42c34ce6f339872e81bea17614165b811a564e413233e8714b71e97cd242" name="libvirt-daemon-driver-nwfilter" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="b808ae95037973753788b39607bb1b28d399a365e3ec56956e9ad9fbcbbd2b9f" name="libvirt-daemon-driver-nwfilter" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="aa59ce6dd21e85890fc71f249703cdbf29541255c5cac7f426c44a157f666788" name="libvirt-daemon-driver-qemu" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="bedef7c0495f516687748b01b8959022d3347403163609ad896b3109c2e8b7c5" name="libvirt-daemon-driver-qemu" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="54858d388d42f64f0b1ee678921c7af6ae708f8700d9a15eb9be7adc3b16a000" name="libvirt-daemon-driver-secret" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="03bd12180fa4840b590fa14653e0c1ebad153ac84b2eba1df73ff322f6926651" name="libvirt-daemon-driver-secret" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="cc2703dc19d936506f9fff9c85f3bb101dc12c34cdbc01ca9118f9a65f4cc5ab" name="libvirt-daemon-driver-storage" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="a7fa284d19d7ea12d835b49766a8b5bb89812d6e356c8e79530ea98bf9d990a0" name="libvirt-daemon-driver-storage" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="6213b808080ab94d30370b8c4913dff7fab5d92a9080ee5a6af61c9f2ddb7470" name="libvirt-daemon-driver-storage-core" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="027add6308e5f52b22a23eca42890c4d3524567e999add3565a1f1a59c0b429e" name="libvirt-daemon-driver-storage-core" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="2fab62393457a3c8999ca1b281362604b68863d6f851ad56ee3c60eea2948834" name="libvirt-daemon-driver-storage-disk" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="d68afff0c124725794c599023cb249dfceeec2700ece9b56c65737e233e534cd" name="libvirt-daemon-driver-storage-disk" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="9cd3afc8c4aaa48395c25804da3c948c2f7697ca0b9754559d4e835da5b9c1ed" name="libvirt-daemon-driver-storage-iscsi" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="550d9fba79b608cd26b48ddd0f46e7b1ba8ef82106a040f5fe1cc2b19ea75b4f" name="libvirt-daemon-driver-storage-iscsi" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="0c6b5ad690cc92885c5ba099875d23033a05f8d52db1df7a8191d11637b56bea" name="libvirt-daemon-driver-storage-iscsi-direct" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="7d4b49729c9cb4ce037211ffbdc540a87fff6f54c3c910e397cd0d776ef81814" name="libvirt-daemon-driver-storage-iscsi-direct" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="5862f89afb05af9190f10cd6c24e32361eee2d386d6d3a2e3532f1f81625a4c2" name="libvirt-daemon-driver-storage-logical" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="30472aa79bb31952556188b7ac6d9953d44c246ed4007d1bd58cd31aa61691af" name="libvirt-daemon-driver-storage-logical" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="9157a5c1aa8043b696e634b9f1f37ccea7fa77754c2f440784c7abd7f72d04cf" name="libvirt-daemon-driver-storage-mpath" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="6ca9d9a1627716dfa08131df5a1c9e373c551efc13681f0f644a309600f8821c" name="libvirt-daemon-driver-storage-mpath" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="2ba3710ba7b0b97c2115ba2bec3606679ce37971649c5bf7d46b6f8a5a6e5ee4" name="libvirt-daemon-driver-storage-rbd" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="062730bb7c925d4a041f1989ce5b310db1fa0bc3a4e37a15ddd33b637b8d934f" name="libvirt-daemon-driver-storage-rbd" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="146512606dd970f18c6df55c19a31752dfbb4e70497554a472120c25ed35fbd3" name="libvirt-daemon-driver-storage-scsi" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="f460becf601b5ac09c60c658e2a29cbe695162c66d17d8d9d321749ed38aef29" name="libvirt-daemon-driver-storage-scsi" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="e1c357ffafdc15fec065ee7ab2057b7b365626e746dfe514e687b5378f075cae" name="libvirt-daemon-qemu" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="fd427c1dbaad97a2641b9123ae4866a7f6e1e033da136f4aa82ad597b972b220" name="libvirt-daemon-qemu" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="d75a90b9c4af4c7f975c0572a20500b7a22c3196f9f5b6a91792599c5ae56fc1" name="libvirt-libs" arch="aarch64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="40afb1fec74913efb0d55ff6e1e9dcbafa75c289e18fdbede44ae30e287f6ca9" name="libvirt-libs" arch="x86_64">
  <version epoch="0" ver="7.1.0" rel="150300.6.35.2"/>
  <changelog author="jfehlig@suse.com" date="1627560000">- storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath
  CVE-2021-3667
  447f69de-CVE-2021-3667.patch
  bsc#1188843</changelog>
  <changelog author="jfehlig@suse.com" date="1628683200">- supportconfig: When checking for installed hypervisor drivers,
  use the libvirtr-daemon-driver-&lt;hypervisor&gt; package instead of
  libvirt-daemon-&lt;hypervisor&gt;. The latter are not required packages
  for a functioning hypervisor driver.</changelog>
  <changelog author="jfehlig@suse.com" date="1630324800">- qemu: Set label on vhostuser net device when hotplugging
  2e8ebfe3-label-vhostuser-port.patch
  bsc#1186398</changelog>
  <changelog author="jfehlig@suse.com" date="1631620800">- libxl: Improve reporting of die_id in capabilities
  b75a16ae-libxl-improve-die-id.patch
  boo#1190493
- libxl: Fix driver reload
  65fab900-libxl-fix-driver-reload.patch,
  51eb680b-libxl-dont-autostart-on-reload.patch
  bsc#1190420</changelog>
  <changelog author="jfehlig@suse.com" date="1632398400">- spec: Fix hangs during package update
  bsc#1177902, bsc#1190693
- spec: Don't add --timeout arg to /etc/sysconfig/libvirtd when
  running in traditional mode without socket activation
  bsc#1190695</changelog>
  <changelog author="jfehlig@suse.com" date="1634299200">- qemu: Do not report eof when processing monitor IO
  2703b0b5-qemu-dont-report-eof.patch
  bsc#1190917</changelog>
  <changelog author="jfehlig@suse.com" date="1634558400">- supportconfig: Use systemctl command 'is-active' instead of
  'is-enabled' when checking if libvirtd is active</changelog>
  <changelog author="jfehlig@suse.com" date="1634731200">- lxc: controller: Fix container launch on cgroup v1
  1b9ce05c-lxc-fix-cgroupV1.patch
  boo#1183247</changelog>
  <changelog author="jfehlig@suse.com" date="1635249600">- Add upstream debug patch to the libxl driver to aid in future
  debugging
  27e1779f-libxl-debug.patch
- Include collection of active VM config files in the
  supportconfig plugin</changelog>
  <changelog author="jfehlig@suse.com" date="1638532800">- CVE-2021-4147: libxl: Fix libvirtd deadlocks and segfaults
  23b51d7b-libxl-disable-death-event.patch,
  a4e6fba0-libxl-rename-threadinfo-struct.patch,
  e4f7589a-libxl-shutdown-thread-name.patch,
  b9a5faea-libxl-handle-death-thread.patch,
  5c5df531-libxl-search-domid-in-thread.patch,
  a7a03324-libxl-protect-logger-access.patch
  bsc#1191668, bsc#1192017, bsc#1193981, bsc#1194041</changelog>
  <changelog author="jfehlig@suse.com" date="1639483200">- apparmor: Allow new capabilities required by libvirtd
  4f2811eb-apparmor-new-libvirtd-caps.patch
  bsc#1193719</changelog>
  <changelog author="jfehlig@suse.com" date="1639483201">- libxl: Implement domainGetMessages API
  cbae4eaa-libxl-add-domainGetMessages.patch
  bsc#1193623</changelog>
  <changelog author="jfehlig@suse.com" date="1643025600">- spec: Weaken apparmor-abstractions dependency to Recommends
  bsc#1192119, jsc#SLE-23394</changelog>
  <changelog author="jfehlig@suse.com" date="1643112000">- libxl: Add lock process indicator to saved VM state
  31e937fb-libxl-save-lock-indicator.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1644235200">- libxl: Mark auto-allocated graphics ports to used on reconnect
  e0241f33-libxl-mark-allocated-graphics-ports.patch
- libxl: Release all auto-allocated graphics ports
  18ec405a-libxl-release-graphics-ports.patch
  bsc#1191668</changelog>
  <changelog author="jfehlig@suse.com" date="1646308800">- qemu: Directly query KVM for TSC scaling support
  5df2c492-use-kvm-for-tsc-scaling.patch
  bsc#1193364</changelog>
  <changelog author="jfehlig@suse.com" date="1648555200">- CVE-2022-0897: nwfilter: fix crash when counting number of
  network filters
  a4947e8f-nwfilter-CVE-2022-0897.patch
  bsc#1197636</changelog>
  <changelog author="jfehlig@suse.com" date="1648728000">- qemu: Improve save operation by increasing pipe size
  c61d1e9b-virfile-set-pipe-size.patch,
  47d6d185-virfile-fix-indent.patch,
  cd7acb33-virfile-report-error.patch
  bsc#1196625</changelog>
  <changelog author="jfehlig@suse.com" date="1652788800">- qemu: Support memory allocation threads
  ba7f9812-conf-intro-mem-alloc-threads.patch,
  a30dac15-qemu-detect-prealloc-threads.patch,
  75a4e016-qemu-validate-prealloc-threads.patch,
  b8d6ecc7-qemu-generate-prealloc-threads.patch
  bsc#1197084</changelog>
  <changelog author="jfehlig@suse.com" date="1661342400">- spec: Include aarch64 in the list of architectures that 'Require'
  dmidecode
  bsc#1202608</changelog>
</package>
<package pkgid="d7783b931751b4f9502cc192609d8c1437a08f969e2ac443caea2778db81c0bb" name="libvmtools0" arch="x86_64">
  <version epoch="0" ver="12.1.0" rel="150300.19.1"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="80e694c9dcc8f03f9b1a2c64effae79ce04c43f43d8a9b875d60dbee4297ab1f" name="libvmtools0" arch="x86_64">
  <version epoch="0" ver="12.1.0" rel="150300.21.2"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="af5cfdaa66d572b410d3b9ad33e03565b14fa9e415c8c99d0ee0c212b4da1c9c" name="libxcrypt" arch="src">
  <version epoch="0" ver="4.4.15" rel="150300.4.4.3"/>
  <changelog author="schwab@suse.de" date="1525867200">- ABI compatible replacement for libcypt from glibc</changelog>
  <changelog author="schwab@suse.de" date="1527076800">- Update to libxcrypt 4.0.1</changelog>
  <changelog author="schwab@suse.de" date="1533124800">- Update to libxcrypt 4.1.0
  * Fix spelling of SUSE.
  * Lower the minimum required automake version to 1.14.
  * Fix build with USE_SWAPCONTEXT turned off.
  * Extend --enable-weak-hashes configure option to accept optional
    "glibc" parameter.
  * Fix the leak of obtained random bytes.
  * Check expected output strings for deterministic methods.
  * Fix memory leak in crypt_sha1_rn.
  * Fix read of random bytes out of bounds in gensalt_sha1_rn.
  * Make it possible to disable individual hashes at configure time.
  * Make salt validation pickier.
  * Replace crypt-sunmd5.c with BSD-licensed cleanroom reimplementation.
  * Make crypt_gensalt for $sha1 deterministic.
  * Fix incorrect output-size computation in crypt_sha1_rn.
  * Add docs for SHA1, MD5/Sun, NTHASH.
  * Introduce CRYPT_GENSALT_IMPLEMENTS_* feature test macros.
  * Install libcrypt.pc symlink along with libxcrypt.pc.
  * Extend --enable-obsolete-api configure option.
  * Extend overall test coverage.</changelog>
  <changelog author="jengelh@inai.de" date="1533556800">- Fix RPM groups for Factory.</changelog>
  <changelog author="schwab@suse.de" date="1533729600">- Add conflicts with glibc-devel &lt; 2.28</changelog>
  <changelog author="schwab@suse.de" date="1539086400">- Set compatibility level to suse</changelog>
  <changelog author="mliska@suse.cz" date="1550145600">- Update to version 4.4.3:
  * Add libxcrypt.so, libxcrypt.a and xcrypt.h.
  * Add new man3 manual pages.</changelog>
  <changelog author="schwab@suse.de" date="1550577600">- format-overflow.patch: Fix -Werror=format-overflow</changelog>
  <changelog author="mliska@suse.cz" date="1561032000">- Disable LTO due to symbol versioning (boo#1138833).</changelog>
  <changelog author="schwab@suse.de" date="1575720000">- Update to version 4.4.10
  * Fix alignment problem for GOST 34.11 (Streebog) in gost-yestcrypt.
  * The crypt_* functions will now all fail and set errno to ERANGE if
    their 'phrase' argument is longer than CRYPT_MAX_PASSPHRASE_SIZE
    characters (this is currently 512)
  * The NT hashing method no longer truncates passphrases at 128
    characters; Windows does not do this.
- format-overflow.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1576152000">- gcc10.patch: fix build with gcc10 (bsc#1158192)</changelog>
  <changelog author="schwab@suse.de" date="1579694400">- Update to version 4.4.11
  * Fixes for GCC v10.x
  * Change how the known-answer tests are parallelized
- gcc10.patch: remove</changelog>
  <changelog author="schwab@suse.de" date="1580385600">- Update to version 4.4.12
  * Another fix for GCC v10.x, which occurs on s390 architectures only.</changelog>
  <changelog author="schwab@suse.de" date="1583150400">- Update to version 4.4.15
  * The compatibility symbols crypt_gensalt_r, xcrypt, xcrypt_r,
    xcrypt_gensalt, and xcrypt_gensalt_r are deprecated further
  * Speed up ka-sunmd5 by skipping most of the test phrases
- Package README.md and TODO.md (bsc#1165389)</changelog>
  <changelog author="schwab@suse.de" date="1598961600">- Add compatibility provides for SLE15</changelog>
  <changelog author="dmueller@suse.com" date="1612612800">- add compatibility provides for Step 15 as well (bsc#1181571)</changelog>
</package>
<package pkgid="343b5e5ca4ee5e76fc5a61da2bb33555c7b733361ba3ffa11ecdfc418893c6a7" name="libxml2-2" arch="aarch64">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="0a6aacac172cf8beb23e846ed7fe1557f4cdbd30bf45beace9b6d4e6415c6caa" name="libxml2-2" arch="x86_64">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="8f69fd84229c7cc9679bb006f988e1a768a4e0a8a2f73b6c6a862a2fdb6b96ed" name="libxml2-2" arch="aarch64">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="957cb9491e5f534c8f28fe71c9569ed5fcc67b83be6723bc73c693b0e99b255b" name="libxml2-2" arch="x86_64">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="7a914fa4f144047dd8dedf2eef2b0c3ddeaca567fbb86dfb6d5c672cb9ece62f" name="libxml2" arch="src">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="faf1cc6a1371d5c49d78fe5efa1f8780d0d8e732fd6de8d2f72c0a61570a0cec" name="libxml2" arch="src">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="baf74afb2ca0313462d4e5c1b8f30e42c41df90226595afa95708167c4c9d9da" name="libxml2-tools" arch="aarch64">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="5c8307c4164fbe46faf534da88e63e4d438de1e44db98f36e7437618de9945a1" name="libxml2-tools" arch="x86_64">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="7e3e4bc5d23155cdc8898a68b86af00dbf9948a6d38849a08d21a4067940ba7b" name="libxml2-tools" arch="aarch64">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="ee4b8faffc823b319458c4ea54e27d74fd9760878dca70c64530cbcea8b11d0a" name="libxml2-tools" arch="x86_64">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
  * Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
  * Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="david.anes@suse.com" date="1651579200">- Security fix: [bsc#1199132, CVE-2022-29824]
  * Integer overflow leading to out-of-bounds write in buf.c
    (xmlBuf*) and tree.c (xmlBuffer*)
  * Add libxml2-CVE-2022-29824.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
</package>
<package pkgid="b96390d2180071b4f4a11540c9f5455ab60a0627bfe721c6b4174bf66e2662ce" name="libxmlsec1-1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.11.1"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="d8511cd50c877ccc04de7e2b41481a3039dffbf7835913e6fc232cafedbe8928" name="libxmlsec1-openssl1" arch="x86_64">
  <version epoch="0" ver="1.2.28" rel="150100.7.11.1"/>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="c68ceb5a128c4bbbe825e7420390612a5c0498b86bb10df964a9218206ca0444" name="libxslt" arch="src">
  <version epoch="0" ver="1.1.32" rel="150000.3.11.1"/>
  <changelog author="jengelh@medozas.de" date="1325678400">- Remove redundant tags (License: field is inherited)
- Use exact EVR for Provides:</changelog>
  <changelog author="jengelh@medozas.de" date="1331985600">- Make sure to follow shlib policy; put tools in a separate package
  like done in libxml2</changelog>
  <changelog author="chris@computersalat.de" date="1335355200">- add macro "soname" %{name}1
- fix "self obsoletion"</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1354795200">- update to 1.1.28:
  * fix generate-id() to avoid generating the same ID
  * fix crash with empty xsl:key/@match attribute
  * fix crash when passing an uninitialized variable to document()
  * fix regression: default namespace not correctly used
  * remove xsltTransStorageAdd and xsltTransStorageRemove from symbols.xml
- changes from 1.1.27:
  * link python module with python library (Frederic Crozat)
  * report errors on variable use in key
  * the XSLT namespace string is a constant one
  * fix handling of names in xsl:attribute
  * reserved namespaces in xsl:element and xsl:attribute
  * null-terminate result string of cry:rc4_decrypt
  * EXSLT date normalization fix
  * exit after compilation of invalid func:result
  * fix for EXSLT func:function
  * rewrite EXSLT string:replace to be conformant
  * avoid a heap use after free error
  * fix a dictionary string usage
  * output should not include extraneous newlines when indent is off
  * document('') fails to return stylesheets parsed from memory
  * xsltproc should return an error code if xinclude fails
  * forwards-compatible processing of unknown top level elements
  * fix system-property with unknown namespace
  * fix default template processing on namespace nodes
  * fix a bug in selecting XSLT elements
  * fix a memory leak with xsl:number
  * fix a problem with ESXLT date:add() with January
  * fix generate-id() to not expose object addresses
  * allow whitespace in xsl:variable with select
  * fix direct pattern matching bug
  * add the saxon:systemId extension
  * add an append mode to document output
  * fix portability to upcoming libxml2-2.9.0
  * precompile patterns in xsl:number
- change soname macro back to "1" and enforce it in the files list
- revert -tools subpackage for openSUSE &lt; 12.2 as that has only
  become effective since 12.2 on the package that ships with the
  distribution, to avoid having a completely different package
  layout in this repository as compared to the stock distribution
  packages (added a Provides: libxslt-tools though)</changelog>
  <changelog author="coolo@suse.com" date="1422792000">- add 0009-Make-generate-id-deterministic.patch from debian's
  reproducible builds project to avoid randomness in generated IDs</changelog>
  <changelog author="suse@microstep-mis.com" date="1428580800">- fix package with "soname" should obsolete libxslt package on suse &lt; 12.2 (SLE11)</changelog>
  <changelog author="kstreitova@suse.com" date="1463745600">- add libxslt-1.1.28-type_confusion_preprocess_attr.patch to fix
  type confusion in preprocessing attributes [bnc#952474],
  [CVE-2015-7995]</changelog>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Fix broken license symlink for libxslt-tools [bsc#1203669]</changelog>
</package>
<package pkgid="b0812216d3a34d79e3933c1ab1109f6c2291e6d2ed085143a037d11d543f3d90" name="libxslt" arch="src">
  <version epoch="0" ver="1.1.32" rel="150000.3.14.1"/>
  <changelog author="jengelh@medozas.de" date="1331985600">- Make sure to follow shlib policy; put tools in a separate package
  like done in libxml2</changelog>
  <changelog author="chris@computersalat.de" date="1335355200">- add macro "soname" %{name}1
- fix "self obsoletion"</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1354795200">- update to 1.1.28:
  * fix generate-id() to avoid generating the same ID
  * fix crash with empty xsl:key/@match attribute
  * fix crash when passing an uninitialized variable to document()
  * fix regression: default namespace not correctly used
  * remove xsltTransStorageAdd and xsltTransStorageRemove from symbols.xml
- changes from 1.1.27:
  * link python module with python library (Frederic Crozat)
  * report errors on variable use in key
  * the XSLT namespace string is a constant one
  * fix handling of names in xsl:attribute
  * reserved namespaces in xsl:element and xsl:attribute
  * null-terminate result string of cry:rc4_decrypt
  * EXSLT date normalization fix
  * exit after compilation of invalid func:result
  * fix for EXSLT func:function
  * rewrite EXSLT string:replace to be conformant
  * avoid a heap use after free error
  * fix a dictionary string usage
  * output should not include extraneous newlines when indent is off
  * document('') fails to return stylesheets parsed from memory
  * xsltproc should return an error code if xinclude fails
  * forwards-compatible processing of unknown top level elements
  * fix system-property with unknown namespace
  * fix default template processing on namespace nodes
  * fix a bug in selecting XSLT elements
  * fix a memory leak with xsl:number
  * fix a problem with ESXLT date:add() with January
  * fix generate-id() to not expose object addresses
  * allow whitespace in xsl:variable with select
  * fix direct pattern matching bug
  * add the saxon:systemId extension
  * add an append mode to document output
  * fix portability to upcoming libxml2-2.9.0
  * precompile patterns in xsl:number
- change soname macro back to "1" and enforce it in the files list
- revert -tools subpackage for openSUSE &lt; 12.2 as that has only
  become effective since 12.2 on the package that ships with the
  distribution, to avoid having a completely different package
  layout in this repository as compared to the stock distribution
  packages (added a Provides: libxslt-tools though)</changelog>
  <changelog author="coolo@suse.com" date="1422792000">- add 0009-Make-generate-id-deterministic.patch from debian's
  reproducible builds project to avoid randomness in generated IDs</changelog>
  <changelog author="suse@microstep-mis.com" date="1428580800">- fix package with "soname" should obsolete libxslt package on suse &lt; 12.2 (SLE11)</changelog>
  <changelog author="kstreitova@suse.com" date="1463745600">- add libxslt-1.1.28-type_confusion_preprocess_attr.patch to fix
  type confusion in preprocessing attributes [bnc#952474],
  [CVE-2015-7995]</changelog>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Fix broken license symlink for libxslt-tools [bsc#1203669]</changelog>
  <changelog author="pmonreal@suse.com" date="1677067200">- Security Fix: [bsc#1208574, CVE-2021-30560]
  * Use after free in Blink XSLT
  * Add libxslt-CVE-2021-30560.patch</changelog>
</package>
<package pkgid="3ebc370545bc94e1dcab09289e7b06b3ced7873934e1c4bba07f6bb04bfee2c3" name="libxslt1" arch="aarch64">
  <version epoch="0" ver="1.1.32" rel="150000.3.11.1"/>
  <changelog author="coolo@suse.com" date="1422792000">- add 0009-Make-generate-id-deterministic.patch from debian's
  reproducible builds project to avoid randomness in generated IDs</changelog>
  <changelog author="suse@microstep-mis.com" date="1428580800">- fix package with "soname" should obsolete libxslt package on suse &lt; 12.2 (SLE11)</changelog>
  <changelog author="kstreitova@suse.com" date="1463745600">- add libxslt-1.1.28-type_confusion_preprocess_attr.patch to fix
  type confusion in preprocessing attributes [bnc#952474],
  [CVE-2015-7995]</changelog>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Fix broken license symlink for libxslt-tools [bsc#1203669]</changelog>
</package>
<package pkgid="77176a043f8b1e3b794b34494d92753ac235679540b1428ca8fdf142e3996b85" name="libxslt1" arch="x86_64">
  <version epoch="0" ver="1.1.32" rel="150000.3.11.1"/>
  <changelog author="coolo@suse.com" date="1422792000">- add 0009-Make-generate-id-deterministic.patch from debian's
  reproducible builds project to avoid randomness in generated IDs</changelog>
  <changelog author="suse@microstep-mis.com" date="1428580800">- fix package with "soname" should obsolete libxslt package on suse &lt; 12.2 (SLE11)</changelog>
  <changelog author="kstreitova@suse.com" date="1463745600">- add libxslt-1.1.28-type_confusion_preprocess_attr.patch to fix
  type confusion in preprocessing attributes [bnc#952474],
  [CVE-2015-7995]</changelog>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Fix broken license symlink for libxslt-tools [bsc#1203669]</changelog>
</package>
<package pkgid="d5531e637d58440c4c4c739f84aa07c51b8a17d7b767aa31365c20993983e076" name="libxslt1" arch="aarch64">
  <version epoch="0" ver="1.1.32" rel="150000.3.14.1"/>
  <changelog author="coolo@suse.com" date="1422792000">- add 0009-Make-generate-id-deterministic.patch from debian's
  reproducible builds project to avoid randomness in generated IDs</changelog>
  <changelog author="suse@microstep-mis.com" date="1428580800">- fix package with "soname" should obsolete libxslt package on suse &lt; 12.2 (SLE11)</changelog>
  <changelog author="kstreitova@suse.com" date="1463745600">- add libxslt-1.1.28-type_confusion_preprocess_attr.patch to fix
  type confusion in preprocessing attributes [bnc#952474],
  [CVE-2015-7995]</changelog>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Fix broken license symlink for libxslt-tools [bsc#1203669]</changelog>
  <changelog author="pmonreal@suse.com" date="1677067200">- Security Fix: [bsc#1208574, CVE-2021-30560]
  * Use after free in Blink XSLT
  * Add libxslt-CVE-2021-30560.patch</changelog>
</package>
<package pkgid="344dc75ea15d93963ea60026f85c3c5bb44edcbe138bfc2ef5058f08fbabaeb0" name="libxslt1" arch="x86_64">
  <version epoch="0" ver="1.1.32" rel="150000.3.14.1"/>
  <changelog author="coolo@suse.com" date="1422792000">- add 0009-Make-generate-id-deterministic.patch from debian's
  reproducible builds project to avoid randomness in generated IDs</changelog>
  <changelog author="suse@microstep-mis.com" date="1428580800">- fix package with "soname" should obsolete libxslt package on suse &lt; 12.2 (SLE11)</changelog>
  <changelog author="kstreitova@suse.com" date="1463745600">- add libxslt-1.1.28-type_confusion_preprocess_attr.patch to fix
  type confusion in preprocessing attributes [bnc#952474],
  [CVE-2015-7995]</changelog>
  <changelog author="tchvatal@suse.com" date="1465646400">- Update to 1.1.29:
  * new release after 4 years with few bugfies all around
- Refresh patch 0009-Make-generate-id-deterministic.patch to apply
- Remove cve patch that was integrated upstream:
  libxslt-1.1.28-type_confusion_preprocess_attr.patch
- Unpack the manpage as the compression is set by buildbot not always gz</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1489406400">- Added patch libxslt-CVE-2016-4738.patch
  * Fix heap overread in xsltFormatNumberConversion: An empty
    decimal-separator could cause a heap overread. This can be
    exploited to leak a couple of bytes after the buffer that holds
    the pattern string.
  * bsc#1005591 CVE-2016-4738</changelog>
  <changelog author="pgajdos@suse.com" date="1491393600">- security update: initialize random generator, CVE-2015-9019
  [bsc#934119]
  + libxslt-random-seed.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493121600">- Fixed CVE-2017-5029 bcs#1035905
  * Limit buffer size in xsltAddTextString to INT_MAX
- Added patch libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1501243200">- Add gpg signature
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Fix RPM groups. Drop ineffective --with-pic.
  Trim conjecture from description.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1508414400">- Update to version 1.1.30 [bsc#1063934]
  * Documentation:
  - Misc doc fixes
  * Portability:
  - Look for libxml2 via pkg-config first
  * Bug Fixes:
  - Also fix memory hazards in exsltFuncResultElem
  - Fix NULL deref in xsltDefaultSortFunction
  - Fix memory hazards in exsltFuncFunctionFunction
  - Fix memory leaks in EXSLT error paths
  - Fix memory leak in str:concat with empty node-set
  - Fix memory leaks in error paths
  - Switch to xmlUTF8Strsize in numbers.c
  - Fix NULL pointer deref in xsltFormatNumberFunction
  - Fix UTF-8 check in str:padding
  - Fix xmlStrPrintf argument
  - Check for overflow in _exsltDateParseGYear
  - Fix double to int conversion
  - Check for overflow in exsltDateParseDuration
  - Change version of xsltMaxVars back to 1.0.24
  - Disable xsltCopyTextString optimization for extensions
  - Create DOCTYPE for HTML version 5
  - Make xsl:decimal-format work with namespaces
  - Remove norm:localTime extension function
  - Check for integer overflow in xsltAddTextString
  - Detect infinite recursion when evaluating function arguments
  - Fix memory leak in xsltElementAvailableFunction
  - Fix for pattern predicates calling functions
  - Fix cmd.exe invocations in Makefile.mingw
  - Don't try to install index.sgml
  - Fix symbols.xml
  - Fix heap overread in xsltFormatNumberConversion
  - Fix &lt;xsl:number level="any"/&gt; for non-element nodes
  - Fix unreachable code in xsltAddChild
  - Change version number in xsl:version warning
  - Avoid infinite recursion after failed param evaluation
  - Stop if potential recursion is detected
  - Consider built-in templates in apply-imports
  - Fix precedence with multiple attribute sets
  - Rework attribute set resolution
  * Improvements:
  - Silence tests a little
  - Set LIBXML_SRC to absolute path
  - Add missing #include
  - Adjust expected error messages in tests
  - Make xsltDebug more quiet
  - New-line terminate error message that missed this convention
  - Use xmlBuffers in EXSLT string functions
  - Switch to xmlUTF8Strsize in EXSLT string functions
  - Check for return value of xmlUTF8Strlen
  - Avoid double/long round trip in FORMAT_ITEM
  - Separate date and duration structs
  - Check for overflow in _exsltDateDifference
  - Clamp seconds field of durations
  - Change _exsltDateAddDurCalc parameter types
  - Fix date:difference with time zones
  - Rework division/remainder arithmetic in date.c
  - Remove exsltDateCastDateToNumber
  - Change internal representation of years
  - Optimize IS_LEAP
  - Link libraries with libm
  - Rename xsltCopyTreeInternal to xsltCopyTree
  - Update linker version script
  - Add local wildcard to version script
  - Make some symbols static
  - Remove redundant NULL check in xsltNumberComp
  - Fix forwards compatibility for imported stylesheets
  - Reduce warnings in forwards-compatible mode
  - Precompute XSLT elements after preprocessing
  - Fix whitespace in xsltParseStylesheetTop
  - Consolidate recursion checks
  - Treat XSLT_STATE_STOPPED same as errors
  - Make sure that XSLT_STATE_STOPPED isn't overwritten
  - Add comment regarding built-in templates and params
  - Rewrite memory management of local RVTs
  - Validate QNames of attribute sets
  - Add xsl:attribute-set regression tests
  - Ignore imported stylesheets in xsltApplyAttributeSet
- Dropped patches fixed upstream
  * libxslt-CVE-2016-4738.patch
  * libxslt-1.1.28-CVE-2017-5029.patch</changelog>
  <changelog author="vcizek@suse.com" date="1510142400">- Update to version 1.1.32
  * fixes xml-config detection regression (boo#1066525)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554984000">- Security fix: [bsc#1132160, CVE-2019-11068]
  * Bypass of a protection mechanism because callers of xsltCheckRead
    and xsltCheckWrite permit access even upon receiving a -1 error
    code. xsltCheckRead can return -1 for a crafted URL that is not
    actually invalid and is subsequently loaded.
  * Added libxslt-CVE-2019-11068.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068800">- Security fix: [bsc#1140095, CVE-2019-13117]
  * Fix uninitialized read of xsl:number token. An xsl number with
    certain format strings could lead to a uninitialized read in
    xsltNumberFormatInsertNumbers
  * Added libxslt-CVE-2019-13117.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562068801">- Security fix: [bsc#1140101, CVE-2019-13118]
  * Fix uninitialized read with UTF-8 grouping chars. Read of
    uninitialized stack data due to too narrow xsl:number
    instruction and an invalid character
  * Added libxslt-CVE-2019-13118.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571659200">- Security fix [bsc#1154609, CVE-2019-18197]
  * Fix dangling pointer in xsltCopyText
  * Add libxslt-CVE-2019-18197.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668081600">- Fix broken license symlink for libxslt-tools [bsc#1203669]</changelog>
  <changelog author="pmonreal@suse.com" date="1677067200">- Security Fix: [bsc#1208574, CVE-2021-30560]
  * Use after free in Blink XSLT
  * Add libxslt-CVE-2021-30560.patch</changelog>
</package>
<package pkgid="11449582eae99cdb9b6281448965973825629ed2d228a0a784361db5bb5d46f5" name="libyajl" arch="src">
  <version epoch="0" ver="2.1.0" rel="150000.4.3.1"/>
  <changelog author="pascal.bleser@opensuse.org" date="1278936000">- initial package (1.0.9)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1291204800">- update to 1.0.11: no user-visible changes
- changes from 1.0.10:
  * yajl version number now programatically accessible</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1292932800">- merge yajl package from darix:
  * lib -&gt; LIBDIR patch
  * -devel-static subpackage</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1297252800">- fix license, changed from erroneous BSD3c to MIT, as stated on
  http://pyyaml.org/wiki/LibYAML, sort of fixes bnc#670525</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1297252801">- revert last change, it is BSD3c indeed, and totally unrelated to
  bnc#670525</changelog>
  <changelog author="coolo@novell.com" date="1302264000">- add baselibs.conf for 32bit library support</changelog>
  <changelog author="jfehlig@novell.com" date="1302696000">- Add filters to rpmlintrc
- spec file: Document githash usage in tarbal name</changelog>
  <changelog author="jfehlig@novell.com" date="1302696001">- Add filters to rpmlintrc
- spec file: Document githash usage in tarbal name</changelog>
  <changelog author="jfehlig@novell.com" date="1307016000">- Add man pages for json_{reformat,verify}</changelog>
  <changelog author="mrueckert@suse.de" date="1313150400">- update to 2.0.1
  - lth generator flag to allow client to specify they want escaped
    solidi '/'.  issue #28
  - lth crash fix when yajl_parse() is never called. issue #27
- additional changes from 2.0.0
  - lth YAJL is now ISC licensed:
    http://en.wikipedia.org/wiki/ISC_license
  - lth 20-35% (osx and linux respectively) parsing performance
    improvement attained by tweaking string scanning (idea:
    @michaelrhanson).
  - Florian Forster &amp; lth - yajl_tree interface introduced as a
    higher level interface to the parser (eats JSON, poops a memory
    representation)
  - lth require a C99 compiler
  - lth integers are now represented with long long (64bit+) on all
    platforms.
  - lth size_t now used throughout to represent buffer lengths, so
    you can safely manage buffers greater than 4GB.
  - gno semantic improvements to yajl's API regarding partial value
    parsing and trailing garbage
  - lth new configuration mechanism for yajl, see yajl_config() and
    yajl_gen_config()
  - gno more allocation checking in more places
  - gno remove usage of strtol, replace with custom implementation
    that cares not about your locale.
  - lth yajl_parse_complete renamed to yajl_complete_parse.
  - lth add a switch to validate utf8 strings as they are
    generated.
  - lth tests are a lot quieter in their output.
  - lth addition of a little in tree performance benchmark,
    `perftest` in perf/perftest.c
- additional changes from 1.0.12
  - Conrad Irwin - Parse null bytes correctly
  - Mirek Rusin - fix LLVM warnings
  - gno - Don't generate numbers for keys. closes #13
  - lth - various win32 fixes, including build documentation
    improvements
  - John Stamp - Don't export private symbols.
  - John Stamp - Install yajl_version.h, not the template.
  - John Stamp - Don't use -fPIC for static lib.  Cmake will
    automatically add it for the shared.
  - lth 0 fix paths embedded in dylib upon installation on osx.
    closes #11
- refreshed optflags patch</changelog>
  <changelog author="mrueckert@suse.de" date="1313496000">- bump baselibs.conf</changelog>
  <changelog author="jengelh@medozas.de" date="1316174400">- Add libyajl-devel to baselibs</changelog>
  <changelog author="jengelh@medozas.de" date="1327838400">- Remove redundant tags/sections per specfile guideline suggestions</changelog>
  <changelog author="ku.b@gmx.de" date="1415188800">- update to 2.1.0
- 2.1.0
  - @nonodename, @patperry - fixed some compiler warnings
  - @yep, @emaste - documentation improvements
  - @sgravrock - build fix for NetBSD (and whenever sh != bash)
  - @rotty, @brimstone3, @lloyd - allow client to reset generator
  - @sgravrock - remove bash dependencies
  - @lloyd - add api tests
  - @rflynn - remove ruby dependency
  - @cloderic - nmake install works on windows
  - @shahbag - build fix for qnx
  - @breese - debugging improvements
  - @lloyd - json_verify supports -s flag for stream processing
  - @lloyd - json_reformat supports -s flag for stream processing
- 2.0.4
  - @jcekstrom - additional checking in integer parsing
  - @jcekstrom - fix a bug in yajl_tree that would cause valid json integersto fail to parse
  - @plaguemorin - fix a memory leak in yajl_tree (error strings were being leaked)
  - @7AC - reset errno
  - @ConradIrwin - include flags to reformatter to allow toggling of escape solidus option
- 2.0.3
  - John Stamp generation of a pkgconfig file at build time.
  - @robzuber bugfix in yajl_tree_get()
  - @lloyd - fix for compilation on 64 bit windows
- 2.0.2
  - lth fix typos in yajl_tree.h macros YAJL_IS_INTEGER and YAJL_IS_DOUBLE,
    contributed by Artem S Vybornov.
  - lth add #ifdef __cplusplus wrappers to yajl_tree to allow proper
    usage from many populer C++ compilers.
- fix array access</changelog>
  <changelog author="mpluskal@suse.com" date="1430049600">- Use correct url for download
- Add dependency on doxygen for doc generation
- Cleanup spec file with spec-clener</changelog>
  <changelog author="kukuk@suse.de" date="1522152000">- Use %license instead of %doc [bsc#1082318]
- Move other docu to -devel package where it better fits</changelog>
  <changelog author="jtomasiak@suse.com" date="1652443200">- add libyajl-CVE-2022-24795.patch (CVE-2022-24795, bsc#1198405)</changelog>
</package>
<package pkgid="5c7350c6f2839a40fc8e4e97b0d4abaec1198fb187362015063adbd1438e50b9" name="libyajl2" arch="aarch64">
  <version epoch="0" ver="2.1.0" rel="150000.4.3.1"/>
  <changelog author="jfehlig@novell.com" date="1302696000">- Add filters to rpmlintrc
- spec file: Document githash usage in tarbal name</changelog>
  <changelog author="jfehlig@novell.com" date="1307016000">- Add man pages for json_{reformat,verify}</changelog>
  <changelog author="mrueckert@suse.de" date="1313150400">- update to 2.0.1
  - lth generator flag to allow client to specify they want escaped
    solidi '/'.  issue #28
  - lth crash fix when yajl_parse() is never called. issue #27
- additional changes from 2.0.0
  - lth YAJL is now ISC licensed:
    http://en.wikipedia.org/wiki/ISC_license
  - lth 20-35% (osx and linux respectively) parsing performance
    improvement attained by tweaking string scanning (idea:
    @michaelrhanson).
  - Florian Forster &amp; lth - yajl_tree interface introduced as a
    higher level interface to the parser (eats JSON, poops a memory
    representation)
  - lth require a C99 compiler
  - lth integers are now represented with long long (64bit+) on all
    platforms.
  - lth size_t now used throughout to represent buffer lengths, so
    you can safely manage buffers greater than 4GB.
  - gno semantic improvements to yajl's API regarding partial value
    parsing and trailing garbage
  - lth new configuration mechanism for yajl, see yajl_config() and
    yajl_gen_config()
  - gno more allocation checking in more places
  - gno remove usage of strtol, replace with custom implementation
    that cares not about your locale.
  - lth yajl_parse_complete renamed to yajl_complete_parse.
  - lth add a switch to validate utf8 strings as they are
    generated.
  - lth tests are a lot quieter in their output.
  - lth addition of a little in tree performance benchmark,
    `perftest` in perf/perftest.c
- additional changes from 1.0.12
  - Conrad Irwin - Parse null bytes correctly
  - Mirek Rusin - fix LLVM warnings
  - gno - Don't generate numbers for keys. closes #13
  - lth - various win32 fixes, including build documentation
    improvements
  - John Stamp - Don't export private symbols.
  - John Stamp - Install yajl_version.h, not the template.
  - John Stamp - Don't use -fPIC for static lib.  Cmake will
    automatically add it for the shared.
  - lth 0 fix paths embedded in dylib upon installation on osx.
    closes #11
- refreshed optflags patch</changelog>
  <changelog author="mrueckert@suse.de" date="1313496000">- bump baselibs.conf</changelog>
  <changelog author="jengelh@medozas.de" date="1316174400">- Add libyajl-devel to baselibs</changelog>
  <changelog author="jengelh@medozas.de" date="1327838400">- Remove redundant tags/sections per specfile guideline suggestions</changelog>
  <changelog author="ku.b@gmx.de" date="1415188800">- update to 2.1.0
- 2.1.0
  - @nonodename, @patperry - fixed some compiler warnings
  - @yep, @emaste - documentation improvements
  - @sgravrock - build fix for NetBSD (and whenever sh != bash)
  - @rotty, @brimstone3, @lloyd - allow client to reset generator
  - @sgravrock - remove bash dependencies
  - @lloyd - add api tests
  - @rflynn - remove ruby dependency
  - @cloderic - nmake install works on windows
  - @shahbag - build fix for qnx
  - @breese - debugging improvements
  - @lloyd - json_verify supports -s flag for stream processing
  - @lloyd - json_reformat supports -s flag for stream processing
- 2.0.4
  - @jcekstrom - additional checking in integer parsing
  - @jcekstrom - fix a bug in yajl_tree that would cause valid json integersto fail to parse
  - @plaguemorin - fix a memory leak in yajl_tree (error strings were being leaked)
  - @7AC - reset errno
  - @ConradIrwin - include flags to reformatter to allow toggling of escape solidus option
- 2.0.3
  - John Stamp generation of a pkgconfig file at build time.
  - @robzuber bugfix in yajl_tree_get()
  - @lloyd - fix for compilation on 64 bit windows
- 2.0.2
  - lth fix typos in yajl_tree.h macros YAJL_IS_INTEGER and YAJL_IS_DOUBLE,
    contributed by Artem S Vybornov.
  - lth add #ifdef __cplusplus wrappers to yajl_tree to allow proper
    usage from many populer C++ compilers.
- fix array access</changelog>
  <changelog author="mpluskal@suse.com" date="1430049600">- Use correct url for download
- Add dependency on doxygen for doc generation
- Cleanup spec file with spec-clener</changelog>
  <changelog author="kukuk@suse.de" date="1522152000">- Use %license instead of %doc [bsc#1082318]
- Move other docu to -devel package where it better fits</changelog>
  <changelog author="jtomasiak@suse.com" date="1652443200">- add libyajl-CVE-2022-24795.patch (CVE-2022-24795, bsc#1198405)</changelog>
</package>
<package pkgid="81da4a49f273e2b0ba29e286b2e760780041361efb5678c897734545d1921f02" name="libyajl2" arch="x86_64">
  <version epoch="0" ver="2.1.0" rel="150000.4.3.1"/>
  <changelog author="jfehlig@novell.com" date="1302696000">- Add filters to rpmlintrc
- spec file: Document githash usage in tarbal name</changelog>
  <changelog author="jfehlig@novell.com" date="1307016000">- Add man pages for json_{reformat,verify}</changelog>
  <changelog author="mrueckert@suse.de" date="1313150400">- update to 2.0.1
  - lth generator flag to allow client to specify they want escaped
    solidi '/'.  issue #28
  - lth crash fix when yajl_parse() is never called. issue #27
- additional changes from 2.0.0
  - lth YAJL is now ISC licensed:
    http://en.wikipedia.org/wiki/ISC_license
  - lth 20-35% (osx and linux respectively) parsing performance
    improvement attained by tweaking string scanning (idea:
    @michaelrhanson).
  - Florian Forster &amp; lth - yajl_tree interface introduced as a
    higher level interface to the parser (eats JSON, poops a memory
    representation)
  - lth require a C99 compiler
  - lth integers are now represented with long long (64bit+) on all
    platforms.
  - lth size_t now used throughout to represent buffer lengths, so
    you can safely manage buffers greater than 4GB.
  - gno semantic improvements to yajl's API regarding partial value
    parsing and trailing garbage
  - lth new configuration mechanism for yajl, see yajl_config() and
    yajl_gen_config()
  - gno more allocation checking in more places
  - gno remove usage of strtol, replace with custom implementation
    that cares not about your locale.
  - lth yajl_parse_complete renamed to yajl_complete_parse.
  - lth add a switch to validate utf8 strings as they are
    generated.
  - lth tests are a lot quieter in their output.
  - lth addition of a little in tree performance benchmark,
    `perftest` in perf/perftest.c
- additional changes from 1.0.12
  - Conrad Irwin - Parse null bytes correctly
  - Mirek Rusin - fix LLVM warnings
  - gno - Don't generate numbers for keys. closes #13
  - lth - various win32 fixes, including build documentation
    improvements
  - John Stamp - Don't export private symbols.
  - John Stamp - Install yajl_version.h, not the template.
  - John Stamp - Don't use -fPIC for static lib.  Cmake will
    automatically add it for the shared.
  - lth 0 fix paths embedded in dylib upon installation on osx.
    closes #11
- refreshed optflags patch</changelog>
  <changelog author="mrueckert@suse.de" date="1313496000">- bump baselibs.conf</changelog>
  <changelog author="jengelh@medozas.de" date="1316174400">- Add libyajl-devel to baselibs</changelog>
  <changelog author="jengelh@medozas.de" date="1327838400">- Remove redundant tags/sections per specfile guideline suggestions</changelog>
  <changelog author="ku.b@gmx.de" date="1415188800">- update to 2.1.0
- 2.1.0
  - @nonodename, @patperry - fixed some compiler warnings
  - @yep, @emaste - documentation improvements
  - @sgravrock - build fix for NetBSD (and whenever sh != bash)
  - @rotty, @brimstone3, @lloyd - allow client to reset generator
  - @sgravrock - remove bash dependencies
  - @lloyd - add api tests
  - @rflynn - remove ruby dependency
  - @cloderic - nmake install works on windows
  - @shahbag - build fix for qnx
  - @breese - debugging improvements
  - @lloyd - json_verify supports -s flag for stream processing
  - @lloyd - json_reformat supports -s flag for stream processing
- 2.0.4
  - @jcekstrom - additional checking in integer parsing
  - @jcekstrom - fix a bug in yajl_tree that would cause valid json integersto fail to parse
  - @plaguemorin - fix a memory leak in yajl_tree (error strings were being leaked)
  - @7AC - reset errno
  - @ConradIrwin - include flags to reformatter to allow toggling of escape solidus option
- 2.0.3
  - John Stamp generation of a pkgconfig file at build time.
  - @robzuber bugfix in yajl_tree_get()
  - @lloyd - fix for compilation on 64 bit windows
- 2.0.2
  - lth fix typos in yajl_tree.h macros YAJL_IS_INTEGER and YAJL_IS_DOUBLE,
    contributed by Artem S Vybornov.
  - lth add #ifdef __cplusplus wrappers to yajl_tree to allow proper
    usage from many populer C++ compilers.
- fix array access</changelog>
  <changelog author="mpluskal@suse.com" date="1430049600">- Use correct url for download
- Add dependency on doxygen for doc generation
- Cleanup spec file with spec-clener</changelog>
  <changelog author="kukuk@suse.de" date="1522152000">- Use %license instead of %doc [bsc#1082318]
- Move other docu to -devel package where it better fits</changelog>
  <changelog author="jtomasiak@suse.com" date="1652443200">- add libyajl-CVE-2022-24795.patch (CVE-2022-24795, bsc#1198405)</changelog>
</package>
<package pkgid="b2c85c250d3afc1e169f875f91089079b65da7fab49e75811da542d9825c8d1f" name="libz1" arch="aarch64">
  <version epoch="0" ver="1.2.11" rel="150000.3.33.1"/>
  <changelog author="mpluskal@suse.com" date="1496318400">- Add gpg signature
- Re-enable profiling</changelog>
  <changelog author="kah0922@gmail.com" date="1497268800">- Added 32bit minizip support</changelog>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
</package>
<package pkgid="4ef537bd91c851a321aba4b1cef4679c257e3409c5e4591edea974d333eaa090" name="libz1" arch="x86_64">
  <version epoch="0" ver="1.2.11" rel="150000.3.33.1"/>
  <changelog author="mpluskal@suse.com" date="1496318400">- Add gpg signature
- Re-enable profiling</changelog>
  <changelog author="kah0922@gmail.com" date="1497268800">- Added 32bit minizip support</changelog>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
</package>
<package pkgid="7507b9c06929d7431db267b1e31c48accb2b315dc64a6d18cbfde3bf7e344cfd" name="libz1" arch="aarch64">
  <version epoch="0" ver="1.2.11" rel="150000.3.36.1"/>
  <changelog author="kah0922@gmail.com" date="1497268800">- Added 32bit minizip support</changelog>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
</package>
<package pkgid="43720d5dcadfb4859ed04be2f25e7770f2c3f5fc75c055161af7c9b4d6a52be6" name="libz1" arch="x86_64">
  <version epoch="0" ver="1.2.11" rel="150000.3.36.1"/>
  <changelog author="kah0922@gmail.com" date="1497268800">- Added 32bit minizip support</changelog>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
</package>
<package pkgid="3338c12611b357bdf6e45928369913d78acdb2610b38c77019a025ae82647e89" name="libz1" arch="aarch64">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="2ca875d8f93fb4732079933f8841b814954cf49c6fe976a37e2203fa175cb9a8" name="libz1" arch="x86_64">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="81822e12bad0882737b3459008b615ad96173a877bd2bd63b26f4a639d4d6b71" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.30.0" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1622548800">- Work around download.o.o broken https redirects.
- Allow trusted repos to add additional signing keys (bsc#1184326)
  Repositories signed with a trusted gpg key may import additional
  package signing keys. This is needed if different keys were used
  to sign the the packages shipped by the repository.
- MediaCurl: Fix logging of redirects.
- Use 15.3 resolver problem and solution texts on all distros.
- $ZYPP_LOCK_TIMEOUT: Let negative values wait forever for the
  zypp lock (bsc#1184399)
  Helps boot time services like 'zypper purge-kernels' to wait for
  the zypp lock until other services using zypper have completed.
- Fix purge-kernels is broken in Leap 15.3 (bsc#1185325)
  Leap 15.3 introduces a new kernel package called
  kernel-flavour-extra, which contain kmp's. Currently kmp's are
  detected by name ".*-kmp(-.*)?" but this does not work which
  those new packages. This patch fixes the problem by checking
  packages for kmod(*) and ksym(*) provides and only falls back to
  name checking if the package in question does not provide one of
  those.
- Introduce zypp-runpurge, a tool to run purge-kernels on
  testcases.
- version 17.26.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Enhance XML output of repo GPG options (fixes openSUSE/zypper#390)
  In addition to the effective values, add optional attributes
  showing the raw values actually present in the .repo file.
  (raw_gpgcheck, raw_repo_gpgcheck, raw_pkg_gpgcheck)
- Link all executables with -pie (bsc#1186447)
- Ship an empty /etc/zypp/needreboot per default (fixes #311, jsc#PM-2645)
  If packages want to trigger the reboot-needed hiint upon installation
  they may provide 'installhint(reboot-needed)'.
  Builtin packages triggering the hint without the provides are
  only kernel and kernel-firmware related.
- Add Solvable::isBlacklisted as superset of retracted and ptf
  packages (bsc#1186503)
- Fix segv if ZYPP_FULLOG is set (fixes #317)
- version 17.27.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
</package>
<package pkgid="954af5e24852a65b34aa0a4a62043893034240c8cca7ed5219b50729c974bcc8" name="libzypp" arch="src">
  <version epoch="0" ver="17.30.0" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1622548800">- Work around download.o.o broken https redirects.
- Allow trusted repos to add additional signing keys (bsc#1184326)
  Repositories signed with a trusted gpg key may import additional
  package signing keys. This is needed if different keys were used
  to sign the the packages shipped by the repository.
- MediaCurl: Fix logging of redirects.
- Use 15.3 resolver problem and solution texts on all distros.
- $ZYPP_LOCK_TIMEOUT: Let negative values wait forever for the
  zypp lock (bsc#1184399)
  Helps boot time services like 'zypper purge-kernels' to wait for
  the zypp lock until other services using zypper have completed.
- Fix purge-kernels is broken in Leap 15.3 (bsc#1185325)
  Leap 15.3 introduces a new kernel package called
  kernel-flavour-extra, which contain kmp's. Currently kmp's are
  detected by name ".*-kmp(-.*)?" but this does not work which
  those new packages. This patch fixes the problem by checking
  packages for kmod(*) and ksym(*) provides and only falls back to
  name checking if the package in question does not provide one of
  those.
- Introduce zypp-runpurge, a tool to run purge-kernels on
  testcases.
- version 17.26.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Enhance XML output of repo GPG options (fixes openSUSE/zypper#390)
  In addition to the effective values, add optional attributes
  showing the raw values actually present in the .repo file.
  (raw_gpgcheck, raw_repo_gpgcheck, raw_pkg_gpgcheck)
- Link all executables with -pie (bsc#1186447)
- Ship an empty /etc/zypp/needreboot per default (fixes #311, jsc#PM-2645)
  If packages want to trigger the reboot-needed hiint upon installation
  they may provide 'installhint(reboot-needed)'.
  Builtin packages triggering the hint without the provides are
  only kernel and kernel-firmware related.
- Add Solvable::isBlacklisted as superset of retracted and ptf
  packages (bsc#1186503)
- Fix segv if ZYPP_FULLOG is set (fixes #317)
- version 17.27.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
</package>
<package pkgid="96ea6e2271730830a692d715bea3e95f52ead6b36253d11b9cbe3b2ad7f95a6e" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.30.0" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1622548800">- Work around download.o.o broken https redirects.
- Allow trusted repos to add additional signing keys (bsc#1184326)
  Repositories signed with a trusted gpg key may import additional
  package signing keys. This is needed if different keys were used
  to sign the the packages shipped by the repository.
- MediaCurl: Fix logging of redirects.
- Use 15.3 resolver problem and solution texts on all distros.
- $ZYPP_LOCK_TIMEOUT: Let negative values wait forever for the
  zypp lock (bsc#1184399)
  Helps boot time services like 'zypper purge-kernels' to wait for
  the zypp lock until other services using zypper have completed.
- Fix purge-kernels is broken in Leap 15.3 (bsc#1185325)
  Leap 15.3 introduces a new kernel package called
  kernel-flavour-extra, which contain kmp's. Currently kmp's are
  detected by name ".*-kmp(-.*)?" but this does not work which
  those new packages. This patch fixes the problem by checking
  packages for kmod(*) and ksym(*) provides and only falls back to
  name checking if the package in question does not provide one of
  those.
- Introduce zypp-runpurge, a tool to run purge-kernels on
  testcases.
- version 17.26.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Enhance XML output of repo GPG options (fixes openSUSE/zypper#390)
  In addition to the effective values, add optional attributes
  showing the raw values actually present in the .repo file.
  (raw_gpgcheck, raw_repo_gpgcheck, raw_pkg_gpgcheck)
- Link all executables with -pie (bsc#1186447)
- Ship an empty /etc/zypp/needreboot per default (fixes #311, jsc#PM-2645)
  If packages want to trigger the reboot-needed hiint upon installation
  they may provide 'installhint(reboot-needed)'.
  Builtin packages triggering the hint without the provides are
  only kernel and kernel-firmware related.
- Add Solvable::isBlacklisted as superset of retracted and ptf
  packages (bsc#1186503)
- Fix segv if ZYPP_FULLOG is set (fixes #317)
- version 17.27.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
</package>
<package pkgid="9982b90916ca53ba39b9912b80cd34dd7a91f732ca8b7c98c1fde3176baa054d" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.30.2" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
</package>
<package pkgid="4202291f3cb14cf4c1b3d6872e96fb97a92af42d7961c9dafb80e3ef06bc3aa2" name="libzypp" arch="src">
  <version epoch="0" ver="17.30.2" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
</package>
<package pkgid="6d5038e756801965a18c719e645ef3440c50931e78a16db7cd1e0db01a092055" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.30.2" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1627300800">- Rephrase vendor conflict message in case 2 packages are
  involved (bsc#1187760)
  This covers the case where not the packages itself would change
  its vendor, but replaces a package from a different vendor.
- Fix solver jobs for PTFs (bsc#1186503)
- spec: switch to pkgconfig(openssl)
- Show key fpr from signature when signature check fails
  (bsc#1187224)
  Rpm by default only shows the short key ID when checking the
  signature of a package fails. This patch reads the signatures
  from the RPM headers and replaces she short IDs with the key
  fingerprints fetched from the signatures.
- Implement alternative single transaction commit strategy.
  This patch adds a experimental commit strategy that runs all
  operations in a single rpm transaction, speeding up the execution
  a lot.
- Use ZYPP_MEDIANETWORK=1 to enable the experimental new media
  backend.
- Implement zchunk download, refactor Downloader backend.
- Fix purge-kernels fails with kernels from Kernel:HEAD
  (bsc#1187738)
  There recently was a change in the kernel package naming scheme
  in regards to rc kernels. Since kernel upstream uses characters
  in the version that are not allowed in rpm versions a "-rc" was
  previously replaced with ".rc" which broke sorting by version, to
  fix this issue it was replaced with "~rc", which unfortunately
  broke the purge-kernels logic. This patch makes sure purge-kernel
  does apply the same conversion.
- version 17.28.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1629720000">- Fix crashes in logging code when shutting down (bsc#1189031)
- version 17.28.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
</package>
<package pkgid="118c2cb031d17ceaf094c2d18e8a67c58114876606749c829cb1332138798a69" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.31.0" rel="150200.42.1"/>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
</package>
<package pkgid="167f92ac839cc29464be4ae855e121486c1b5380e2eecabad6da93e103e580e9" name="libzypp" arch="src">
  <version epoch="0" ver="17.31.0" rel="150200.42.1"/>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
</package>
<package pkgid="2218c0961af6a0da7ab91fd8dcb16c6d09da0034a98a96147bd09a3722b3409e" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.31.0" rel="150200.42.1"/>
  <changelog author="ma@suse.de" date="1630411200">- Workaround Bug 1189788: Don't allow ZYPP_SINGLE_RPMTRANS=1 on a
  not UsrMerged Tumbleweed system.
- version 17.28.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1630670400">- CMake/spec: Add option to force SINGLE_RPMTRANS as default for
  zypper (fixes #340)
- Make sure singleTrans is zypper-only for now.
- Do not double check signatures and keys (bsc#1190059)
- version 17.28.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
</package>
<package pkgid="7ab375cdfbd65bfcdb3d85c0c3b4b11243a23252265612e0d80e9b949a06864f" name="libzypp" arch="aarch64">
  <version epoch="0" ver="17.31.2" rel="150200.45.1"/>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
</package>
<package pkgid="291187b0551465e99e74b5b353731d4bf12fdf356023a6a833ac0ba1eb376934" name="libzypp" arch="src">
  <version epoch="0" ver="17.31.2" rel="150200.45.1"/>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
</package>
<package pkgid="1b4674de3fded5e47d4eb72d656723dd771fce64265c123237f798b8476d3133" name="libzypp" arch="x86_64">
  <version epoch="0" ver="17.31.2" rel="150200.45.1"/>
  <changelog author="ma@suse.de" date="1631880000">- Make sure to keep states alives while transitioning
  (bsc#1190199)
- May set techpreview variables for testing in /etc/zypp/zypp.conf.
  If environment variables are unhandy one may enable the desired
  techpreview in zypp.conf as well:
    [main]
    techpreview.ZYPP_SINGLE_RPMTRANS=1
    techpreview.ZYPP_MEDIANETWORK=1
- version 17.28.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1633348800">- Downloader does not respect checkExistsOnly flag (bsc#1190712)
  A missing check causes zyppng::Downloader to always download full
  files even if the checkExistsOnly flag is set. This patch adds
  the missing logic.
- Fix kernel-*-livepatch removal in purge-kernels (bsc#1190815)
  The kernel-*-livepatch packages are supposed to serve as a stable
  handle for the ephemeral kernel livepatch packages. See
  FATE#320268 for details. As part of the kernel live patching
  ecosystem, kernel-*-livepatch packages should not block the
  purge-kernels step.
- version 17.28.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Zypper should keep cached files if transaction is aborted
  (bsc#1190356)
  Singletrans mode currently does not keep files around if the
  transaction is aborted. This patch fixes the problem.
- Require a minimum number of mirrors for multicurl (bsc#1191609)
- Use procfs to detect nr of open fd's if rlimit is too high
  (bsc#1191324)
  Especially in a VM iterating over all possible fd's to close open
  ones right before a exec() slows down zypper unnecessarily. This
  patch uses /proc/self/fd to iterate over open fd's in case rlimit
  is above 1024.
- po: Fix some lost '%' signs in positional args (bsc#1191370)
- RepoManager: Don't probe for plaindir repo if URL schema is
  plugin: (bsc#1191286)
- version 17.28.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1636027200">- Check log writer before accessing it (fixes #355, bsc#1192337)
- Save locks: Update an existing locks changed comment string.
- Allow uname-r format in purge kernels keepspec (fixes
  openSUSE/zypper#418)
- version 17.28.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1636632000">- Disable logger in the child after fork (bsc#1192436)
- version 17.28.8 (22)</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Use the default zypp.conf settings if no zypp.conf exists
  (bsc#1193488)
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
  PublicKeyData.
- version 17.29.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1641816000">- Fix broken install path for parser compat headers (fixes #372,
  bsc#1194597)
- RepoManager: remember exec errors in exception history
  (bsc#1193007)
- version 17.29.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1642680000">- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1643716800">- Public header files on older distros must use c++11
  (bsc#1194597)
- Fix exception handling when reading or writing credentials
  (bsc#1194898)
- version 17.29.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1644321600">- Fix handling of redirected command in-/output (bsc#1195326)
  This fixes delays at the end of zypper operations, where
  zypper unintentionally waits for appdata plugin scripts to
  complete.
- version 17.29.4 (22)</changelog>
  <changelog author="ma@suse.de" date="1645704000">- Hint on ptf&lt;&gt;patch resolver conflicts (bsc#1194848)
- version 17.29.5 (22)</changelog>
  <changelog author="ma@suse.de" date="1647259200">- Fix package signature check (bsc#1184501)
  Pay attention that header and payload are secured by a valid
  signature and report more detailed which signature is missing.
- Retry umount if device is busy (bsc#1196061, closes #381)
  A previously released ISO image may need a bit more time to
  release it's loop device. So we wait a bit and retry.
- Fix serializing/deserializing type mismatch in zypp-rpm
  protocol (bsc#1196925)
- Fix handling of ISO media in releaseAll (bsc#1196061)
- Hint on common ptf resolver conflicts (bsc#1194848)
- version 17.29.6 (22)</changelog>
  <changelog author="ma@suse.de" date="1647864000">- Fix possible hang in singletrans mode (bsc#1197134)
- Do 2 retries if mount is still busy.
- version 17.29.7 (22)</changelog>
  <changelog author="ma@suse.de" date="1648209600">- ZConfig: Update solver settings if target changes (bsc#1196368)
- version 17.30.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1653912000">- PluginRepoverification: initial version hooked into
  repo::Downloader and repo refresh.
- Immediately start monitoring the download.transfer_timeout.
  Do not wait until the first data arrived. (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only.
- Work around cases where sat repo.start points to an invalid
  solvable.  May happen if (wrong arch) solvables were removed
  at the  beginning of the repo.
- fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
  (fixes #388)
- version 17.30.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1655294400">- appdata plugin: Pass path to the repodata/ directory inside the
  cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending
  endOfScriptTag.
- version 17.30.2 (22)</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 12.x release (#396)
- version 17.30.3 (22)</changelog>
  <changelog author="ma@suse.de" date="1658232000">- Add PoolItem::statusReinit to reset the status it's initial
  state in the ResPool (might help bsc#1199895)
  This may either be 'KEEP_STATE bySOLVER' or 'LOCKED byUSER' if
  the PoolItem matched a hard lock defined in /etc/zypp/locks.
- Fix building with GCC 13 on i586 (fixes #407, fixes #396)
- Be prepared to receive exceptions from curl_easy_cleanup
  (bsc#1201092)
- Don't auto-flag kernel-firmware as 'reboot-needed' (bsc#1200993)
- Remove Medianetwork and dependend code.
  This commit removes the MediaNetwork tech preview and all related
  code. First reason for this is that MediaNetwork was just meant
  as a way to test the new CURL based downloader and second: since
  the Provide API is going to completely replace the current media
  backend it would be extra work to ensure that changes on the
  Downloader do not break MediaNetwork.
- version 17.31.0 (22)</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #402)
- Log backtrace on SIGABRT too.
- Need to explicitly enable building experimental code. Otherwise
  an old Notcurses++ package which happens to be present in the
  buildenv breaks the build (fixes #412).
- Work around libyui/libyui#78 on code 15.4 and older.
- Stop using std::*ary_function; deprecated and removed in c++17.
- Don't expose header files which use types not available in
  c++11.  In 15.3 and older, YAST and PK compile with -std=c++11.
- Remove no longer needed %post code (bsc#1203649)
- Enable zck support for SLE15-SP4 and newer. On Leap it is enabled
  since 15.1 (bsc#1189282)
- version 17.31.1 (22)</changelog>
  <changelog author="ma@suse.de" date="1664971200">- Resolver: Fix missing --[no]-recommends initialization in
  update (fixes #openSUSE/zypper#459, bsc#1201972)
- Log ONLY_NAMESPACE_RECOMMENDED because this is what corresponds
  to --[no]-recommends.
- version 17.31.2 (22)</changelog>
</package>
<package pkgid="de54c473bb815cc2127fd2f6913e37d8d6f4c98b6d7b69cf5ad28d47587fdf09" name="logrotate" arch="aarch64">
  <version epoch="0" ver="3.13.0" rel="150000.4.7.1"/>
  <changelog author="p.drouand@gmail.com" date="1424433600">- Update to version 3.8.9
  * Add new directive "createolddir" and "nocreateolddir". These directives
    can be used to create the directory specified by olddir with particular
  "mode", "owner" and "group".
  * Continue with rotation even when first log from logset is removed
  during the rotation.
  * Fix crash on BSD systems introduced in 3.8.8 caused by different qsort_r
  function. Function qsort is now used instead.
  * Fix potential buffer overflow in usage of strncat function.
  * Fix compilation with musl-libc.
  * Add experimental 'renamecopy' directive to allow 'olddir' on different
    physical device. See the "man logrotate" for more information.
- Remove logrotate-fail_if_ENOENT_and_nomissingok.patch; merged on
  upstream release
- Updated patches
  * logrotate-3.7.8-addextension.patch &gt; logrotate-addextension.patch
  * logrotate-3.7.8-autoext.patch &gt; logrotate-autoext.patch
  * logrotate-3.7.8-conf.patch &gt; logrotate-conf.patch
  * logrotate-manpage_config_clarification.patch
- Remove redunant %clean section</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1432036800">- Enable Persistent timer since we are now in systemd 219.</changelog>
  <changelog author="kstreitova@suse.com" date="1434974400">- update to 3.9.1
  * 3.9.1
  - Fix off-by-one error which can lead to crash when copytruncate
    is used.
  * 3.9.0
  - Fix crash when using long dateformat. [nmerdan]
  - Add support for %H dateformat. [czchen]
  - Fix regression introduced in 3.8.9 when when rotating multiple
    logs when one of them is missing.
  - In the debug mode, do not skip the code-path which handles the
    case when the last rotation does not exist. [Sergey Vidishev]
  - Show more precise description when "log does not need rotating".
  - Add new -l option to log verbose output to file. The file is
    overwritten on every logrotate execution.
  - Allow rotation of sparse files with copytruncate.
  * update logrotate-addextension.patch
- use spec-cleaner
- remove unused PreReq tags</changelog>
  <changelog author="dimstar@opensuse.org" date="1475496000">- Add logrotate-fix-test62_with_bash-4.4.patch: Fix the test suite
  when running with bash 4.4 (gh#logrotate/logrotate#66).</changelog>
  <changelog author="tchvatal@suse.com" date="1475668800">- Version update to 3.10.0 fate#322037:
  * Update url to point to github
- Remove upstreamed patch:
  * logrotate-3.7.8-mess_err.patch
- Rebase patches:
  * logrotate-3.7.8-suse.patch
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-fix-test62_with_bash-4.4.patch</changelog>
  <changelog author="kukuk@suse.de" date="1478952000">- Move logrotate.status to /var/lib/misc following FHS/LSB and
  making implementing read-only root filesystem much easier.
  [FATE#322036]
- Add patch:
  * logrotate-var-lib-misc.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1479729600">- Fix post scriptlet condition bnc#1011120</changelog>
  <changelog author="tchvatal@suse.com" date="1482926400">- Version update to 3.11.0:
  * Merges from distribution patchsets and small fixes around
- Remove all patches merged upstream:
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-conf.patch
  * logrotate-fix-test62_with_bash-4.4.patch
  * logrotate-manpage_config_clarification.patch
  * logrotate-var-lib-misc.patch
  * logrotate-3.7.8-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Remove aaa_base compat setting that is from 2003, we do not
  support such migration anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1499428801">- Version update to 3.12.3:
  * Fixed accident removal of rotated files with dateext. (#118)
  * Line comments inside globs in config files are now skipped. (#109)
  * logrotate now recovers from a corrupted state file. (#45)
  * createolddir now creates old directory as unprivileged user. (#114)
  * weekly rotations are now predictable and configurable. (#93)
  * Errors in config files are no longer treated as fatal errors. (#81)
  * configure --with-default-mail-command specifies default mail command. (#100)
  * Fixed heap buffer overflow when parsing crafted config file. (#33)
  * build fixes related to -Werror (#119) and -Werror=format= (#108)
  * configure --enable-werror now controls use of the -Werror flag (#123)
  * copy and copytruncate directives now work together again
  * unlink() is no longer preceded by open() unless shred is enabled (#124)
  * compress and uncompress now take commands from $PATH, too (#122)
- By default disable werror while building</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515153600">- Version update to 3.13.0:
  * make distribution tarballs report logrotate version properly
  * make (un)compress work even if stdin and/or stdout are closed (#154)
  * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152)
  * uncompress logs before mailing them even if delaycompress is enabled (#151)
  * handle unlink of a non-existing log file as a warning only (#144)
  * include compile-time options in the output of logrotate --version (#145)
  * make logrotate --version print to stdout instead of stderr (#145)
  * flush write buffers before syncing state file (#148)
  * specify (un)compress utility explicitly in tests (#137)
  * enable running tests in parallel (#132)
  * explicitly map root UID/GID to 0 on Cygwin (#133)
  * add .dpkg-bak and .dpkg-del to default tabooext list (#134)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1528372800">- Add "Environment=HOME=/root" to logrotate.service file in order
  to allow mariadb to rotate its logs when the database has a root
  password defined [bsc#1093617]
- Added patch:
  * logrotate-3.13.0-systemd_add_home_env.patch</changelog>
  <changelog author="manfred.h@gmx.net" date="1654603200">- Fix "logrotate emits unintended warning: keyword size not properly
  separated, found 0x3d" (bsc#1200278, bsc#1200802):
  * Added patch logrotate-dont_warn_on_size=_syntax.patch</changelog>
  <changelog author="david.anes@suse.com" date="1655294400">- Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864)
  * enforce stricter parsing to avoid CVE-2021-3864
  * Added patch logrotate-enforce-stricter-parsing-and-extra-tests.patch</changelog>
</package>
<package pkgid="c2bbf132fc026494b20058262741f3e4e2c648a4973cf50e3993690446da39fe" name="logrotate" arch="src">
  <version epoch="0" ver="3.13.0" rel="150000.4.7.1"/>
  <changelog author="vcizek@suse.com" date="1396353600">- return error when nomissingok is specified and the log path
  doesn't exist (bnc#871217)
  * added logrotate-fail_if_ENOENT_and_nomissingok.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1396440000">- Migrate from cron to systemd timer units, this is overall
  the most important package to migrate since it is one
  of the very few base components that hard-require cron.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1396526400">- BuildRequire systemd 197 or later.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1396526401">- Also, avoid logrotate unit activation when the system is
  on battery power.</changelog>
  <changelog author="vcizek@suse.com" date="1403784000">- temporarily remove the 'Persistent' option from logrotate.timer
  * our current systemd doesn't support it yet (bnc#884338)</changelog>
  <changelog author="p.drouand@gmail.com" date="1424433600">- Update to version 3.8.9
  * Add new directive "createolddir" and "nocreateolddir". These directives
    can be used to create the directory specified by olddir with particular
  "mode", "owner" and "group".
  * Continue with rotation even when first log from logset is removed
  during the rotation.
  * Fix crash on BSD systems introduced in 3.8.8 caused by different qsort_r
  function. Function qsort is now used instead.
  * Fix potential buffer overflow in usage of strncat function.
  * Fix compilation with musl-libc.
  * Add experimental 'renamecopy' directive to allow 'olddir' on different
    physical device. See the "man logrotate" for more information.
- Remove logrotate-fail_if_ENOENT_and_nomissingok.patch; merged on
  upstream release
- Updated patches
  * logrotate-3.7.8-addextension.patch &gt; logrotate-addextension.patch
  * logrotate-3.7.8-autoext.patch &gt; logrotate-autoext.patch
  * logrotate-3.7.8-conf.patch &gt; logrotate-conf.patch
  * logrotate-manpage_config_clarification.patch
- Remove redunant %clean section</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1432036800">- Enable Persistent timer since we are now in systemd 219.</changelog>
  <changelog author="kstreitova@suse.com" date="1434974400">- update to 3.9.1
  * 3.9.1
  - Fix off-by-one error which can lead to crash when copytruncate
    is used.
  * 3.9.0
  - Fix crash when using long dateformat. [nmerdan]
  - Add support for %H dateformat. [czchen]
  - Fix regression introduced in 3.8.9 when when rotating multiple
    logs when one of them is missing.
  - In the debug mode, do not skip the code-path which handles the
    case when the last rotation does not exist. [Sergey Vidishev]
  - Show more precise description when "log does not need rotating".
  - Add new -l option to log verbose output to file. The file is
    overwritten on every logrotate execution.
  - Allow rotation of sparse files with copytruncate.
  * update logrotate-addextension.patch
- use spec-cleaner
- remove unused PreReq tags</changelog>
  <changelog author="dimstar@opensuse.org" date="1475496000">- Add logrotate-fix-test62_with_bash-4.4.patch: Fix the test suite
  when running with bash 4.4 (gh#logrotate/logrotate#66).</changelog>
  <changelog author="tchvatal@suse.com" date="1475668800">- Version update to 3.10.0 fate#322037:
  * Update url to point to github
- Remove upstreamed patch:
  * logrotate-3.7.8-mess_err.patch
- Rebase patches:
  * logrotate-3.7.8-suse.patch
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-fix-test62_with_bash-4.4.patch</changelog>
  <changelog author="kukuk@suse.de" date="1478952000">- Move logrotate.status to /var/lib/misc following FHS/LSB and
  making implementing read-only root filesystem much easier.
  [FATE#322036]
- Add patch:
  * logrotate-var-lib-misc.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1479729600">- Fix post scriptlet condition bnc#1011120</changelog>
  <changelog author="tchvatal@suse.com" date="1482926400">- Version update to 3.11.0:
  * Merges from distribution patchsets and small fixes around
- Remove all patches merged upstream:
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-conf.patch
  * logrotate-fix-test62_with_bash-4.4.patch
  * logrotate-manpage_config_clarification.patch
  * logrotate-var-lib-misc.patch
  * logrotate-3.7.8-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Remove aaa_base compat setting that is from 2003, we do not
  support such migration anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1499428801">- Version update to 3.12.3:
  * Fixed accident removal of rotated files with dateext. (#118)
  * Line comments inside globs in config files are now skipped. (#109)
  * logrotate now recovers from a corrupted state file. (#45)
  * createolddir now creates old directory as unprivileged user. (#114)
  * weekly rotations are now predictable and configurable. (#93)
  * Errors in config files are no longer treated as fatal errors. (#81)
  * configure --with-default-mail-command specifies default mail command. (#100)
  * Fixed heap buffer overflow when parsing crafted config file. (#33)
  * build fixes related to -Werror (#119) and -Werror=format= (#108)
  * configure --enable-werror now controls use of the -Werror flag (#123)
  * copy and copytruncate directives now work together again
  * unlink() is no longer preceded by open() unless shred is enabled (#124)
  * compress and uncompress now take commands from $PATH, too (#122)
- By default disable werror while building</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515153600">- Version update to 3.13.0:
  * make distribution tarballs report logrotate version properly
  * make (un)compress work even if stdin and/or stdout are closed (#154)
  * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152)
  * uncompress logs before mailing them even if delaycompress is enabled (#151)
  * handle unlink of a non-existing log file as a warning only (#144)
  * include compile-time options in the output of logrotate --version (#145)
  * make logrotate --version print to stdout instead of stderr (#145)
  * flush write buffers before syncing state file (#148)
  * specify (un)compress utility explicitly in tests (#137)
  * enable running tests in parallel (#132)
  * explicitly map root UID/GID to 0 on Cygwin (#133)
  * add .dpkg-bak and .dpkg-del to default tabooext list (#134)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1528372800">- Add "Environment=HOME=/root" to logrotate.service file in order
  to allow mariadb to rotate its logs when the database has a root
  password defined [bsc#1093617]
- Added patch:
  * logrotate-3.13.0-systemd_add_home_env.patch</changelog>
  <changelog author="manfred.h@gmx.net" date="1654603200">- Fix "logrotate emits unintended warning: keyword size not properly
  separated, found 0x3d" (bsc#1200278, bsc#1200802):
  * Added patch logrotate-dont_warn_on_size=_syntax.patch</changelog>
  <changelog author="david.anes@suse.com" date="1655294400">- Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864)
  * enforce stricter parsing to avoid CVE-2021-3864
  * Added patch logrotate-enforce-stricter-parsing-and-extra-tests.patch</changelog>
</package>
<package pkgid="ee4bb22150400834ed84c797b93943a8e2e9f1b970e7dfae703ba07b7af88746" name="logrotate" arch="x86_64">
  <version epoch="0" ver="3.13.0" rel="150000.4.7.1"/>
  <changelog author="p.drouand@gmail.com" date="1424433600">- Update to version 3.8.9
  * Add new directive "createolddir" and "nocreateolddir". These directives
    can be used to create the directory specified by olddir with particular
  "mode", "owner" and "group".
  * Continue with rotation even when first log from logset is removed
  during the rotation.
  * Fix crash on BSD systems introduced in 3.8.8 caused by different qsort_r
  function. Function qsort is now used instead.
  * Fix potential buffer overflow in usage of strncat function.
  * Fix compilation with musl-libc.
  * Add experimental 'renamecopy' directive to allow 'olddir' on different
    physical device. See the "man logrotate" for more information.
- Remove logrotate-fail_if_ENOENT_and_nomissingok.patch; merged on
  upstream release
- Updated patches
  * logrotate-3.7.8-addextension.patch &gt; logrotate-addextension.patch
  * logrotate-3.7.8-autoext.patch &gt; logrotate-autoext.patch
  * logrotate-3.7.8-conf.patch &gt; logrotate-conf.patch
  * logrotate-manpage_config_clarification.patch
- Remove redunant %clean section</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1432036800">- Enable Persistent timer since we are now in systemd 219.</changelog>
  <changelog author="kstreitova@suse.com" date="1434974400">- update to 3.9.1
  * 3.9.1
  - Fix off-by-one error which can lead to crash when copytruncate
    is used.
  * 3.9.0
  - Fix crash when using long dateformat. [nmerdan]
  - Add support for %H dateformat. [czchen]
  - Fix regression introduced in 3.8.9 when when rotating multiple
    logs when one of them is missing.
  - In the debug mode, do not skip the code-path which handles the
    case when the last rotation does not exist. [Sergey Vidishev]
  - Show more precise description when "log does not need rotating".
  - Add new -l option to log verbose output to file. The file is
    overwritten on every logrotate execution.
  - Allow rotation of sparse files with copytruncate.
  * update logrotate-addextension.patch
- use spec-cleaner
- remove unused PreReq tags</changelog>
  <changelog author="dimstar@opensuse.org" date="1475496000">- Add logrotate-fix-test62_with_bash-4.4.patch: Fix the test suite
  when running with bash 4.4 (gh#logrotate/logrotate#66).</changelog>
  <changelog author="tchvatal@suse.com" date="1475668800">- Version update to 3.10.0 fate#322037:
  * Update url to point to github
- Remove upstreamed patch:
  * logrotate-3.7.8-mess_err.patch
- Rebase patches:
  * logrotate-3.7.8-suse.patch
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-fix-test62_with_bash-4.4.patch</changelog>
  <changelog author="kukuk@suse.de" date="1478952000">- Move logrotate.status to /var/lib/misc following FHS/LSB and
  making implementing read-only root filesystem much easier.
  [FATE#322036]
- Add patch:
  * logrotate-var-lib-misc.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1479729600">- Fix post scriptlet condition bnc#1011120</changelog>
  <changelog author="tchvatal@suse.com" date="1482926400">- Version update to 3.11.0:
  * Merges from distribution patchsets and small fixes around
- Remove all patches merged upstream:
  * logrotate-addextension.patch
  * logrotate-autoext.patch
  * logrotate-conf.patch
  * logrotate-fix-test62_with_bash-4.4.patch
  * logrotate-manpage_config_clarification.patch
  * logrotate-var-lib-misc.patch
  * logrotate-3.7.8-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Remove aaa_base compat setting that is from 2003, we do not
  support such migration anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1499428801">- Version update to 3.12.3:
  * Fixed accident removal of rotated files with dateext. (#118)
  * Line comments inside globs in config files are now skipped. (#109)
  * logrotate now recovers from a corrupted state file. (#45)
  * createolddir now creates old directory as unprivileged user. (#114)
  * weekly rotations are now predictable and configurable. (#93)
  * Errors in config files are no longer treated as fatal errors. (#81)
  * configure --with-default-mail-command specifies default mail command. (#100)
  * Fixed heap buffer overflow when parsing crafted config file. (#33)
  * build fixes related to -Werror (#119) and -Werror=format= (#108)
  * configure --enable-werror now controls use of the -Werror flag (#123)
  * copy and copytruncate directives now work together again
  * unlink() is no longer preceded by open() unless shred is enabled (#124)
  * compress and uncompress now take commands from $PATH, too (#122)
- By default disable werror while building</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515153600">- Version update to 3.13.0:
  * make distribution tarballs report logrotate version properly
  * make (un)compress work even if stdin and/or stdout are closed (#154)
  * remove -s from DEFAULT_MAIL_COMMAND and improve its documenation (#152)
  * uncompress logs before mailing them even if delaycompress is enabled (#151)
  * handle unlink of a non-existing log file as a warning only (#144)
  * include compile-time options in the output of logrotate --version (#145)
  * make logrotate --version print to stdout instead of stderr (#145)
  * flush write buffers before syncing state file (#148)
  * specify (un)compress utility explicitly in tests (#137)
  * enable running tests in parallel (#132)
  * explicitly map root UID/GID to 0 on Cygwin (#133)
  * add .dpkg-bak and .dpkg-del to default tabooext list (#134)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1528372800">- Add "Environment=HOME=/root" to logrotate.service file in order
  to allow mariadb to rotate its logs when the database has a root
  password defined [bsc#1093617]
- Added patch:
  * logrotate-3.13.0-systemd_add_home_env.patch</changelog>
  <changelog author="manfred.h@gmx.net" date="1654603200">- Fix "logrotate emits unintended warning: keyword size not properly
  separated, found 0x3d" (bsc#1200278, bsc#1200802):
  * Added patch logrotate-dont_warn_on_size=_syntax.patch</changelog>
  <changelog author="david.anes@suse.com" date="1655294400">- Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864)
  * enforce stricter parsing to avoid CVE-2021-3864
  * Added patch logrotate-enforce-stricter-parsing-and-extra-tests.patch</changelog>
</package>
<package pkgid="0240283a8d8dd89220b93a30efb15a6b9d81b3c47e96656cc72d57a37b2d80da" name="lshw" arch="aarch64">
  <version epoch="0" ver="B.02.19.2+git.20220628" rel="150200.3.12.1"/>
  <changelog author="mpluskal@suse.com" date="1553774400">- Update to version B.02.18+git.20190324:
  * merge Github PR44
- Set correct version (bsc#1130818)</changelog>
  <changelog author="mpluskal@suse.com" date="1556798400">- Fix displaying proper logical name of network device bsc#1133923
  * lswh-logical-name-iface.patch
- Fix displaying correct version bsc##1130818
  * lshw-display-latest-version.patch
  * lshw-help-man.patch
  * lshw-modified-time.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1571918400">- Update to version B.02.18+git.20190613 (fate#326432 jsc#SLE-7715):
  * devtree: Add DIMM running speed
  * spd: Print dimm rank information
  * Display proper logical name of network device
- Drop no longer needed lswh-logical-name-iface.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1580904000">- Fix bsc#1162690:
  * lshw-add-notime-option-to-manpage.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581076800">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="mpluskal@suse.com" date="1582200000">- Disable LTO as it causes random build failures on some
  architectures (bsc#1164297)</changelog>
  <changelog author="mpluskal@suse.com" date="1584360000">- Update to version B.02.18+git.20191228:
  * fix #755: handle invalid FAT
  * code clean-up
  * volumes: Add support for detecting Apple APFS fstype
  * partitions: Add Apple APFS GUID
  * specfile: Fix version issue
  * Do not show modified time with -notime option
  * Update help message and man page
- Drop upstreamed patches:
  * lshw-help-man.patch
  * lshw-modified-time.patch
- Add lshw-nvme.patch to support nvme devices bsc#1161323</changelog>
  <changelog author="mpluskal@suse.com" date="1585569600">- Update to version B.02.19.2:
  * New release tagged, no significant changes from previous
    version (git snapsho)
- Drop no longer needed patches:
  * lshw-display-latest-version.patch
  * lshw-add-notime-option-to-manpage.patch
  * lshw-nvme.patch</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1587643200">- Disable LTO for aarch64 &amp; PowerPC, bypass boo#1168865</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1587729600">- Reenable LTO for powerpc and aarch64
- Fix PowerPC and aarch64 LTO: boo#1168865 and boo#1169668
  * lshw-fix-segfault-in-apfs-volume-code.patch
- Fix aarch64 SIGABRT: (boo#1169668)
  * lshw-fix-mmc.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1598875200">- Fix detection of ppc products - boo#1172156
  * lshw-fix-ppc.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1611662400">- Display UUID on Power VM LPAR (bsc#1181411 ltc#191040)
  * lshw-devtree-Add-UUID-property.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1622030400">- Update to version B.02.19+git.20210429:
  * Fix getting size of memory banks &lt;32GiB
  * devtree: Add UUID property
  * code clean-up
  * improve portability (esp. musl)
  * fix potential crash
  * add static target to Makefile
  * Avoid crash on device-tree parsing
  * Add JEDEC manufacturer
  * Report correct memory size on SMBIOS &lt; 2.7
  * fix man page after previous update
- Drop no longer needed patches:
  * lshw-fix-segfault-in-apfs-volume-code.patch
  * lshw-fix-mmc.patch
  * lshw-fix-ppc.patch
  * lshw-devtree-Add-UUID-property.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1624536000">- Update to version B.02.19+git.20210619:
  * Fix typos in translatable messages
- jsc#SLE-19399</changelog>
  <changelog author="mpluskal@suse.com" date="1628078400">- Update versioning to to allow easy transition on SLE
- Disable parallel build to avoid random failures</changelog>
  <changelog author="mpluskal@suse.com" date="1634212800">- Update to version B.02.19.2+git.20211013:
  * add some includes
  * fix typo
  * cosmetic fixes
  * support for new ethtool capabilities
  * code clean-up
  * code clean-up
  * allow pkg-config override
  * allow pkg-config override
  * Remove unnecessary space before closing parenthesis
  * Translate all words of a phrase together
  * Fix another typo</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version B.02.19.2+git.20211102:
  * merge Github PR#77
  * use max (9) Gzip compression
  * Add Catalan translation
  * Update POT file
  * Add more network speeds</changelog>
  <changelog author="mpluskal@suse.com" date="1642766400">- Update to version B.02.19.2+git.20211222:
  * Add Spanish translation
  * Fix mistakes in Catalan translation</changelog>
  <changelog author="mpluskal@suse.com" date="1648468800">- Update to version B.02.19.2+git.20220310:
  * Github PR85  Set product name for all netdevs sharing the same PCI number</changelog>
  <changelog author="mpluskal@suse.com" date="1658836800">- Update to version B.02.19.2+git.20220628 (jsc#526):
  * make version check optional</changelog>
</package>
<package pkgid="87fbb0ece447efbe50d971a0e59c3d034ba203208d6431697cdb2baed116126b" name="lshw" arch="src">
  <version epoch="0" ver="B.02.19.2+git.20220628" rel="150200.3.12.1"/>
  <changelog author="mpluskal@suse.com" date="1553774400">- Update to version B.02.18+git.20190324:
  * merge Github PR44
- Set correct version (bsc#1130818)</changelog>
  <changelog author="mpluskal@suse.com" date="1556798400">- Fix displaying proper logical name of network device bsc#1133923
  * lswh-logical-name-iface.patch
- Fix displaying correct version bsc##1130818
  * lshw-display-latest-version.patch
  * lshw-help-man.patch
  * lshw-modified-time.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1571918400">- Update to version B.02.18+git.20190613 (fate#326432 jsc#SLE-7715):
  * devtree: Add DIMM running speed
  * spd: Print dimm rank information
  * Display proper logical name of network device
- Drop no longer needed lswh-logical-name-iface.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1580904000">- Fix bsc#1162690:
  * lshw-add-notime-option-to-manpage.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581076800">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="mpluskal@suse.com" date="1582200000">- Disable LTO as it causes random build failures on some
  architectures (bsc#1164297)</changelog>
  <changelog author="mpluskal@suse.com" date="1584360000">- Update to version B.02.18+git.20191228:
  * fix #755: handle invalid FAT
  * code clean-up
  * volumes: Add support for detecting Apple APFS fstype
  * partitions: Add Apple APFS GUID
  * specfile: Fix version issue
  * Do not show modified time with -notime option
  * Update help message and man page
- Drop upstreamed patches:
  * lshw-help-man.patch
  * lshw-modified-time.patch
- Add lshw-nvme.patch to support nvme devices bsc#1161323</changelog>
  <changelog author="mpluskal@suse.com" date="1585569600">- Update to version B.02.19.2:
  * New release tagged, no significant changes from previous
    version (git snapsho)
- Drop no longer needed patches:
  * lshw-display-latest-version.patch
  * lshw-add-notime-option-to-manpage.patch
  * lshw-nvme.patch</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1587643200">- Disable LTO for aarch64 &amp; PowerPC, bypass boo#1168865</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1587729600">- Reenable LTO for powerpc and aarch64
- Fix PowerPC and aarch64 LTO: boo#1168865 and boo#1169668
  * lshw-fix-segfault-in-apfs-volume-code.patch
- Fix aarch64 SIGABRT: (boo#1169668)
  * lshw-fix-mmc.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1598875200">- Fix detection of ppc products - boo#1172156
  * lshw-fix-ppc.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1611662400">- Display UUID on Power VM LPAR (bsc#1181411 ltc#191040)
  * lshw-devtree-Add-UUID-property.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1622030400">- Update to version B.02.19+git.20210429:
  * Fix getting size of memory banks &lt;32GiB
  * devtree: Add UUID property
  * code clean-up
  * improve portability (esp. musl)
  * fix potential crash
  * add static target to Makefile
  * Avoid crash on device-tree parsing
  * Add JEDEC manufacturer
  * Report correct memory size on SMBIOS &lt; 2.7
  * fix man page after previous update
- Drop no longer needed patches:
  * lshw-fix-segfault-in-apfs-volume-code.patch
  * lshw-fix-mmc.patch
  * lshw-fix-ppc.patch
  * lshw-devtree-Add-UUID-property.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1624536000">- Update to version B.02.19+git.20210619:
  * Fix typos in translatable messages
- jsc#SLE-19399</changelog>
  <changelog author="mpluskal@suse.com" date="1628078400">- Update versioning to to allow easy transition on SLE
- Disable parallel build to avoid random failures</changelog>
  <changelog author="mpluskal@suse.com" date="1634212800">- Update to version B.02.19.2+git.20211013:
  * add some includes
  * fix typo
  * cosmetic fixes
  * support for new ethtool capabilities
  * code clean-up
  * code clean-up
  * allow pkg-config override
  * allow pkg-config override
  * Remove unnecessary space before closing parenthesis
  * Translate all words of a phrase together
  * Fix another typo</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version B.02.19.2+git.20211102:
  * merge Github PR#77
  * use max (9) Gzip compression
  * Add Catalan translation
  * Update POT file
  * Add more network speeds</changelog>
  <changelog author="mpluskal@suse.com" date="1642766400">- Update to version B.02.19.2+git.20211222:
  * Add Spanish translation
  * Fix mistakes in Catalan translation</changelog>
  <changelog author="mpluskal@suse.com" date="1648468800">- Update to version B.02.19.2+git.20220310:
  * Github PR85  Set product name for all netdevs sharing the same PCI number</changelog>
  <changelog author="mpluskal@suse.com" date="1658836800">- Update to version B.02.19.2+git.20220628 (jsc#526):
  * make version check optional</changelog>
</package>
<package pkgid="3c793d6c3041f6c3fa2a7436172d67a4c470ca9fbc825fb9cd542a1ae2a5ed50" name="lshw" arch="x86_64">
  <version epoch="0" ver="B.02.19.2+git.20220628" rel="150200.3.12.1"/>
  <changelog author="mpluskal@suse.com" date="1553774400">- Update to version B.02.18+git.20190324:
  * merge Github PR44
- Set correct version (bsc#1130818)</changelog>
  <changelog author="mpluskal@suse.com" date="1556798400">- Fix displaying proper logical name of network device bsc#1133923
  * lswh-logical-name-iface.patch
- Fix displaying correct version bsc##1130818
  * lshw-display-latest-version.patch
  * lshw-help-man.patch
  * lshw-modified-time.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1571918400">- Update to version B.02.18+git.20190613 (fate#326432 jsc#SLE-7715):
  * devtree: Add DIMM running speed
  * spd: Print dimm rank information
  * Display proper logical name of network device
- Drop no longer needed lswh-logical-name-iface.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1580904000">- Fix bsc#1162690:
  * lshw-add-notime-option-to-manpage.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581076800">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="mpluskal@suse.com" date="1582200000">- Disable LTO as it causes random build failures on some
  architectures (bsc#1164297)</changelog>
  <changelog author="mpluskal@suse.com" date="1584360000">- Update to version B.02.18+git.20191228:
  * fix #755: handle invalid FAT
  * code clean-up
  * volumes: Add support for detecting Apple APFS fstype
  * partitions: Add Apple APFS GUID
  * specfile: Fix version issue
  * Do not show modified time with -notime option
  * Update help message and man page
- Drop upstreamed patches:
  * lshw-help-man.patch
  * lshw-modified-time.patch
- Add lshw-nvme.patch to support nvme devices bsc#1161323</changelog>
  <changelog author="mpluskal@suse.com" date="1585569600">- Update to version B.02.19.2:
  * New release tagged, no significant changes from previous
    version (git snapsho)
- Drop no longer needed patches:
  * lshw-display-latest-version.patch
  * lshw-add-notime-option-to-manpage.patch
  * lshw-nvme.patch</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1587643200">- Disable LTO for aarch64 &amp; PowerPC, bypass boo#1168865</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1587729600">- Reenable LTO for powerpc and aarch64
- Fix PowerPC and aarch64 LTO: boo#1168865 and boo#1169668
  * lshw-fix-segfault-in-apfs-volume-code.patch
- Fix aarch64 SIGABRT: (boo#1169668)
  * lshw-fix-mmc.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1598875200">- Fix detection of ppc products - boo#1172156
  * lshw-fix-ppc.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1611662400">- Display UUID on Power VM LPAR (bsc#1181411 ltc#191040)
  * lshw-devtree-Add-UUID-property.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1622030400">- Update to version B.02.19+git.20210429:
  * Fix getting size of memory banks &lt;32GiB
  * devtree: Add UUID property
  * code clean-up
  * improve portability (esp. musl)
  * fix potential crash
  * add static target to Makefile
  * Avoid crash on device-tree parsing
  * Add JEDEC manufacturer
  * Report correct memory size on SMBIOS &lt; 2.7
  * fix man page after previous update
- Drop no longer needed patches:
  * lshw-fix-segfault-in-apfs-volume-code.patch
  * lshw-fix-mmc.patch
  * lshw-fix-ppc.patch
  * lshw-devtree-Add-UUID-property.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1624536000">- Update to version B.02.19+git.20210619:
  * Fix typos in translatable messages
- jsc#SLE-19399</changelog>
  <changelog author="mpluskal@suse.com" date="1628078400">- Update versioning to to allow easy transition on SLE
- Disable parallel build to avoid random failures</changelog>
  <changelog author="mpluskal@suse.com" date="1634212800">- Update to version B.02.19.2+git.20211013:
  * add some includes
  * fix typo
  * cosmetic fixes
  * support for new ethtool capabilities
  * code clean-up
  * code clean-up
  * allow pkg-config override
  * allow pkg-config override
  * Remove unnecessary space before closing parenthesis
  * Translate all words of a phrase together
  * Fix another typo</changelog>
  <changelog author="mpluskal@suse.com" date="1636632000">- Update to version B.02.19.2+git.20211102:
  * merge Github PR#77
  * use max (9) Gzip compression
  * Add Catalan translation
  * Update POT file
  * Add more network speeds</changelog>
  <changelog author="mpluskal@suse.com" date="1642766400">- Update to version B.02.19.2+git.20211222:
  * Add Spanish translation
  * Fix mistakes in Catalan translation</changelog>
  <changelog author="mpluskal@suse.com" date="1648468800">- Update to version B.02.19.2+git.20220310:
  * Github PR85  Set product name for all netdevs sharing the same PCI number</changelog>
  <changelog author="mpluskal@suse.com" date="1658836800">- Update to version B.02.19.2+git.20220628 (jsc#526):
  * make version check optional</changelog>
</package>
<package pkgid="b83a1b5feb9a0dcc86e2ebd2cb7955767bf9c88d14ffaae72c4ecf3df46025fb" name="lvm2" arch="aarch64">
  <version epoch="0" ver="2.03.05" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="c1bd3e7d995f5acacf688cae6b8070937defe112662a8085b9a28273cc74335b" name="lvm2" arch="src">
  <version epoch="0" ver="2.03.05" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="b7da48e441798670ef2954aae26276510eb7dca8d78a627f4c552d0e802b9583" name="lvm2" arch="x86_64">
  <version epoch="0" ver="2.03.05" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="833afa27ddb1f1e7929ef1af4b1163fd25482321745606c4f3ae5e5b602e41fd" name="lvm2-device-mapper" arch="src">
  <version epoch="0" ver="2.03.05" rel="150200.8.49.1"/>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1639656000">- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch</changelog>
  <changelog author="mwilck@suse.com" date="1643716800">- udev: create symlinks and watch even in suspended state (bsc#1195231)
  + bug-1195231-udev-create-symlinks-and-watch-even-in-suspended-sta.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1662120000">- lvm2.spec %post deletes libdevmapper and triggers kernel panic (bsc#1198523)
  - change %post behaviour, only do deleting job for non-link folder</changelog>
  <changelog author="heming.zhao@suse.com" date="1667217600">- dracut-initqueue timeouts with 5.3.18-150300.59.63 kernel on ppc64le (bsc#1199074)
  - in lvm2.spec, change device_mapper_version from 1.02.163 to %{lvm2_version}_1.02.163</changelog>
  <changelog author="amit.chaudhary@suse.com" date="1667822400">- killed lvmlockd doesn't clear/adopt locks leading to inability to start volume group (bsc#1203216)
  - bug-1203216_lvmlockd-purge-the-lock-resources-left-in-previous-l.patch</changelog>
</package>
<package pkgid="5935e9ddffe7d07540238d26c986f01da55dfe9b4d6389a8bd19a1aa82d01d0c" name="mdadm" arch="aarch64">
  <version epoch="0" ver="4.1" rel="150300.24.15.1"/>
  <changelog author="colyli@suse.com" date="1553774400">- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch</changelog>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
</package>
<package pkgid="e21082a0a0a26efe2c056d5dea593fc814d3de3e8bb602544496024a3c9ea66e" name="mdadm" arch="src">
  <version epoch="0" ver="4.1" rel="150300.24.15.1"/>
  <changelog author="colyli@suse.com" date="1553774400">- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch</changelog>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
</package>
<package pkgid="620b156c4f2714eb184bf6bc8ae81ffe904dc693c9107d60cb9fa52a9c642799" name="mdadm" arch="x86_64">
  <version epoch="0" ver="4.1" rel="150300.24.15.1"/>
  <changelog author="colyli@suse.com" date="1553774400">- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch</changelog>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
</package>
<package pkgid="b5da737eae2791f2bc8031282a1b632942e06b2e50ad2cce7546877ea24fa03c" name="mdadm" arch="aarch64">
  <version epoch="0" ver="4.1" rel="150300.24.18.1"/>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
  <changelog author="colyli@suse.com" date="1660219200">- imsm: support for third Sata controller (bsc#1201297)
  0122-imsm-support-for-third-Sata-controller.patch
- mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297)
  1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch</changelog>
</package>
<package pkgid="72d4f6c6629916b3ba3c49d1434c09655cfac5e08fd320e8874d40eb00435928" name="mdadm" arch="src">
  <version epoch="0" ver="4.1" rel="150300.24.18.1"/>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
  <changelog author="colyli@suse.com" date="1660219200">- imsm: support for third Sata controller (bsc#1201297)
  0122-imsm-support-for-third-Sata-controller.patch
- mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297)
  1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch</changelog>
</package>
<package pkgid="bb9a7d413c422bae863000ec5f9644b7cd5feab50438d0621324150c56282134" name="mdadm" arch="x86_64">
  <version epoch="0" ver="4.1" rel="150300.24.18.1"/>
  <changelog author="colyli@suse.com" date="1566820800">- 0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
  (bsc#1139709)
  mdadm: add --no-devices to avoid component devices detail
  information
- 0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
  (bsc#1139709)
  udev: add --no-devices option for calling 'mdadm --detail'</changelog>
  <changelog author="nfbrown@suse.com" date="1572436800">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236800">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583236801">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617278400">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630584000">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
  <changelog author="colyli@suse.com" date="1660219200">- imsm: support for third Sata controller (bsc#1201297)
  0122-imsm-support-for-third-Sata-controller.patch
- mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297)
  1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch</changelog>
</package>
<package pkgid="1300d16a47bd29db4e27e8ad7802e4dbcb4d8599212aa654799727e532a7a1c7" name="mdadm" arch="aarch64">
  <version epoch="0" ver="4.1" rel="150300.24.21.1"/>
  <changelog author="nfbrown@suse.com" date="1572350400">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583150400">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583150401">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617192000">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630497600">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
  <changelog author="colyli@suse.com" date="1660219200">- imsm: support for third Sata controller (bsc#1201297)
  0122-imsm-support-for-third-Sata-controller.patch
- mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297)
  1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch</changelog>
  <changelog author="colyli@suse.com" date="1663588800">- mdadm.spec: add EXTRAVERSION string to make command line
  (jsc#SLE-24761, bsc#1193566)</changelog>
</package>
<package pkgid="a1a545baa6d5c34eda26ae2549f74431177260314a35b66fc35124e12982ed18" name="mdadm" arch="src">
  <version epoch="0" ver="4.1" rel="150300.24.21.1"/>
  <changelog author="nfbrown@suse.com" date="1572350400">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583150400">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583150401">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617192000">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630497600">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
  <changelog author="colyli@suse.com" date="1660219200">- imsm: support for third Sata controller (bsc#1201297)
  0122-imsm-support-for-third-Sata-controller.patch
- mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297)
  1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch</changelog>
  <changelog author="colyli@suse.com" date="1663588800">- mdadm.spec: add EXTRAVERSION string to make command line
  (jsc#SLE-24761, bsc#1193566)</changelog>
</package>
<package pkgid="66f74576b5e51e19934f7e2936e7c4787485fbcd84f2f958c6abd0ab2aee3ddc" name="mdadm" arch="x86_64">
  <version epoch="0" ver="4.1" rel="150300.24.21.1"/>
  <changelog author="nfbrown@suse.com" date="1572350400">- New patch: 0022-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
  New patch: 0023-mdcheck-use-to-pass-variable-to-mdcheck.patch
  New patch: 0024-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
  Improve systemd units for mdcheck (bsc#1153258)</changelog>
  <changelog author="colyli@suse.com" date="1581076800">- Create: add support for RAID0 layouts. (bsc#1162479)
  0024-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0025-Assemble-add-support-for-RAID0-layouts.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1581076801">- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0026-Enable-probe_roms-to-scan-more-than-6-roms.patch</changelog>
  <changelog author="colyli@suse.com" date="1583150400">- Rename the following patches, they will be listed with new
  re-ordered prefix number in following commit,
    0001-Document-PART-POLICY-lines.patch
    0001-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
    0002-policy-support-devices-with-multiple-paths.patch
    0003-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
    0004-Monitor-add-system-timer-to-run-oneshot-periodically.patch
    0005-imsm-update-metadata-correctly-while-raid10-double-d.patch
    0006-Grow-avoid-overflow-in-compute_backup_blocks.patch
    0007-Grow-report-correct-new-chunk-size.patch
    0008-policy.c-prevent-NULL-pointer-referencing.patch
    0009-Detail.c-do-not-skip-first-character-when-calling-xs.patch
    0010-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
    0011-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
    0012-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
    0013-udev-add-no-devices-option-for-calling-mdadm-detail.patch
    0021-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
    0022-mdcheck-use-to-pass-variable-to-mdcheck.patch
    0023-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
    0024-Create-add-support-for-RAID0-layouts.patch
    0025-Assemble-add-support-for-RAID0-layouts.patch
    0026-Enable-probe_roms-to-scan-more-than-6-roms.patch
    1002-mdadm.8-add-note-information-for-raid0-growing-opera.patch</changelog>
  <changelog author="colyli@suse.com" date="1583150401">- Update for latest mdadm-4.1+ patches, this is required by
  jsc#SLE-10078 and jsc#SLE-9348. Mostly the purpose is for
  latest Intel IMSM raid support.
  The following patches also include previous patches with
  new re-ordered prefix numbers.
- Makefile: install mdadm_env.sh to /usr/lib/mdadm (bsc#1111960)
  0000-Makefile-install-mdadm_env.sh-to-usr-lib-mdadm.patch
- Assemble: keep MD_DISK_FAILFAST and MD_DISK_WRITEMOSTLY flag
  (jsc#SLE-10078, jsc#SLE-9348)
  0001-Assemble-keep-MD_DISK_FAILFAST-and-MD_DISK_WRITEMOST.patch
- Document PART-POLICY lines (jsc#SLE-10078, jsc#SLE-9348)
  0002-Document-PART-POLICY-lines.patc
- policy: support devices with multiple paths.
  (jsc#SLE-10078, jsc#SLE-9348)
  0003-policy-support-devices-with-multiple-paths.patch
- mdcheck: add systemd unit files to run mdcheck. (bsc#1115407)
  0004-mdcheck-add-systemd-unit-files-to-run-mdcheck.patch
- Monitor: add system timer to run --oneshot periodically (bsc#1115407)
  0005-Monitor-add-system-timer-to-run-oneshot-periodically.patch
- imsm: update metadata correctly while raid10 double
  (jsc#SLE-10078, jsc#SLE-9348)
  0006-imsm-update-metadata-correctly-while-raid10-double-d.patch
- Assemble: mask FAILFAST and WRITEMOSTLY flags when finding
  (jsc#SLE-10078, jsc#SLE-9348)
  0007-Assemble-mask-FAILFAST-and-WRITEMOSTLY-flags-when-fi.patch
- Grow: avoid overflow in compute_backup_blocks()
  (jsc#SLE-10078, jsc#SLE-9348)
  0008-Grow-avoid-overflow-in-compute_backup_blocks.patch
- Grow: report correct new chunk size. (jsc#SLE-10078, jsc#SLE-9348)
  0009-Grow-report-correct-new-chunk-size.patch
- policy.c: prevent NULL pointer referencing (bsc#1106078)
  0010-policy.c-prevent-NULL-pointer-referencing.patch
- policy.c: Fix for compiler error (jsc#SLE-10078, jsc#SLE-9348)
  0012-policy.c-Fix-for-compiler-error.patch
- imsm: finish recovery when drive with rebuild fails (bsc#1126975)
  0013-imsm-finish-recovery-when-drive-with-rebuild-fails.patch
- imsm: fix reshape for &gt;2TB drives (jsc#SLE-10078, jsc#SLE-9348)
  0014-imsm-fix-reshape-for-2TB-drives.patch
- Fix spelling typos. (jsc#SLE-10078, jsc#SLE-9348)
  0015-Fix-spelling-typos.patch
- Detail.c: do not skip first character when calling xstrdup in
  Detail() (bsc#1123814)
  0016-Detail.c-do-not-skip-first-character-when-calling-xs.patch
- Fix reshape for decreasing data offset (jsc#SLE-10078, jsc#SLE-9348)
  0018-Fix-reshape-for-decreasing-data-offset.patch
- mdadm/tests: add one test case for failfast of raid1
  (jsc#SLE-10078, jsc#SLE-9348)
  0019-mdadm-tests-add-one-test-case-for-failfast-of-raid1.patch
- mdmon: don't attempt to manage new arrays when terminating
  (bsc#1127526)
  0020-mdmon-don-t-attempt-to-manage-new-arrays-when-termin.patch
- mdmon: wait for previous mdmon to exit during takeover
  (jsc#SLE-10078, jsc#SLE-9348)
  0021-mdmon-wait-for-previous-mdmon-to-exit-during-takeove.patch
- Assemble: Fix starting array with initial reshape checkpoint
  (jsc#SLE-10078, jsc#SLE-9348)
  0022-Assemble-Fix-starting-array-with-initial-reshape-che.patch
- add missing units to --examine (jsc#SLE-10078, jsc#SLE-9348)
  0023-add-missing-units-to-examine.patch
- imsm: fix spare activation for old matrix arrays
  (jsc#SLE-10078, jsc#SLE-9348)
  0024-imsm-fix-spare-activation-for-old-matrix-arrays.patch
- Create: Block rounding size to max (jsc#SLE-10078, jsc#SLE-9348)
  0025-Create-Block-rounding-size-to-max.patch
- udev: Add udev rules to create by-partuuid for md device
  (jsc#SLE-10078, jsc#SLE-9348)
  0026-udev-Add-udev-rules-to-create-by-partuuid-for-md-dev.patch
- mdmon: fix wrong array state when disk fails during mdmon
  (jsc#SLE-10078, jsc#SLE-9348)
  0027-mdmon-fix-wrong-array-state-when-disk-fails-during-m.patch
- Enable probe_roms to scan more than 6 roms. (bsc#1156040)
  0028-Enable-probe_roms-to-scan-more-than-6-roms.patch
- super-intel: Fix issue with abs() being irrelevant
  (jsc#SLE-10078, jsc#SLE-9348)
  0029-super-intel-Fix-issue-with-abs-being-irrelevant.patch
- mdadm.h: Introduced unaligned {get,put}_unaligned{16,32}()
  (jsc#SLE-10078, jsc#SLE-9348)
  0030-mdadm.h-Introduced-unaligned-get-put-_unaligned-16-3.patch
- super-intel: Use put_unaligned in split_ull
  (jsc#SLE-10078, jsc#SLE-9348)
  0031-super-intel-Use-put_unaligned-in-split_ull.patch
- mdadm: load default sysfs attributes after assemblation
  (jsc#SLE-10078, jsc#SLE-9348)
  0032-mdadm-load-default-sysfs-attributes-after-assemblati.patch
- mdadm.h: include sysmacros.h unconditionally
  (jsc#SLE-10078, jsc#SLE-9348)
  0033-mdadm.h-include-sysmacros.h-unconditionally.patch
- mdadm: add --no-devices to avoid component devices detail
  (bsc#1139709)
  0034-mdadm-add-no-devices-to-avoid-component-devices-deta.patch
- udev: add --no-devices option for calling 'mdadm (bsc#1139709)
  0035-udev-add-no-devices-option-for-calling-mdadm-detail.patch
- imsm: close removed drive fd. (jsc#SLE-10078, jsc#SLE-9348)
  0036-imsm-close-removed-drive-fd.patch
- mdadm: check value returned by snprintf against errors
  (jsc#SLE-10078, jsc#SLE-9348)
  0037-mdadm-check-value-returned-by-snprintf-against-error.patch
- mdadm: Introduce new array state 'broken' for raid0/linear
  (jsc#SLE-10078, jsc#SLE-9348)
  0038-mdadm-Introduce-new-array-state-broken-for-raid0-lin.patch
- mdadm: force a uuid swap on big endian (jsc#SLE-10078, jsc#SLE-9348)
  0039-mdadm-force-a-uuid-swap-on-big-endian.patch
- mdadm/md.4: add the descriptions for bitmap sysfs nodes
  (jsc#SLE-10078, jsc#SLE-9348)
  0040-mdadm-md.4-add-the-descriptions-for-bitmap-sysfs-nod.patch
- Init devlist as an array (jsc#SLE-10078, jsc#SLE-9348)
  0041-Init-devlist-as-an-array.patch
- Don't need to check recovery after re-add when no I/O writes
  (jsc#SLE-10078, jsc#SLE-9348)
  0042-Don-t-need-to-check-recovery-after-re-add-when-no-I-.patch
- udev: allow for udev attribute reading bug.
  (jsc#SLE-10078, jsc#SLE-9348)
  0043-udev-allow-for-udev-attribute-reading-bug.patch
- imsm: save current_vol number (jsc#SLE-10078, jsc#SLE-9348)
  0044-imsm-save-current_vol-number.patch
- imsm: allow to specify second volume size
  (jsc#SLE-10078, jsc#SLE-9348)
  0045-imsm-allow-to-specify-second-volume-size.patch
- mdcheck: when mdcheck_start is enabled, enable (bsc#1153258)
  0046-mdcheck-when-mdcheck_start-is-enabled-enable-mdcheck.patch
- mdcheck: use ${} to pass variable to mdcheck (bsc#1153258)
  0050-mdcheck-use-to-pass-variable-to-mdcheck.patch
- SUSE-mdadm_env.sh: handle MDADM_CHECK_DURATION (bsc#1153258)
  0051-SUSE-mdadm_env.sh-handle-MDADM_CHECK_DURATION.patch
- super-intel: don't mark structs 'packed' unnecessarily
  (jsc#SLE-10078, jsc#SLE-9348)
  0052-super-intel-don-t-mark-structs-packed-unnecessarily.patch
- Manage: Remove the legacy code for md driver prior to 0.90.03
  (jsc#SLE-10078, jsc#SLE-9348)
  0053-Manage-Remove-the-legacy-code-for-md-driver-prior-to.patch
- Remove last traces of HOT_ADD_DISK (jsc#SLE-10078, jsc#SLE-9348)
  0054-Remove-last-traces-of-HOT_ADD_DISK.patch
- Fix up a few formatting issues (jsc#SLE-10078, jsc#SLE-9348)
  0055-Fix-up-a-few-formatting-issues.patch
- Remove unused code (jsc#SLE-10078, jsc#SLE-9348)
  0056-Remove-unused-code.patch
- imsm: return correct uuid for volume in detail
  (jsc#SLE-10078, jsc#SLE-9348)
  0057-imsm-return-correct-uuid-for-volume-in-detail.patch
- imsm: Change the way of printing nvme drives in
  (jsc#SLE-10078, jsc#SLE-9348)
  0058-imsm-Change-the-way-of-printing-nvme-drives-in-detai.patch
- Create: add support for RAID0 layouts. (bsc#1162479)
  0059-Create-add-support-for-RAID0-layouts.patch
- Assemble: add support for RAID0 layouts. (bsc#1162479)
  0060-Assemble-add-support-for-RAID0-layouts.patch
- Respect $(CROSS_COMPILE) when $(CC) is the default
  (jsc#SLE-10078, jsc#SLE-9348)
  0061-Respect-CROSS_COMPILE-when-CC-is-the-default.patch
- Change warning message (jsc#SLE-10078, jsc#SLE-9348)
  0062-Change-warning-message.patch
- mdcheck service can't start succesfully because of syntax
  (jsc#SLE-10078, jsc#SLE-9348)
  0063-mdcheck-service-can-t-start-succesfully-because-of-s.patch
- imsm: Update grow manual. (jsc#SLE-10078, jsc#SLE-9348)
  0064-imsm-Update-grow-manual.patch
- Add support for Tebibytes (jsc#SLE-10078, jsc#SLE-9348)
  0065-Add-support-for-Tebibytes.patch
- imsm: fill working_disks according to metadata.
  (jsc#SLE-10078, jsc#SLE-9348)
  0066-imsm-fill-working_disks-according-to-metadata.patch
- mdadm.8: add note information for raid0 growing operation
  (bsc#1129900)
  0067-mdadm.8-add-note-information-for-raid0-growing-opera.patch
- Remove the legacy whitespace (jsc#SLE-10078, jsc#SLE-9348)
  0068-Remove-the-legacy-whitespace.patch
- imsm: pass subarray id to kill_subarray function
  (jsc#SLE-10078, jsc#SLE-9348)
  0069-imsm-pass-subarray-id-to-kill_subarray-function.patch
- imsm: Remove --dump/--restore implementation
  (jsc#SLE-10078, jsc#SLE-9348)
  0070-imsm-Remove-dump-restore-implementation.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827200">- Detail: adding sync status for cluster device
  (bsc#1163727)
  0072-Detail-adding-sync-status-for-cluster-device.patch
- Monitor: improve check_one_sharer() for checking duplicated process
  (bsc#1168953)
  0071-Monitor-improve-check_one_sharer-for-checking-duplic.patch</changelog>
  <changelog author="colyli@suse.com" date="1592827201">- OnCalendar format fix of mdcheck_start.timer (bsc#1173137)
  1002-OnCalendar-format-fix-of-mdcheck_start-timer.patch</changelog>
  <changelog author="colyli@suse.com" date="1598788800">- mdadm: treat the Dell softraid array as local array (bsc#1175004)
  1003-mdadm-treat-the-Dell-softraid-array-as-local-array.patch</changelog>
  <changelog author="colyli@suse.com" date="1602417600">- Update to latest mdadm which is requested by jsc#SLE-13700 from
  partners. Mostly the purpose is for latest Intel IMSM raid
  support, while some other fixes are important too.
- imsm: Correct minimal device size (jsc#SLE-13700)
  0073-imsm-Correct-minimal-device-size.patch
- Detail: show correct bitmap info for cluster raid device
  (jsc#SLE-13700)
  0074-Detail-show-correct-bitmap-info-for-cluster-raid-dev.patch
- imsm: support the Array Creation Time field in metadata
  (jsc#SLE-13700)
  0075-imsm-support-the-Array-Creation-Time-field-in-metada.patch
- imsm: show Subarray and Volume ID in --examine output
  (jsc#SLE-13700)
  0076-imsm-show-Subarray-and-Volume-ID-in-examine-output.patch
- udev: Ignore change event for imsm (jsc#SLE-13700)
  0077-udev-Ignore-change-event-for-imsm.patch
- Manage, imsm: Write metadata before add (jsc#SLE-13700)
  0078-Manage-imsm-Write-metadata-before-add.patch
- Assemble: print error message if mdadm fails assembling
  with --uuid option (jsc#SLE-13700)
  0079-Assemble-print-error-message-if-mdadm-fails-assembli.patch
- clean up meaning of small typo (jsc#SLE-13700)
  0080-clean-up-meaning-of-small-typo.patch
- Assemble.c: respect force flag (jsc#SLE-13700)
  0081-Assemble.c-respect-force-flag.patch
- mdcheck: Log when done (jsc#SLE-13700)
  0082-mdcheck-Log-when-done.patch
- Makefile: add EXTRAVERSION support (jsc#SLE-13700)
  0083-Makefile-add-EXTRAVERSION-support.patch
- uuid.c: split uuid stuffs from util.c (jsc#SLE-13700)
  0084-uuid.c-split-uuid-stuffs-from-util.c.patch
- Include count for \0 character when using strncpy to
  implement strdup. (jsc#SLE-13700)
  0085-Include-count-for-0-character-when-using-strncpy-to-.patch
- restripe: fix ignoring return value of read and lseek
  (jsc#SLE-13700)
  0086-restripe-fix-ignoring-return-value-of-read-and-lseek.patch
- Block overwriting existing links while manual assembly
  (jsc#SLE-13700)
  0087-Block-overwriting-existing-links-while-manual-assemb.patch
- Detect too-small device: error rather than underflow/crash
  (jsc#SLE-13700)
  0088-Detect-too-small-device-error-rather-than-underflow-.patch
- Use more secure HTTPS URLs  (jsc#SLE-13700)
  0089-Use-more-secure-HTTPS-URLs.patch
- Update link to Intel page for IMSM (jsc#SLE-13700)
  0090-Update-link-to-Intel-page-for-IMSM.patch
- mdadm/Grow: prevent md's fd from being occupied during delayed time
  (jsc#SLE-13700)
  0091-mdadm-Grow-prevent-md-s-fd-from-being-occupied-durin.patch
- Specify nodes number when updating cluster nodes (jsc#SLE-13700)
  0092-Specify-nodes-number-when-updating-cluster-nodes.patch
- mdadm/md.4: update path to in-kernel-tree documentation
  (jsc#SLE-13700)
  0093-mdadm-md.4-update-path-to-in-kernel-tree-documentati.patch
- manual: update --examine-badblocks (jsc#SLE-13700)
  0094-manual-update-examine-badblocks.patch</changelog>
  <changelog author="colyli@suse.com" date="1607169600">- There are some important fixes merged in mdadm upstream which
  should go with jsc#SLE-13700. This is the update from upstream
  mdadm including the important fixes we should have.
- Detail: show correct raid level when the array is inactive
  (jsc#SLE-13700)
  0095-Detail-show-correct-raid-level-when-the-array-is-ina.patch
- Don't create bitmap for raid5 with journal disk
  (jsc#SLE-13700)
  0096-Don-t-create-bitmap-for-raid5-with-journal-disk.patch
- Monitor: refresh mdstat fd after select (jsc#SLE-13700)
  0097-Monitor-refresh-mdstat-fd-after-select.patch
- Monitor: stop notifing about containers.  (jsc#SLE-13700)
  0098-Monitor-stop-notifing-about-containers.patch
- mdmonitor: set small delay once (jsc#SLE-13700)
  0099-mdmonitor-set-small-delay-once.patch
- Check if other Monitor instance running before fork.
  (jsc#SLE-13700)
  0100-Check-if-other-Monitor-instance-running-before-fork.patch
- Super1: allow RAID0 layout setting to be removed.
  (jsc#SLE-13700)
  0101-Super1-allow-RAID0-layout-setting-to-be-removed.patch
- Detail: fix segfault during IMSM raid creation
  (jsc#SLE-13700)
  0102-Detail-fix-segfault-during-IMSM-raid-creation.patch
- Create.c: close mdfd and generate uevent (jsc#SLE-13700)
  0103-Create.c-close-mdfd-and-generate-uevent.patch
- imsm: update num_data_stripes according to dev_size
  (jsc#SLE-13700)
  0104-imsm-update-num_data_stripes-according-to-dev_size.patch
- imsm: remove redundant calls to imsm_get_map (jsc#SLE-13700)
  0105-imsm-remove-redundant-calls-to-imsm_get_map.patch
- Monitor: don't use default modes when creating a file
  (jsc#SLE-13700)
  0106-Monitor-don-t-use-default-modes-when-creating-a-file.patch
- imsm: limit support to first NVMe namespace (jsc#SLE-13700)
  0107-imsm-limit-support-to-first-NVMe-namespace.patch
- mdadm: Unify forks behaviour (jsc#SLE-13700)
  0108-mdadm-Unify-forks-behaviour.patch
- mdadm/Detail: show correct state for clustered array
  (jsc#SLE-13700)
  0109-mdadm-Detail-show-correct-state-for-clustered-array.patch
- Make target to install binaries only (jsc#SLE-13700)
  0110-Make-target-to-install-binaries-only.patch
- udev: start grow service automatically (jsc#SLE-13700)
  0111-udev-start-grow-service-automatically.patch</changelog>
  <changelog author="colyli@suse.com" date="1609848000">- Incremental: Remove redundant spare movement logic
  (jsc#SLE-13700, bsc#1180220)
  0112-Incremental-Remove-redundant-spare-movement-logic.patch
- Dump: get stat from a wrong metadata file when restoring metadata
  (jsc#SLE-13700)
  0113-Dump-get-stat-from-a-wrong-metadata-file-when-restor.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1617192000">- cluster-md/mdadm : avoid useless re-sync (bsc#1181341)
  0114-super1-fix-Floating-point-exception.patch
  0115-super1.c-avoid-useless-sync-when-bitmap-switches-fro.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993600">- imsm: nvme multipath support (bsc#1175758)
  0116-imsm-nvme-multipath-support.patch</changelog>
  <changelog author="colyli@suse.com" date="1620993601">- Grow: be careful of corrupt dev_roles list (bsc#1181619)
  0117-Grow-be-careful-of-corrupt-dev_roles-list.patch</changelog>
  <changelog author="colyli@suse.com" date="1630497600">- Remove Spare drives line from details for external metadata
  (bsc#1180661, bsc#1182642)
  0118-Remove-Spare-drives-line-from-details-for-external-m.patch
- Don't associate spares with other arrays during RAID Examine
  (bsc#1180661, bsc#1182642)
  0119-Don-t-associate-spares-with-other-arrays-during-RAID.patch</changelog>
  <changelog author="colyli@suse.com" date="1645012800">- Monitor: print message before quit for no array to monitor
  (bsc#1183229)
  0120-Monitor-print-message-before-quit-for-no-array-to-mo.patch</changelog>
  <changelog author="mwilck@suse.com" date="1647604800">- skip RAID assembly if DM_UDEV_DISABLE_OTHER_RULES_FLAG (bsc#1196054)
  * Add 0121-udev-md-raid-assembly.rules-skip-if-DM_UDEV_DISABLE_.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1653912000">- resource RAID failed during cluster patch, Mdadm gets floating point error (bsc#1197158)
  1004-mdadm-super1-restore-commit-45a87c2f31335-to-fix-clu.patch</changelog>
  <changelog author="colyli@suse.com" date="1660219200">- imsm: support for third Sata controller (bsc#1201297)
  0122-imsm-support-for-third-Sata-controller.patch
- mdadm: enable Intel Alderlake RSTe configuration (bsc#1201297)
  1005-mdadm-enable-Intel-Alderlake-RSTe-configuration.patch</changelog>
  <changelog author="colyli@suse.com" date="1663588800">- mdadm.spec: add EXTRAVERSION string to make command line
  (jsc#SLE-24761, bsc#1193566)</changelog>
</package>
<package pkgid="c2c5fe56136f9eb7e64292b1c765a4809caa5e344ccce91ffb3b79c5495f6b72" name="mozilla-nspr" arch="aarch64">
  <version epoch="0" ver="4.34" rel="150000.3.23.1"/>
  <changelog author="wr@rosenauer.org" date="1501934400">- update to version 4.15
  * added TCP Fast Open functionality
  * various correctness fixes</changelog>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
</package>
<package pkgid="dac9f6d2f2955d5488b0277eaaa9196c655d5705e3576cdae7d07c57e8ec4721" name="mozilla-nspr" arch="src">
  <version epoch="0" ver="4.34" rel="150000.3.23.1"/>
  <changelog author="wr@rosenauer.org" date="1501934400">- update to version 4.15
  * added TCP Fast Open functionality
  * various correctness fixes</changelog>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
</package>
<package pkgid="ebe59609738318394618ccc19f9d6d8c32633ecfb5d73b16be903145c6103fac" name="mozilla-nspr" arch="x86_64">
  <version epoch="0" ver="4.34" rel="150000.3.23.1"/>
  <changelog author="wr@rosenauer.org" date="1501934400">- update to version 4.15
  * added TCP Fast Open functionality
  * various correctness fixes</changelog>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
</package>
<package pkgid="f53b007a7660313eac597b391ba1c6d5ecd51b25ebcae6cbadde7f8d2ae86ab4" name="mozilla-nspr" arch="aarch64">
  <version epoch="0" ver="4.34.1" rel="150000.3.26.1"/>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1660132800">- update to version 4.34.1
  * add file descriptor sanity checks in the NSPR poll function.</changelog>
</package>
<package pkgid="f2c8f774b5a1fe5a42938e5fa53f04846c9b3f5738826ba1a02b59d12d67dd5a" name="mozilla-nspr" arch="src">
  <version epoch="0" ver="4.34.1" rel="150000.3.26.1"/>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1660132800">- update to version 4.34.1
  * add file descriptor sanity checks in the NSPR poll function.</changelog>
</package>
<package pkgid="2f8e8c4c8be9df8e92e459866bda9d7df429c971ca1ee0b1afaa67c00163b22f" name="mozilla-nspr" arch="x86_64">
  <version epoch="0" ver="4.34.1" rel="150000.3.26.1"/>
  <changelog author="wr@rosenauer.org" date="1505217600">- update to version 4.16
  * contains various correctness fixes
    see
    https://bugzilla.mozilla.org/buglist.cgi?resolution=FIXED&amp;query_format=advanced&amp;product=NSPR&amp;target_milestone=4.16
    for details</changelog>
  <changelog author="wr@rosenauer.org" date="1506859200">- update to version 4.17
  * changes to the Windows implementation of the networking code
    required for Firefox 57
  * a FreeBSD build fix (bmo#1391716)</changelog>
  <changelog author="wr@rosenauer.org" date="1518004800">- update to version 4.18
  * removed HP-UX DCE threads support
  * improvements for the Windows implementation of PR_SetCurrentThreadName
  * fixes for the Windows implementation of TCP Fast Open</changelog>
  <changelog author="cgrobertson@suse.com" date="1521115200">- update to version 4.19
  * changed order of shutdown cleanup to avoid a crash on Mac OSX
  * build compatibility with Android NDK r16 and glibc 2.26</changelog>
  <changelog author="alarrosa@suse.com" date="1540814400">- update to version 4.20
  * abstract socket address support for Linux (incl. Android)
  * aarch64 support for Windows
  * support for riscv64</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1563192000">- update to version 4.21
  * Use MAP_SHARED for read-only file mappings on MacOS and
    Android.
  * Changed prbit.h to use builtin function on aarch64.
  * Test program build fixes.
  * Minor fixes to support unified builds.
  * Update library copyright notices.
  * Removed Gonk/B2G references.</changelog>
  <changelog author="cgrobertson@suse.com" date="1574424000">- Use FAT LTO objects in order to provide proper static library</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1575460800">- update to version 4.23
  * fixed a build failure that was introduced in 4.22
  * correctness fix for Win64 socket polling
  * whitespace in C files was cleaned up and no longer uses
    tab characters for indenting
- update to version 4.22
  * added support for the ARC architecture
  * removed support for the following platforms:
    OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  * correctness and build fixes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1579089600">- update to version 4.24
  * added macro PR_ASSERT_ARG
  * removed some declarations
  * added support for Nios-II, Nds32 and Microblaze architectures</changelog>
  <changelog author="wr@rosenauer.org" date="1583236800">- update to version 4.25
  * fixed reading files larger than 4 GB on Win32
  * added support for Xtensa architecture</changelog>
  <changelog author="wr@rosenauer.org" date="1595505600">- update to version 4.26
  * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get
    information about the operating system build version.
  * Better support parallel building on Windows.
  * The internal release automatic script requires python 3.</changelog>
  <changelog author="wr@rosenauer.org" date="1598097600">- update to version 4.27
  * the macOS platform code for shared library loading was
    changed to support macOS 11.
    If the absolute path parameter given to PR_LoadLibrary
    begins with either /System/ or /usr/lib/ then no test is
    performed if the library exists at a file.
  * An include statement for a Windows system library header
    was added</changelog>
  <changelog author="wr@rosenauer.org" date="1599566400">- update to version 4.28
  * Fix a compiler warning
  * Add rule for cross-compiling with cygwin</changelog>
  <changelog author="wr@rosenauer.org" date="1601467200">- update to version 4.29
  * Remove macOS Code Fragment Manager support code
  * Remove XP_MACOSX and OS_TARGET=MacOSX
  * Refresh config.guess and config.sub
  * Remove NSPR's patch to config.sub
  * Add support for e2k target (64-bit Elbrus 2000)</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to version 4.30
  * support longer thread names on macOS
  * fix a build failure on OpenBSD</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to version 4.31:
  * Lock access to PRCallOnceType members in PR_CallOnce* for
    thread safety bmo#1686138</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627300800">- update to version 4.32:
  * implement new socket option PR_SockOpt_DontFrag
  * support larger DNS records by increasing the default buffer
    size for DNS queries</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1640779200">- update to 4.33:
  * fixes to build system and export of private symbols</changelog>
  <changelog author="wr@rosenauer.org" date="1653825600">- update to version 4.34
  * add an API that returns a preferred loopback IP on hosts that
    have two IP stacks available.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1660132800">- update to version 4.34.1
  * add file descriptor sanity checks in the NSPR poll function.</changelog>
</package>
<package pkgid="1b9bd000e649447113c58fe5323b6e6d5f6fb0773059df91156971e30bde373d" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="0e6d218cf54060b7c7228b2a9457705e6ea91c201072b5de894f59b80e8274a1" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="5ac9be7a1c8e753bfcadd2f3aede6fcedcdcd887937ce57092fdb16b57118779" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="d0e102b927d53e57c8c4ab8a78ddc2658bd7ba01f0ef001308ecf900e6c23df3" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="68f7a213da85c9a4cb9a096be2f555d8e88425ea3705bfd66e1333942d54fbc3" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="31b08b8ac0e2a341d9b35a14b0e23931c81f04cb86b2f620d2a3bc633b277566" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="3ee8ca2ad30ca0372bc32e3fa6114c494302870a9a38f76a15c5f522ac67b919" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="6b3fa2bd98a5f66e3dfd5dcc86c5404ce1163f501c0d1bb41cce2a92e5a36a06" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="a3eed30c8125897ccf76456f41237dce942b3599cefe4cd0f07dea792c11e95f" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="3059e3b95b440fee832f50fa1c64add70b38570d637e50090297fbc1c4cd1771" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="ac19faa434069d82ec06c9fd1e0ba5b132c7033bbdb9e510c94e152622f376a5" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="b073c164747846905e2d8967a30e5a87f1c249875cc3b5ce50821554fa15cb45" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="c21a2817e54a3d4bd47d2e20c3a09ff023b8dc3624372db8893f7d206f684bdd" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="355cf44fb5499408e55f48a7f145aa9c71a6c7fdb752fb5864c0c109e9c5a56b" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="0ab40462a51c695d86223f4686a9858b1a3681700baeb3d09472357e2d666cc2" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="bca45c5f1a0beeed5e8eec2ec63ff77b698821db7db83542e8fc32d7b1754dc6" name="mozilla-nss" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="4e6783d9205305bf78fb6f7c1eeec3f74f101e1e67abb34406b3608631905b34" name="mozilla-nss" arch="src">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="3daf71a5cbef7d6e5f9a805e59f620ed0758267707014e60f7d5e71ba518b15c" name="mozilla-nss" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="c1b55797e226c80548bf5500993a5ef4456538a955298d7c293d9137f161ca2f" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="cb982210facf4c61edebb958eb7eb2ae645035453ac26c150ed2f14d6b87d97f" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="dd0d97480fdfaf4099746ca200eac4ffa2f23d0e8f0906e28d3cf0cf1377076f" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="0c6ce560a9226eccad0dcda745f34bcfa2631ec925cecf63393a81b87bcd49f9" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="11b7c943cfca4e2f556a04426232969ffb2e27a2ab4a9520b8fcbaa28ba31302" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="64caadad559c65beff516bc5e79dbfd5c4fe38fd32f7ebfae6b7126a871f3cb5" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="63334abb179bc3029e0c9c05724ae49e032f7ce3ba1627f5ccb022b9a0629485" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="5a68218c2407aedbbceaa0c3ecf1a2e7fae182995535933ff0448bb52029ed7d" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="0a3d48d7687c8edb721805f61e449f4b33a93a9e102175e549404d260ee3e26c" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="a37265e2a2ba8eac6483cf99c148383721f32333eb6829121b44771618a888c7" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="1e2612101646c0c497243b4cd5586997d493034c531314a753a5b1b864b9f773" name="mozilla-nss-certs" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="aefe449d1563ba5c39d0ee20f7bd28579f8e48a1d11e8d0f4021c0b5afa114cf" name="mozilla-nss-certs" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="8c8adf5caa99be73242cf28d3c7dcdb62f3b8c1372d580edd50276dd3ae51849" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="4a4de4586d905a13df2ec087e3581ec62995d332da5462a77b711920f65a98db" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79" rel="150000.3.74.1"/>
  <changelog author="wr@rosenauer.org" date="1615896000">- update to NSS 3.62
  * bmo#1688374 - Fix parallel build NSS-3.61 with make
  * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add()
    can corrupt "cachedCertTable"
  * bmo#1690583 - Fix CH padding extension size calculation
  * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail
  * bmo#1690421 - Install packaged libabigail in docker-builds image
  * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing
  * bmo#1674819 - Fixup a51fae403328, enum type may be signed
  * bmo#1681585 - Add ECH support to selfserv
  * bmo#1681585 - Update ECH to Draft-09
  * bmo#1678398 - Add Export/Import functions for HPKE context
  * bmo#1678398 - Update HPKE to draft-07
- required for Firefox 87</changelog>
  <changelog author="wr@rosenauer.org" date="1618747200">- update to NSS 3.63.1
  * no upstream release notes for 3.63.1 (yet)
  Fixed in 3.63
  * bmo#1697380 - Make a clang-format run on top of helpful contributions.
  * bmo#1683520 - ECCKiila P384, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual
    scalar multiplication.
  * bmo#1683520 - ECCKiila P521, change syntax of nested structs
    initialization to prevent build isses with GCC 4.8.
  * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual
    scalar multiplication.
  * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  * bmo#1694214 - tstclnt can't enable middlebox compat mode.
  * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting
    profiles.
  * bmo#1685880 - Minor fix to prevent unused variable on early return.
  * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv
    with nss build.
  * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch
    of root CA changes, CA list version 2.48.
  * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's
    'Chambers of Commerce' and 'Global Chambersign' roots.
  * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER.
  * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS.
  * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS.
  * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs
    from NSS.
  * bmo#1687822 - Turn off Websites trust bit for the ?Staat der
    Nederlanden Root CA - G3? root cert in NSS.
  * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce
    Root - 2008' and 'Global Chambersign Root - 2008?.
  * bmo#1694291 - Tracing fixes for ECH.
- required for Firefox 88</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
</package>
<package pkgid="92914010b7e7f8bee3d7dc4027d0ef49d96f55b80237c6752a5ecbe386a792bb" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="2005096d80dc78ff968b966045dd352b6d91c3d495d4b86b5914affc14760d8f" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.1" rel="150000.3.77.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1622116800">- update to NSS 3.64
  * bmo#1705286 - Properly detect mips64.
  * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and
    disable_crypto_vsx.
  * bmo#1698320 - replace __builtin_cpu_supports("vsx") with
    ppc_crypto_support() for clang.
  * bmo#1613235 - Add POWER ChaCha20 stream cipher vector
    acceleration.</changelog>
  <changelog author="wr@rosenauer.org" date="1625918400">- update to NSS 3.66
  * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  * bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  * bmo#1707097 - Add Certum Trusted Root CA to NSS.
  * bmo#1707097 - Add Certum EC-384 CA to NSS.
  * bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  * bmo#1709291 - Add VerifyCodeSigningCertificateChain.
  * Use GNU tar for the release helper script.
- update to NSS 3.65
  * bmo#1709654 - Update for NetBSD configuration.
  * bmo#1709750 - Disable HPKE test when fuzzing.
  * bmo#1566124 - Optimize AES-GCM for ppc64le.
  * bmo#1699021 - Add AES-256-GCM to HPKE.
  * bmo#1698419 - ECH -10 updates.
  * bmo#1692930 - Update HPKE to final version.
  * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  * bmo#1703936 - New coverity/cpp scanner errors.
  * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.
- refreshed patches
- Firefox 90.0 requires NSS 3.66</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1627560000">- update to NSS 3.68
  * bmo#1713562 - Fix test leak.
  * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  * bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  * bmo#1712883 - DTLS 1.3 draft-43.
  * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  * bmo#1713562 - Validate ECH public names.
  * bmo#1717610 - Add function to get seconds from epoch from pkix::Time.
- update to NSS 3.67
  * bmo#1683710 - Add a means to disable ALPN.
  * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.</changelog>
  <changelog author="hpj@suse.com" date="1629288000">- Update nss-fips-constructor-self-tests.patch to fix crashes
  reported by upstream. This was likely affecting WebRTC calls.</changelog>
  <changelog author="cgrobertson@suse.com" date="1630411200">- Removed nss-fips-kdf-self-tests.patch.  This was made
  obsolete by upstream changes. (bmo#1660304)
- Rebase nss-fips-stricter-dh.patch needed due to upstream changes.</changelog>
  <changelog author="hpj@suse.com" date="1635768000">- Update nss-fips-approved-crypto-non-ec.patch to claim 3DES
  unapproved in FIPS mode (bsc#1192080).
- Update nss-fips-constructor-self-tests.patch to allow testing
  of unapproved algorithms (bsc#1192228).
- Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086).
  This adds FIPS version indicators.
- Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087).
  Most of the relevant changes are already upstream since NSS 3.60.</changelog>
  <changelog author="hpj@suse.com" date="1637668800">- Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID
  for build.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
</package>
<package pkgid="fe3249f492fba4cde6d1a8441e5046eec710f1ea091d7186ff8d23fc41eaabbc" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="b56410b35e7bf80c962f8ba51f0373343fb8f8ac837543a23f7f944202523dfa" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.82.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1638273600">- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1638446400">- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch</changelog>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
</package>
<package pkgid="39358662d3cafceb40f573a9a6e2cbb68e4c267775748673b4eae6312ccb2549" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="2f5af9cc211e8da2cbf37fb5ae96d816da3dbd1fca04176208878e0b27b14e28" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.2" rel="150000.3.85.1"/>
  <changelog author="hpj@suse.com" date="1638792000">- Update FIPS validation string to version-release format.
- Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC
  from list of FIPS approved algorithms.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1639656000">- Mozilla NSS 3.68.2 (bsc#1193845)
  * mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses
    (bmo#966856)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
</package>
<package pkgid="1b00f87c98f74649986ee5f39d9035d00208f4f00afe5f45a78751e35d639bed" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="4a4d0588ace7f7a633826cddf0bdaf5a5bd69e3fb7bb3968f7c4717ee3bb46d0" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.3" rel="150000.3.90.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1648814400">- Mozilla NSS 3.68.3 (bsc#1197903)
  This release improves the stability of NSS when used in a multi-threaded
  environment. In particular, it fixes memory safety violations that
  can occur when PKCS#11 tokens are removed while in use (CVE-2022-1097).
  We presume that with enough effort these memory safety violations are exploitable.
  * Remove token member from NSSSlot struct (bmo#1756271).
  * Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots
    (bmo#1755555).
  * Check return value of PK11Slot_GetNSSToken (bmo#1370866).</changelog>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
</package>
<package pkgid="50121de0f5dd177bb827de4f3f581f3b0b4cfc5d8a677f07313f39eb6a975a0b" name="mozilla-nss-tools" arch="aarch64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="2d2627651e7342185250b2eb223ec2a4a505153d757696950004e58bca97c397" name="mozilla-nss-tools" arch="x86_64">
  <version epoch="0" ver="3.79.4" rel="150000.3.93.1"/>
  <changelog author="hpj@suse.com" date="1649851200">- Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This
  makes the PBKDF known answer test compliant with NIST SP800-132.</changelog>
  <changelog author="hpj@suse.com" date="1652270400">- Run test suite at build time, and make it pass (bsc#1198486).
  Based on work by Marcus Meissner.
- Add nss-fips-tests-skip.patch to skip algorithms that are hard
  disabled in FIPS mode.
- Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired
  PayPalEE cert from failing the tests.
- Add nss-fips-tests-enable-fips.patch, which enables FIPS during
  test certificate creation and disables the library checksum
  validation during same.
- Update nss-fips-constructor-self-tests.patch to allow
  checksumming to be disabled, but only if we entered FIPS mode
  due to NSS_FIPS being set, not if it came from /proc.</changelog>
  <changelog author="hpj@suse.com" date="1653048000">- Update nss-fips-constructor-self-tests.patch to scan
  LD_LIBRARY_PATH for external libraries to be checksummed.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654171200">- Mozilla NSS 3.68.4 (bsc#1200027)
  * Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
    (bmo#1767590)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1654603200">- Remove upstreamed patches:
  * nss-fips-version-indicators.patch
  * nss-fips-tests-pin-paypalee-cert.patch
- update to NSS 3.79
  - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls.
  - bmo#1766907 - Update mercurial in clang-format docker image.
  - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail.
  - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo.
  - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots.
  - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP.
  - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts.
  - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version.
  - bmo#1764788 - Correct invalid record inner and outer content type alerts.
  - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding.
  - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle.
  - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple.
  - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34
- update to NSS 3.78.1
  * bmo#1767590 - Initialize pointers passed to
    NSS_CMSDigestContext_FinishMultiple
- update to NSS 3.78
    bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests.
    bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries.
    bmo#1763120 - Add ECH Grease Support to tstclnt
    bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname.
    bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false.
    bmo#1760813 - Make SEC_PKCS12EnableCipher succeed
    bmo#1762489 - Update zlib in NSS to 1.2.12.
- update to NSS 3.77
  * Bug 1762244 - resolve mpitests build failure on Windows.
  * bmo#1761779 - Fix link to TLS page on wireshark wiki
  * bmo#1754890 - Add two D-TRUST 2020 root certificates.
  * bmo#1751298 - Add Telia Root CA v2 root certificate.
  * bmo#1751305 - Remove expired explicitly distrusted certificates
    from certdata.txt.
  * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix
  * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate.
  * bmo#1756271 - Remove token member from NSSSlot struct.
  * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime.
  * bmo#1757279 - Support UTF-8 library path in the module spec string.
  * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun.
  * bmo#1760827 - Add a CI Target for gcc-11.
  * bmo#1760828 - Change to makefiles for gcc-4.8.
  * bmo#1741688 - Update googletest to 1.11.0
  * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API.
  * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts.
  * bmo#1755904 - Fix calculation of ECH HRR Transcript.
  * bmo#1758741 - Allow ld path to be set as environment variable.
  * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests.
  * bmo#1758478 - Fix DataBuffer Move Assignment.
  * bmo#1552254 - internal_error alert on Certificate Request with
    sha1+ecdsa in TLS 1.3
  * bmo#1755092 - rework signature verification in mozilla::pkix
- Require nss-util in nss.pc and subsequently remove -lnssutil3
- update to NSS 3.76.1
  NSS 3.76.1
  * bmo#1756271 - Remove token member from NSSSlot struct.
  NSS 3.76
  * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in
    nssTrustDomain_GetActiveSlots.
  * bmo#1370866 - Check return value of PK11Slot_GetNSSToken.
  * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS
  * bmo#1679803 - Add SHA256 fingerprint comments to old
    certdata.txt entries.
  * bmo#1753505 - Avoid truncating files in nss-release-helper.py.
  * bmo#1751157 - Throw illegal_parameter alert for illegal extensions
    in handshake message.
- Add nss-util pkgconfig and config files (copied from RH/Fedora)
- update to NSS 3.75
  * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI.
  * bmo#1749794 - Make DottedOIDToCode.py compatible with python3.
  * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing.
  * bmo#1748386 - Remove redundant key type check.
  * bmo#1749869 - Update ABI expectations to match ECH changes.
  * bmo#1748386 - Enable CKM_CHACHA20.
  * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown.
  * bmo#1747310 - real move assignment operator.
  * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests.
  * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool.
  * bmo#1747772 - Allow to build using clang's integrated assembler.
  * bmo#1321398 - Allow to override python for the build.
  * bmo#1747317 - test HKDF output rather than input.
  * bmo#1747316 - Use ASSERT macros to end failed tests early.
  * bmo#1747310 - move assignment operator for DataBuffer.
  * bmo#1712879 - Add test cases for ECH compression and unexpected
    extensions in SH.
  * bmo#1725938 - Update tests for ECH-13.
  * bmo#1725938 - Tidy up error handling.
  * bmo#1728281 - Add tests for ECH HRR Changes.
  * bmo#1728281 - Server only sends GREASE HRR extension if enabled
    by preference.
  * bmo#1725938 - Update generation of the Associated Data for ECH-13.
  * bmo#1712879 - When ECH is accepted, reject extensions which were
    only advertised in the Outer Client Hello.
  * bmo#1712879 - Allow for compressed, non-contiguous, extensions.
  * bmo#1712879 - Scramble the PSK extension in CHOuter.
  * bmo#1712647 - Split custom extension handling for ECH.
  * bmo#1728281 - Add ECH-13 HRR Handling.
  * bmo#1677181 - Client side ECH padding.
  * bmo#1725938 - Stricter ClientHelloInner Decompression.
  * bmo#1725938 - Remove ECH_inner extension, use new enum format.
  * bmo#1725938 - Update the version number for ECH-13 and adjust
    the ECHConfig size.
- update to NSS 3.74
  * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in
    OCSP responses
  * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR
  * bmo#1721426 - NSS does not properly restrict server keys based on policy
  * bmo#1733003 - Set nssckbi version number to 2.54
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate
  * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate
  * bmo#1735407 - Replace GlobalSign ECC Root CA R4
  * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3
  * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root
    certificates
  * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional
    CIF A62634068 root certificate
  * bmo#1740095 - Add iTrusChina ECC root certificate
  * bmo#1740095 - Add iTrusChina RSA root certificate
  * bmo#1738805 - Add ISRG Root X2 root certificate
  * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate
  * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build
  * bmo#1735028 - Check for missing signedData field
  * bmo#1737470 - Ensure DER encoded signatures are within size limits
- enable key logging option (boo#1195040)
- update to NSS 3.73.1:
  * Add SHA-2 support to mozilla::pkix's OSCP implementation
- update to NSS 3.73
  * bmo#1735028 - check for missing signedData field.
  * bmo#1737470 - Ensure DER encoded signatures are within size limits.
  * bmo#1729550 - NSS needs FiPS 140-3 version indicators.
  * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs
  * bmo#1738600 - sunset Coverity from NSS
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- update to NSS 3.72
  * Remove newline at the end of coreconf.dep
  * bmo#1731911 - Fix nsinstall parallel failure.
  * bmo#1729930 - Increase KDF cache size to mitigate perf
    regression in about:logins
- update to NSS 3.71
  * bmo#1717716 - Set nssckbi version number to 2.52.
  * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py
  * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported
  * bmo#1717707 - Add HARICA Client ECC Root CA 2021.
  * bmo#1717707 - Add HARICA Client RSA Root CA 2021.
  * bmo#1717707 - Add HARICA TLS ECC Root CA 2021.
  * bmo#1717707 - Add HARICA TLS RSA Root CA 2021.
  * bmo#1728394 - Add TunTrust Root CA certificate to NSS.
- update to NSS 3.70
  * bmo#1726022 - Update test case to verify fix.
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max
  * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback
  * bmo#1681975 - Avoid using a lookup table in nssb64d.
  * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian.
  * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true.
  * bmo#1726022 - Cache additional PBE entries.
  * bmo#1709750 - Read HPKE vectors from official JSON.
- Update to NSS 3.69.1
  * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default
  * bmo#1720226 (Backout) - integrity checks in key4.db not happening
    on private components with AES_CBC
  NSS 3.69
  * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again)
  * bmo#1720226 - integrity checks in key4.db not happening on private
    components with AES_CBC (backed out again)
  * bmo#1720235 - SSL handling of signature algorithms ignores
    environmental invalid algorithms.
  * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing
    nss failures.
    (removed obsolete nss-btrfs-sqlite.patch)
  * bmo#1720230 - Gtest update changed the gtest reports, losing gtest
    details in all.sh reports.
  * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode
  * bmo#1720232 - SQLite calls could timeout in starvation situations.
  * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67
  * bmo#1709817 - Import the NSS documentation from MDN in nss/doc.
  * bmo#1720227 - NSS using a tempdir to measure sql performance not active
- add nss-fips-stricter-dh.patch
- updated existing patches with latest SLE</changelog>
  <changelog author="hpj@suse.com" date="1657713600">- Update nss-fips-constructor-self-tests.patch to add on-demand
  integrity tests through sftk_FIPSRepeatIntegrityCheck()
  (bsc#1198980).
- Update nss-fips-approved-crypto-non-ec.patch to mark algorithms
  as approved/non-approved according to security policy
  (bsc#1191546, bsc#1201298).
- Update nss-fips-approved-crypto-non-ec.patch to remove hard
  disabling of unapproved algorithms. This requirement is now
  fulfilled by the service level indicator (bsc#1200325).
- Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need
  the workaround in FIPS mode (bsc#1200325).
- Remove nss-fips-tests-skip.patch. This is no longer needed since
  we removed the code to short-circuit broken hashes and moved to
  using the SLI.</changelog>
  <changelog author="hpj@suse.com" date="1658923200">- Update nss-fips-approved-crypto-non-ec.patch to unapprove the
  rest of the DSA ciphers, keeping signature verification only
  (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to fix compiler
  warning.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1661342400">- update to NSS 3.79.1 (bsc#1202645)
  * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier.
  * bmo#1771498 - Uninitialized value in cert_ComputeCertType.
  * bmo#1759794 - protect SFTKSlot needLogin with slotLock.
  * bmo#1760998 - avoid data race on primary password change.
  * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state.</changelog>
  <changelog author="hpj@suse.com" date="1663329600">- Update nss-fips-approved-crypto-non-ec.patch to prevent keys
  from getting flagged as non-FIPS and add remaining TLS mechanisms.
- Add nss-fips-drbg-libjitter.patch to use libjitterentropy for
  entropy. This is disabled until we can avoid the inline assembler
  in the latter's header file that relies on GNU extensions.
- Update nss-fips-constructor-self-tests.patch to fix an abort()
  when both NSS_FIPS and /proc FIPS mode are enabled.</changelog>
  <changelog author="hpj@suse.com" date="1663848000">- Update nss-fips-approved-crypto-non-ec.patch to prevent sessions
  from getting flagged as non-FIPS (bsc#1191546).
- Mark DSA keygen unapproved (bsc#1191546, bsc#1201298).
- Enable nss-fips-drbg-libjitter.patch now that we have a patched
  libjitter to build with (bsc#1202870).</changelog>
  <changelog author="hpj@suse.com" date="1664280000">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  longer symmetric keys via the service level indicator
  (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to hopefully export
  sftk_FIPSRepeatIntegrityCheck() correctly (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1664798400">- Update nss-fips-approved-crypto-non-ec.patch to allow the use of
  DSA keys (verification only) (bsc#1201298).
- Update nss-fips-constructor-self-tests.patch to add
  sftk_FIPSRepeatIntegrityCheck() to softoken's .def file
  (bsc#1198980).</changelog>
  <changelog author="hpj@suse.com" date="1665576000">- Add nss-allow-slow-tests.patch, which allows a timed test to run
  longer than 1s. This avoids turning slow builds into broken
  builds.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666785600">- update to NSS 3.79.2 (bsc#1204729)
  * bmo#1785846 - Bump minimum NSPR version to 4.34.1.
  * bmo#1777672 - Gracefully handle null nickname in CERT_GetCertNicknameWithValidity.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1666872000">- Require libjitter only for SLE15-SP4 and greater</changelog>
  <changelog author="hpj@suse.com" date="1668081600">- Update nss-fips-approved-crypto-non-ec.patch to allow the use SHA
  keygen mechs (bsc#1191546).
- Update nss-fips-constructor-self-tests.patch to ensure abort() is
  called when the repeat integrity check fails (bsc#1198980).</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1669982400">- Update nss-fips-approved-crypto-non-ec.patch to disapprove the
  creation of DSA keys, i.e. mark them as not-fips (bsc#1201298)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673438400">- update to NSS 3.79.3 (bsc#1207038)
  * Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
    CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates
    (CVE-2022-23491)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1673524800">- Add upstream patch nss-fix-bmo1774654.patch to fix CVE-2022-3479
  (bsc#1204272)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1676030400">- update to NSS 3.79.4 (bsc#1208138)
  * Bug 1804640 - improve handling of unknown PKCS#12 safe bag types.
    (CVE-2023-0767)</changelog>
</package>
<package pkgid="c7712fa57c6a5da1d1c418592d28b9309c0a2d0221155cade98547d5211f0d7a" name="multipath-tools" arch="aarch64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.14.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+190+suse.fe234ea:
  * Fixes for daemon shutdown issues from  SLE(bsc#1110060, bsc#1110439)
  - multipathd: allow shutdown during configure()
  * fix compilation of external programs with -lmultipath
  (bsc#1133957, necessary after the above fix)
  * Minor upstream fixes</changelog>
  <changelog author="mwilck@suse.com" date="1600257601">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
</package>
<package pkgid="bf84e6bd9f2f031607bd88fdb2368adfd945216c7a6f63c1598889785dfae6cc" name="multipath-tools" arch="src">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.14.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+190+suse.fe234ea:
  * Fixes for daemon shutdown issues from  SLE(bsc#1110060, bsc#1110439)
  - multipathd: allow shutdown during configure()
  * fix compilation of external programs with -lmultipath
  (bsc#1133957, necessary after the above fix)
  * Minor upstream fixes</changelog>
  <changelog author="mwilck@suse.com" date="1600257601">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
</package>
<package pkgid="8899c4b482c7e6d707e1d2b404c7d7f32d9ce009ceedc54fdefd6a8096d1bd3b" name="multipath-tools" arch="x86_64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.14.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+190+suse.fe234ea:
  * Fixes for daemon shutdown issues from  SLE(bsc#1110060, bsc#1110439)
  - multipathd: allow shutdown during configure()
  * fix compilation of external programs with -lmultipath
  (bsc#1133957, necessary after the above fix)
  * Minor upstream fixes</changelog>
  <changelog author="mwilck@suse.com" date="1600257601">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
</package>
<package pkgid="9369b5ff76df9e3748837e73ae813c87d8277422baeae60d8a41f536c6b60b26" name="multipath-tools" arch="aarch64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.17.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="501ec85530ec2bdcd0459de3f3c162391edbbff020b4e0de4d26103ae12c7ae5" name="multipath-tools" arch="src">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.17.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="043916605d678ba18acf6bf216cb2753776cc7628e60df3a391c6e45a3033cd0" name="multipath-tools" arch="x86_64">
  <version epoch="0" ver="0.8.5+126+suse.8ce8da5" rel="150300.2.17.1"/>
  <changelog author="mwilck@suse.com" date="1600257600">- Update to version 0.8.4+192+suse.1bc10ad:
  * Fix handling of hardware properties for maps without paths
  (bsc#1176644)</changelog>
  <changelog author="mwilck@suse.com" date="1600344000">- Bugref for all minor fixes since SLE15-SP2 release (bsc#1176670)
- Added README.alua</changelog>
  <changelog author="mwilck@suse.com" date="1607083200">- Remove compatibility code for SLE &lt;= 12-SP2 from spec file</changelog>
  <changelog author="mwilck@suse.com" date="1608120000">- Update to version 0.8.5+12+suse.3b0e9ca
  * libmultipath: force map reload if udev incomplete
  (bsc#1178662, bsc#1172157, bsc#1175454, bsc#1176406)
- Fixes from upstream 0.8.5
  * multipath-tools: add MacroSAN arrays to hwtable
  * libmultipath: Allow discovery of USB devices
  (add configuration option "allow_usb_devices")</changelog>
  <changelog author="mwilck@suse.com" date="1612958400">- Update to version 0.8.5+22+suse.e1e3c48:
  * multipath-tools tests: fix stringop-overflow build errors with gcc 11
    (bsc#1181877)
  * README moved to README.md (has been converted to markdown upstream)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Update to version 0.8.5+23+suse.c11b054:
  * multipath -U: reduce log level of "adding new path" message
  (bsc#1181435, bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1615550400">- Update to version 0.8.5+26+suse.2cbedfd:
  Avoid "illegal request" errors on non-RDAC storage
  (bsc#1182072, bsc#1177371)</changelog>
  <changelog author="mwilck@suse.com" date="1616068800">- Update to version 0.8.5+29+suse.5dabcd2:
  * 11-dm-mpath.rules: run "multipath -U" with -v1 (bsc#1182871)
  * libmultipath: merge update_multipath_table() and update_multipath_status()
  (bsc#1183666)</changelog>
  <changelog author="mwilck@suse.com" date="1617278400">- Update to version 0.8.5+30+suse.633836e:
  * multipathd: give up "add missing path" after multiple failures
  (bsc#1183963)</changelog>
  <changelog author="mwilck@suse.com" date="1621339200">- Update to version 0.8.5+80+suse.73c50f5:
  * add eh_deadline option to avoid endless SCSI error handling
  * add wwid_recheck option to detect storage configuration changes
  * fixes for SAS expanders (bsc#1178377, bsc#1178379, bsc#1177081)
  * Avoid access to root FS while queueing IO (bsc#1178049,
    bsc#1181234)
  * lots of bug fixes, additions to built-in hardware table, and
    CI improvements, backported from upstream 0.8.6 (bsc#1186212)
  * kpartx: free loop device after listing partitions (boo#1107187)</changelog>
  <changelog author="mwilck@suse.com" date="1632225600">- Update to version 0.8.5+82+suse.746b76e:
  * libmultipath: avoid buffer size warning with systemd 240+
  (bsc#1189176)
- Add a versioned dependency of multipath-tools on libmpath0
  (bsc#1190622)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 0.8.5+83+suse.9add9e89:
  * multipath: fix exit status of multipath -T (bsc#1191900)</changelog>
  <changelog author="mwilck@suse.com" date="1648468800">- Update to version 0.8.5+86+suse.a30b4dff:
  * multipathd: don't switch to DAEMON_IDLE during startup (bsc#1197570)</changelog>
  <changelog author="mwilck@suse.com" date="1661515200">- Update to version 0.8.5+105+suse.d00ff6db:
  * Avoid linking to libreadline to avoid licensing issue
    (bsc#1202616)</changelog>
  <changelog author="mwilck@suse.com" date="1661515201">- Update to version 0.8.5+106+suse.b61267ae:
  * libmultipath: use uint64_t for sg_id.lun</changelog>
  <changelog author="mwilck@suse.com" date="1661515202">- Update to version 0.8.5+109+suse.82eea714:
  * multipathd: add "force_reconfigure" option (bsc#1189551)
    The command "multipathd -kreconfigure" changes behavior: instead
    of reloading every map, it checks map configuration and reloads
    only modified maps. This speeds up the reconfigure operation
    substantially. The old behavior can be reinstated by setting
    "force_reconfigure yes" in multipath.conf (not recommended).
    Note: "force_reconfigure yes" is not supported in SLE15-SP4 and
    beyond, which provide the command "multipathd -k'reconfigure all'"
  * multipathd: avoid stalled clients during reconfigure (bsc#1189551)
  * multipathd: handle client disconnect correctly (bsc#1189551)</changelog>
  <changelog author="mwilck@suse.com" date="1662984000">- Update to version 0.8.5+111+suse.16416b3:
  * multipathd: handle fpin events (bsc#1195506, jsc#PED-1448)</changelog>
  <changelog author="mwilck@suse.com" date="1664539200">- Update to version 0.8.5+126+suse.8ce8da5:
  * Fix multipathd authorization bypass and symlink attack
    (bsc#1202739 CVE-2022-41973 CVE-2022-41974)
  * add multipath-dracut.conf: dracut config file to install
    tmpfiles.d/multipath.conf in initramfs</changelog>
  <changelog author="mwilck@suse.com" date="1664539201">- Use %tmpfiles_create macro for tmpfiles.d file</changelog>
  <changelog author="mwilck@suse.com" date="1674043200">- Fix "rpm --verify" (bsc#1207232)</changelog>
</package>
<package pkgid="7de5e4535dc997bac182f591687be75eb3e6f9cbc90b88bf379a6ea0e08ba7c6" name="ncurses" arch="src">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="71f24a048866e5a530d7ae23d2899b7d5d95afa87fab119dc984428243e676e3" name="ncurses-utils" arch="aarch64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="3f91af373804fa5c7d9379ee21742573a883075fcb939cc544dae8db25ac0c81" name="ncurses-utils" arch="x86_64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="48e666ba0bb16b889b0f7f13d68198cd2a2994ab2644cd659c22512030c2422f" name="nfs-client" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="150100.10.27.1"/>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
</package>
<package pkgid="52b164f0455a3a9b89ff9dbff6d36ad24313b0624f6f70e237f756d6d75d527a" name="nfs-client" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="150100.10.27.1"/>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
</package>
<package pkgid="67d44e21658debf56200c521c12b026715f5a505f33e96dd4261455b31d9061c" name="nfs-kernel-server" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="150100.10.27.1"/>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
</package>
<package pkgid="67c3a452dbc4fa80a0a958c3ce4f9ca9e68b7e7225626bf65dbb29f918757502" name="nfs-kernel-server" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="150100.10.27.1"/>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
</package>
<package pkgid="b6985ab4cb6af82db2643845fe300e67fb248da0a225eb25ec476d582bf7bf4f" name="nfs-utils" arch="src">
  <version epoch="0" ver="2.1.1" rel="150100.10.27.1"/>
  <changelog author="nfbrown@suse.com" date="1486555200">- update upstream version from 1.3.4 to 2.1.1
  The significant update is that configuration can
  now be read from a central /etc/nfs.conf file, and
  it can include other files such as /etc/sysconfig/nfs
  This means that the old nfs-config.service systemd
  unit is no longer needed.
- /etc/nfs.conf file created to import all sysconfig
  settings except *_OPTIONS directly into running code.
- dropins created to pass *_OPTIONS sysconfig setting to
  the various daemons.
- various specfile improvements, such as using "-D" in
  "install" commands, and adding "verify_permissions".
- "xtab" has not been needed for years and has now been remove.
- sysconfig.nfs updated, particular the ServiceRestart
  declarations have been tuned for systemd units.
- 0003-nfs-server-generator-handle-noauto-mounts-correctly.patch
  Fix the nfs-server-generator so that mounts marked "noauto"
  are not automatically mounted when NFS exported.
  (bsc#1019211)
- 0001-conffile-ignore-empty-environment-variables.patch
  0002-mount-call-setgroups-before-setuid.patch
  Other minor fixes found during testing.
- REMOVED 0001-Make-location-of-nfs-utils_env.sh-configurable.patch
  now included upstream</changelog>
  <changelog author="kukuk@suse.de" date="1493726400">- Prerequire needed group "nogroup"</changelog>
  <changelog author="schwab@suse.de" date="1499256000">- nsm-headers.patch: add missing &lt;stdint.h&gt;</changelog>
  <changelog author="nfbrown@suse.com" date="1507291200">- fix incorrect dependency in
  /usr/lib/systemd/system/nfs-client.target.d/nfs.conf
  When yast restarts "nfs" it should propagate to nfs-client,
  but doesn't.
  (boo#1053691)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
</package>
<package pkgid="74780a16bdf497e51848a717e2779fa8e4d6bdda25dd69581bf38b46d1ed2ea5" name="nfsidmap" arch="aarch64">
  <version epoch="0" ver="0.26" rel="150000.3.7.1"/>
  <changelog author="aj@suse.de" date="1322222400">- Upstream tarball is .gz, change source.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1325419200">- On Dec 18 2010, export symbols patch was reverted, which is fine
  however we MUST still hide strlcpy() symbol as it will clash
  with other programs.</changelog>
  <changelog author="meissner@suse.com" date="1375099200">- upgraded to 0.25 (FATE#312769)
  * nss_getpwnam: ignore case when comparing domain names
  * rpc.idmapd fails to load plugings
  * Cleaned up some warnings
  * Ignoring more files.
  * Improve debugging during lib initialization.
  * Added new --with-pluginpath configuration flag
- specify correct plugin searchpath to find plugins on lib64 systems
  bnc#800805
- fix-prototype.patch: updated to 0.25 state, dropped 2 upstream hunks
- libnfsidmap-export-symbols.patch: unfuzzed</changelog>
  <changelog author="meissner@suse.com" date="1375099201">- buildrequire pkg-config</changelog>
  <changelog author="p.drouand@gmail.com" date="1382443200">- Remove %fillup_prereq %insserv_prereq PreReq; the package doesn't
  contain any sysvinit script and sysconfig file
- Remove redundant %clean section</changelog>
  <changelog author="meissner@suse.com" date="1392379200">- actually enable the LDAP plugin. bnc#859625</changelog>
  <changelog author="jengelh@inai.de" date="1412596800">- Use implicit %attrs; remove ancient specfile tags/sections</changelog>
  <changelog author="p.drouand@gmail.com" date="1425556800">- Update to version 0.26
  * No changelog available
- Point download Url to new home
- Remove depreciated AUTHORS section</changelog>
  <changelog author="nfbrown@suse.com" date="1533643200">- 0001-libnfsidmap-add-options-to-aid-id-mapping-in-multi-d.patch
  0002-nss_gss_princ_to_ids-and-nss_gss_princ_to_grouplist-.patch
  Improve support for SAMBA+AD
  (bsc#1098217)</changelog>
  <changelog author="nfbrown@suse.com" date="1657108800">- 0001-Removed-some-unused-and-set-but-not-used-warnings.patch
  0002-Handle-NULL-names-better.patch
  0003-Strip-newlines-out-of-IDMAP_LOG-messages.patch
  0004-onf_parse_line-Ignore-whitespace-at-the-beginning-of.patch
  0005-nss.c-wrong-check-of-return-value.patch
  0006-Fixed-a-memory-leak-nss_name_to_gid.patch
  Various bugfixes and improvemes from upstream
  In particular, 0001 fixes a crash that can happen when
  a 'static' mapping is configured.
  (bnc#1200901)</changelog>
</package>
<package pkgid="7885de0bf25149c3844fa44a6185c82e870a7625baf59c0fd73a691e40c41e64" name="nfsidmap" arch="src">
  <version epoch="0" ver="0.26" rel="150000.3.7.1"/>
  <changelog author="meissner@suse.de" date="1240401600">- move plugins .so files to main package, to make it work again
  bnc#495665, bnc#497209
- disable versioning of those plugin libs</changelog>
  <changelog author="meissner@suse.de" date="1267185600">- updated to 0.23
  * Allows mappings to be correct "right out of the box" when DNS is
    set up correctly and stops idmapper from dying when there is
    no domain name set.
  * Move the default processing for the "Local-Realm" config option
    into the main config file processing function and adds missing
    documentation for the previously added configuration option.
  * Print a debug log message "when the krb5 realm can not be used since
    it does not match the DNS domain name or the 'Local-Realm' variable
    defined in /etc/idmad.conf"
  * Move the idmapd.conf manpage from nfs-utils and update it to match
    the current functionality.
  * Changes to install, and look for, the plugin libraries in a separate
    libnfsidmap directory.</changelog>
  <changelog author="meissner@suse.de" date="1269432000">- also remove .la files from the libnfsidmap subdir
- fixed missing ctype.h header include</changelog>
  <changelog author="meissner@suse.de" date="1269864000">- disable the idmapd.conf manpage inclusion, it is in nfs-utils.</changelog>
  <changelog author="jengelh@medozas.de" date="1277726400">- use %_smp_mflags</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1292068800">- libnfsidmap: export only public symbols nfs4_*, in particular
  this avoids exporting strlcpy to calling applications..
- openldap2-devel is not required in -devel package</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1292673600">- revert the last change that exported only public symbols
  breaks loadable modules.</changelog>
  <changelog author="meissner@suse.de" date="1303905600">- include manpage again bnc#689009</changelog>
  <changelog author="meissner@suse.de" date="1303905601">- libnfsidmap-0.24
  * Added autogen.sh which runs all the autoconfig scripts
  * Added nfs4_owner interfaces which are used by the
    new nfsidmap program</changelog>
  <changelog author="coolo@suse.com" date="1322222400">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="aj@suse.de" date="1322222401">- Upstream tarball is .gz, change source.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1325419200">- On Dec 18 2010, export symbols patch was reverted, which is fine
  however we MUST still hide strlcpy() symbol as it will clash
  with other programs.</changelog>
  <changelog author="meissner@suse.com" date="1375099200">- upgraded to 0.25 (FATE#312769)
  * nss_getpwnam: ignore case when comparing domain names
  * rpc.idmapd fails to load plugings
  * Cleaned up some warnings
  * Ignoring more files.
  * Improve debugging during lib initialization.
  * Added new --with-pluginpath configuration flag
- specify correct plugin searchpath to find plugins on lib64 systems
  bnc#800805
- fix-prototype.patch: updated to 0.25 state, dropped 2 upstream hunks
- libnfsidmap-export-symbols.patch: unfuzzed</changelog>
  <changelog author="meissner@suse.com" date="1375099201">- buildrequire pkg-config</changelog>
  <changelog author="p.drouand@gmail.com" date="1382443200">- Remove %fillup_prereq %insserv_prereq PreReq; the package doesn't
  contain any sysvinit script and sysconfig file
- Remove redundant %clean section</changelog>
  <changelog author="meissner@suse.com" date="1392379200">- actually enable the LDAP plugin. bnc#859625</changelog>
  <changelog author="jengelh@inai.de" date="1412596800">- Use implicit %attrs; remove ancient specfile tags/sections</changelog>
  <changelog author="p.drouand@gmail.com" date="1425556800">- Update to version 0.26
  * No changelog available
- Point download Url to new home
- Remove depreciated AUTHORS section</changelog>
  <changelog author="nfbrown@suse.com" date="1533643200">- 0001-libnfsidmap-add-options-to-aid-id-mapping-in-multi-d.patch
  0002-nss_gss_princ_to_ids-and-nss_gss_princ_to_grouplist-.patch
  Improve support for SAMBA+AD
  (bsc#1098217)</changelog>
  <changelog author="nfbrown@suse.com" date="1657108800">- 0001-Removed-some-unused-and-set-but-not-used-warnings.patch
  0002-Handle-NULL-names-better.patch
  0003-Strip-newlines-out-of-IDMAP_LOG-messages.patch
  0004-onf_parse_line-Ignore-whitespace-at-the-beginning-of.patch
  0005-nss.c-wrong-check-of-return-value.patch
  0006-Fixed-a-memory-leak-nss_name_to_gid.patch
  Various bugfixes and improvemes from upstream
  In particular, 0001 fixes a crash that can happen when
  a 'static' mapping is configured.
  (bnc#1200901)</changelog>
</package>
<package pkgid="1e05d5c70989152d0d03a9e567f8492f955b5cdeb08e56ccc7787f688fbf9081" name="nfsidmap" arch="x86_64">
  <version epoch="0" ver="0.26" rel="150000.3.7.1"/>
  <changelog author="aj@suse.de" date="1322222400">- Upstream tarball is .gz, change source.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1325419200">- On Dec 18 2010, export symbols patch was reverted, which is fine
  however we MUST still hide strlcpy() symbol as it will clash
  with other programs.</changelog>
  <changelog author="meissner@suse.com" date="1375099200">- upgraded to 0.25 (FATE#312769)
  * nss_getpwnam: ignore case when comparing domain names
  * rpc.idmapd fails to load plugings
  * Cleaned up some warnings
  * Ignoring more files.
  * Improve debugging during lib initialization.
  * Added new --with-pluginpath configuration flag
- specify correct plugin searchpath to find plugins on lib64 systems
  bnc#800805
- fix-prototype.patch: updated to 0.25 state, dropped 2 upstream hunks
- libnfsidmap-export-symbols.patch: unfuzzed</changelog>
  <changelog author="meissner@suse.com" date="1375099201">- buildrequire pkg-config</changelog>
  <changelog author="p.drouand@gmail.com" date="1382443200">- Remove %fillup_prereq %insserv_prereq PreReq; the package doesn't
  contain any sysvinit script and sysconfig file
- Remove redundant %clean section</changelog>
  <changelog author="meissner@suse.com" date="1392379200">- actually enable the LDAP plugin. bnc#859625</changelog>
  <changelog author="jengelh@inai.de" date="1412596800">- Use implicit %attrs; remove ancient specfile tags/sections</changelog>
  <changelog author="p.drouand@gmail.com" date="1425556800">- Update to version 0.26
  * No changelog available
- Point download Url to new home
- Remove depreciated AUTHORS section</changelog>
  <changelog author="nfbrown@suse.com" date="1533643200">- 0001-libnfsidmap-add-options-to-aid-id-mapping-in-multi-d.patch
  0002-nss_gss_princ_to_ids-and-nss_gss_princ_to_grouplist-.patch
  Improve support for SAMBA+AD
  (bsc#1098217)</changelog>
  <changelog author="nfbrown@suse.com" date="1657108800">- 0001-Removed-some-unused-and-set-but-not-used-warnings.patch
  0002-Handle-NULL-names-better.patch
  0003-Strip-newlines-out-of-IDMAP_LOG-messages.patch
  0004-onf_parse_line-Ignore-whitespace-at-the-beginning-of.patch
  0005-nss.c-wrong-check-of-return-value.patch
  0006-Fixed-a-memory-leak-nss_name_to_gid.patch
  Various bugfixes and improvemes from upstream
  In particular, 0001 fixes a crash that can happen when
  a 'static' mapping is configured.
  (bnc#1200901)</changelog>
</package>
<package pkgid="365c54680b4a8d68619cb856ac503dcc0c6e21d125ede6426fdb0b17ad62ca33" name="nvme-cli" arch="aarch64">
  <version epoch="0" ver="1.13" rel="150300.3.20.1"/>
  <changelog author="sschricker@suse.com" date="1555070400">- Add new 'ontapdevices' command and corresponding documentation.
  Requested in (bsc#1131930).
  + 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  + 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  + 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Revert stop-on-failure patch for connect-all, which caused
  unintended behaviour (bsc#1132124)
  + 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557144000">- Increase size of ONTAP namespace path variable
  + 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
- Fix failing service on devices without fc-hardware (bsc#1133594)
  + 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- No longer convert via obsolete DocBook 4.5 format, but rather via
  DocBook 5.x. This due to asciidoctor 2.x no longer supporting
  DocBook 4.x
  + 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557403200">- Update to version 1.8.1+git41.2c43c51:
  * nvme-print: remove Virtual Management support from ONCS
  * nvme-print: update self-test log to include 'aborted due to
    sanitize'
  * move to DocBook 5
  * nvme-cli: add missing endianness conversions for telemetry log
    page
  * property: Fit print size for a property
  * Add Disable IO flag to wdc_dump_dui_data function
  * Reorder primary commands
  * nvme-cli: add identify secondary controller list
  * sanitize/get-telemetry-log: Print nvme status in case ret &gt; 0
  * print: Introduce show_nvme_status to print nvme status
  * ioctl: Fix wrong return case of get_property
  * ioctl: Fix double-free in a loop of get_property
  * improved Documentation
  * fix compilation with GCC-8
  * fix CFLAGS parameter
  * nvme-cli: fix compilation with uint64_t cast
  * nvme-cli: minor cleanup for submit_io()
  * nvme-cli: align all the macros
  * wdc: Change device capability checking
  * wdc: Add additional device for vs-internal-log
  * wdc: Add device unit info log extraction
  * wdc: Add get drive status command
  * wdc: Add clear assert dump status command
  * wdc: Add drive resize command
  * wdc: Update device capabilities for clear pcie corr
  * wdc: Update file parameter checking
  * wdc: Add command to extract NAND statistics
  * wdc: Add data area extraction for DUI command
  * wdc: Additional device capabilities check
  * nvme-cli: fix fc trtype string
  * NVMe-CLI WDC Plugin - add support for additional SN840 device ID.
  * WDC plugin Change vs-internal-log Command to Save Partial E6 Log Data.
  * WDC Plugins vs-internal-log command unsupported on SN340.
  * Fix print format specifiers
  * Fix format block size usage
  * Add reporting of Virtual Management support to id-ctrl
  * Fix possible NULL pointer dereferences
  * Fix possible memory leak on get-internal-log
  * Print timestamp as a date and time string
  * nvme-cli: add netapp ontapdevices command
  * Add FreeBSD installation instructions
  * Adding a helper to format command
  * fabrics: Return negative errno when asprintf() fails
  * fabrics: Return negative errno to check remove_ctrl() is failed
  * nvme: Support raw_binary and json format for show-regs
  * ioctl: Free memory if get_property for fabrics failed
  * nvme: Use ARRAY_SIZE() macro in common.h
  * nvme: Unify min(), max() macro as a common one
  * nvme: Simplify description for virt-mgmt
  * nvme: Simplify virt-mgmt options to lowercase
  * nvme-print: Fix evaluation of ctratt on pretty print
  * nvme: print I/O error to stderr
- Drop obsolete patches:
  - 0001-wdc-Change-device-capability-checking.patch
  - 0002-wdc-Add-additional-device-for-vs-internal-log.patch
  - 0003-generate-new-documentation.patch
  - 0004-Fix-compilation-with-GCC-8.patch
  - 0005-Fix-CFLAGS-parameter.patch
  - 0006-nvme-cli-fix-compilation-with-uint64_t-cast.patch
  - 0007-Regen-docs.patch
  - 0008-nvme-cli-minor-cleanup-for-submit_io.patch
  - 0009-Regen-documentation.patch
  - 0010-nvme-cli-fix-fc-trtype-string.patch
  - 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  - 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  - 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch
  - 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
  - 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch
  - 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Rename downstream patch:
  + 0001-nvme_fc-auto-connect-scripts.patch
  + 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  + 0003-Add-nvmefc-connect.target.patch
  + 0004-Change-service-to-type-simple.patch
  + 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  - 0100-nvme_fc-auto-connect-scripts.patch
  - 0101-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  - 0102-Add-nvmefc-connect.target.patch
  - 0103-Change-service-to-type-simple.patch
  - 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="sschricker@suse.com" date="1558612800">- Add new subpackage containing the nvme-cli regress script
- Add script to determine host NQN based on the system UUID
  + 0008-nvme-cli-Add-script-to-determine-host-NQN.patch
- Add new udev rule for NetApp E-Series and adjust udev rule naming
  scheme accordingly. (bsc#1124564)
  + 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  + 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
- Update to version 1.8.1+git64.b969cf0:
  * fix json print for list-subsys command
  * Add Virtium plugin extension document
  * Add Virtium plugin extension
  * nvme.h: Fix typos in status code values
  * nvme-cli: remove unused NVME_AER_NOTICE_
  * list-ctrl, create-ns, format: Do not return directly without
    freeing fd</changelog>
  <changelog author="sschricker@suse.com" date="1564142400">- Update to version 1.8.1+git135.9bab71e:
  * various documentation improvements
  * nvme-cli: Restore support for older gcc versions
  * [NVMe-CLI] Add support for larger data sizes needed to get DUI data.
  * [Log] Memblaze add more log infomation for S.M.A.R.T.
  * nvme: add Verify command
  * lnvm: do not print 0 when the arg is not given
  * lnvm: remove redundant whitespace in lnvm_init()
  * nvme: clean up goto labels without whitespace
  * format: check BLKRRPART failure
  * [NVMe-CLI] Add support for SN730 to WDC plugin commmands
  * Add verbose capability to get DUI function to improve debug
  * nvme-print: Show value for Transport SGL Data Block Descriptor support
  * [NVMe-CLI] WDC: Add support for 64 bit data addresses in Get DUI Data functions
  * nvme-cli: Fix more endianness issues
  * nvme-print: add JSON for NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * fabrics: Return errno mapped for fabrics error status
  * fabrics: return error when discovery retry exhausted
  * nvme: Return errno mapped for nvme error status
  * nvme-status: Introduce nvme status module to map errno
  * nvme: Return negative error value for internal errors
  * fabrics: Do not return in the middle of the subcommand
  * nvme: Do not return in the middle of the subcommand
  * nvme-cli: Report the NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * Introduce NVMe 1.4 Identify Namespace fields in struct nvme_id_ns
  * nvme-cli: Skip properties that are not supported
  * Fix various bugs related to endianness bugs
  * NVMe-Cli Shannon Plugin-add support for shannon systems.
  * nvme-print: fix json object memory leak
  * fabrics: Fix memory leak of subsys list
  * nvme: update description for "nvme list" command
  * nvme: update list-ns nsid option
  * nvme-print: add pretty print for estimated sanitize time
  * add namespace to json output of nvme list
  * add free call for json object for commands show-regs
  * add newline for command show-regs
  * nvme-cli: remove unnecessary initialize of local var
  * nvme-cli: don't try to disconnect for ctrl with pcie transport
  * Fix sprintf truncate
- Reorder install steps: Install systemd services first, since they
  are required for the udev rules, avoiding a theoretical race
  condition.</changelog>
  <changelog author="hare@suse.com" date="1574078400">- Update to version 1.9+git122.c5097d5:
  * [NVMe-CLI] Get DUI for SN-340 failing with Data Area 4 - Buffer Misalignment
  * Minor intel-nvme print refactor
  * Use simpler nvme ioctl api for admin
  * Relocate functions and constants to the files that use them
  * Move all spec defined structs to single file
  * Update build rules for .c with no .h
  * Update my email address
  * Makefile: fix cleaning subdirectories
  * remove unused "paths" controller field
  * reign in line lengths
  * Add print for directive receive
  * Unify print routines
  * regenerate documentation
  * fix fw-download reference to committing fw
  * argconfig: Remove unused paramters
  * fix huawei filter to search all namespaces
  * nvme-cli: Support for hugetlbfs
  * Remove all 'struct nvme_command' usage
  * nvme-cli: Update PMR Capability and PMR Status 	1. Adding Controller Memory Space Supported(CMSS) in PMRCAP 	2. Adding Persistent Memory Region Status(CBAI) in PMRSTS
  * nvme-cli: Update Controller Capabilities Register 	1. Add Controller Memory Buffer Supported (CMBS)
  * nvme-cli: Update NVMe Registers 	1. Add Controller Memory Buffer Memory Space Control (CMBMSC) 	2. Add Controller Memory Buffer Status (CMBSTS) 	3. Add Persistent Memory Region Memory Space Control (PMRMSC)
  * fixup attach-ns documentation
  * Add files via upload
  * [NVMe-CLI] Updates and fixes to WDC plugin command vs-internal-log for the SN340 drive.
  * Regen docs, add host-nqn man page
  * [NVMe-ClI] Add Documentation files for clear-fw-activate-history command
  * [NVMe-CLI] Add clear-fw-activate-history WDC plugin command
  * fix namespace checks for legacy list
  * Reset wdc_do_cap_dui default parameters to the proper values
  * README.md: Mention the OpenEmbedded/Yocto recipe
  * Intel plugin: Adding fields to id-ctrl VU region Per https://github.com/linux-nvme/nvme-cli/pull/584/commits/f33510efbf5192116e5757d13a02463d446a1dc5#r332178975 removing pack pragma on vu_id_ctrl_field struct.
  * udev: convert the discovery event handler to the kernel support
  * Use a systemd app-specific machine ID for hostnqn
  * nvme-cli: Add 'transport type' error to the error log
  * nvme-cli: Update nvme_endurance_group_log structure
  * Adding fields to id-ctrl VU reigon for Intel DC drives
  * Check return value of scandir
  * nvme-cli: Add namespace-id option to self-test-log
  * Report invalid output format for 'list' command
  * Provide no-binary output format help text
  * regen documentation
  * Documentation: nvme-wdc-vs-fw-activate-history(1,html) generated
  * nvme-cli/fabrics: Add tos param to connect cmd
  * nvme.spec.in: fix rpm build error
  * Correct self-test-log output
  * nvme: Add 'Endurance Group Critical Warning Summary' to the Smart/Health information Log
  * [NVMe-CLI] Documentation file for WDC vs-fw-activate-history command.
  * [NVMe-CLI] Add new WDC plugin command vs-fw-activate-history.
  * make: install-hostparams depends on install-etc
  * MAINT: compile warning error on 32 bit system
  * nvme-print: fix to print ctrltype when human-readable
  * nvme: add Persistent Memory Region(PMR) Write Elasticity Status Registers
  * [NVMe-CLI] Fix Potential Memory Leak with vs-internal-log command.
  * regen docs
  * fix admin-passthru documentation typo
  * [NVMe-CLI] Fix empty file issue with vs-internal-log wdc plugin command
  * nvme-cli: Fix namespace list output
  * Fix builds for missing uuid
  * Revert "remove LIBUUID things from nvme.h"
  * Revert "nvme-cli: Fix compile on non-libuuid machines"
  * Revert "fix uuid include typo"
  * [NVMe-CLI] Fix offset parameter size for vs-internal-log wdc plugin command.
  * remove LIBUUID things from nvme.h
  * fix build error due to asprintf()
  * id-ctrl: show Flush command behavior in VWC
  * fix uuid include typo
  * nvme-cli: Fix compile on non-libuuid machines
  * [NVMe-CLI] Add updated documentation for additional parameters to specify file size   in vs-internal-log command.
  * Regen docs
  * nvme-cli: Code cleanup
  * nvme-cli: Macro'ify argument defines
  * nvme-cli: Code reorg
  * [NVMe-CLI] Add support to specify file size in get DUI data for SN340.
  * Regenerate documentation
  * nvme-cli: Make 'list' more useful
  * id-ctrl: show Persistent Event Log support in LPA
  * id-ctrl: show Persistent Event Log Size(PELS)
  * id-ctrl: show Endurance Group Maximum ID(ENDGIDMAX)
  * id-ctrl: show FRU Globally Unique Identifier(FGUID)
  * id-ctrl: show Controller Type(CNTRLTYPE)
  * id-ctrl: update id-ctrl header for 1.4
  * systemd: fix echo call with absolute path
  * nvmf-autoconnect: fix absolute path for systemctl
  * make: install udev rules in sysconfdir
  * Add an example for attach-ns
  * make: fix discovery.conf override
  * fabrics: fix loop connect-all
  * nvme: fix compilation error
  * nvme-cli: Enhance format FNA detection
  * nvme-cli: Warn and delay before formatting
  * nvme-cli: prefill metadata buffers
  * Fixed bash-nvme-completion.sh typo
  * Tag release: v1.9
  * Regen docs
  * nvme: UUIDs for Vendor-Specific Information
  * nvme: add Persistent Memory Region (PMR) registers
  * get-lba-status: add Get LBA Status command
  * Added openSUSE Leap to README.md
  * id-ctrl: add 1.4 features to OAES
  * Update packaging state in Arch Linux
  * Fix code block style in the first section
  * nvme-cli: nvmf auto-connect scripts
  * nvme-cli: add --quiet option
  * nvme-cli: Expand --device argument processing
  * nvme-cli: Add routine to search for controller with specific attributes
  * nvme-cli: Add routine to compare ctrl_list_item to connect args
  * nvme-cli: extend ctrl_list_item for connect attributes
  * nvme-cli: Refactor to create a get_nvme_ctrl_info routine
  * nvme-cli: allow discover to address discovery controller by persistent name
  * nvme-cli: support persistent connections to a discovery controller
  * nvme-cli: ignore arguments that pass in "none"
  * nvme-print: show new CMBLOC bit fields added in NVMe 1.4
  * nvme: add support for Namespace Granularity
  * nvme: sanitize enhancements
  * nvme-cli: Update manpages to reflect discovery particulars
  * nvme-cli: mask out invalid options during discovery
  * nvme-cli: do not use 'queue_size' and 'nr_io_queues' for discovery controller
  * nvme: Enhanced Command Retry
  * id-ctrl: add an indicator for get lba status capability
  * nvme: change format default namespace id
  * lnvm: introduce alias geometry for id-ns for lnvm
  * lnvm: introduce chunk-log command for chunk info
  * lnvm: make data_len to sizeof() instead of magic number
- Add patches from SLE15:
  * 0101-nvme-add-iopolicy-rules-for-netapp.patch
  * 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Drop patches merged with upstream:
  * 0001-nvme_fc-auto-connect-scripts.patch
  * 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  * 0003-Add-nvmefc-connect.target.patch
  * 0004-Change-service-to-type-simple.patch
  * 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  * 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  * 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
  * 0008-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="hare@suse.de" date="1574164800">- Add libhugetlbfs to the list of build requirements</changelog>
  <changelog author="hare@suse.com" date="1579176000">- Update to version 1.10.1+git2.797ec65:
  * Makefile: generate Dracut config according to UDEVDIR
  * Add additional smart log critical warn decoding
  * New tag for missing docs
  * Add new wdc documentation
  * Release v1.10
  * Regen documentation
  * Use asprintf for long names
  * [NVME-CLI] Add documentation file for vs-error-reason-identifier WDC            plugin command. [NVME-CLI] Minor updates/corrections to the clear-fw-activate-history            and vs-fw-activate-history command help text.
  * [NVME-CLI] Add support for WDC plugin command - vs-error-reason-identifier [NVME-CLI] Reverse enable/disable bit on the vs-telemetry-controller-option            WDC plugin command
  * Fix systemd service script use of CONNECT_ARGS env var
  * Shannon Plugin update.
  * Doc/Makefile: Introduce 'quiet' build option
  * Makefile: use 'quiet' compile
  * Makefile: Use special variables
  * micron: don't ignore 'system()' return value
  * Fix libhugetlbfs flags
  * Regenerate documentation
  * Micron plugin updates
  * README.md: Mention the buildroot package
  * nvmf-autoconnect: add udev rules to set iopolicy for certain NetApp devices
  * Fix intel json latency statistics output format
  * intel: Add function lat-stats to cli Adds the lat-stats function to intel plugin. If lat-stats-tracking is enabled, lat-stats will print out latency statistics according to the user's desired format.
  * [NVMe-CLI] Update documentation for telemetry data retrieval to vs-internal-log wdc plugin command.
  * [NVMe-CLI] Add support to retrieve telemetry data in vs-internal-log
  * [nvme-cli] Add documentation file for new  wdc plugin command - vs-telemetry-controller-option
  * [nvme-cli] Add support for wdc plugin command - vs-telemetry-controller-option
  * Fix typo (bulit -&gt; built)
  * Warn on admin-passthru opcode not matching read/write flag
  * MAINT: Fix format compile warning error on 32 bit system
  * nvme-cli: Check for sysfs interface before NVMe discovery
  * Revert "Add Dera plugin extension."
  * Revert "Add Dera plugin extension."
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Improve self test log command
  * nvme-cli: Update err to 0 in get_telemetry_log
  * fixup up self-test log when no test is in progress
  * nvme-cli: Update err value to 0 in get_ns_id func.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * nvme.c: create-ns arguments are added
- Remove patch merged with upstream
  * Delete 0101-nvme-add-iopolicy-rules-for-netapp.patch</changelog>
  <changelog author="hare@suse.com" date="1580126400">- Update to version 1.10.1+git9.872e6b0:
  * fabrics: fix connection args parsing
  * nvmf-autoconnect.service
  * Fix status displayed by vs-telemetry-controller-option wdc plugin command.
  * Provide documentation for log page directory WDC plugin command
  * Provide WDC plugin command to dump log page directory
  * Tests: Hande string encoding and handling failures
  * Makefile: use UDEVRULESDIR instead of UDEVDIR
- Rename 'nvme-det-hostnqn' script to 'nvme-gen-hostnqn'</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.12
  * Corrected text output in FW activation history
  * nvme: allow addr family to recognize loop
  * Add log page CA parsing
  * nvme status code updates based nvme spec v1.4
  * Provide documentation for log page directory WDC plugin command
  * Fix status displayed by vs-telemetry-controller-option wdc plugin
  * fabrics: ignore hostnqn file if its empty</changelog>
  <changelog author="daniel.wagner@suse.com" date="1603454400">- update to 1.13
  * support for zoned command set
  * Identify I/O Command Set data structure command added
  * Added new namespace list command on list-ns, 4056 modification added
  * Added temperature information getting and text formatting
  * Implemented additional statistics to display
  * nvme: add support for non shared namespaces</changelog>
  <changelog author="daniel.wagner@suse.com" date="1621339200">- Add KATO fixes for NVMEoF (bsc#1182591)
  * add 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
  * add 0002-print-device-name-when-creating-a-persistent-device.patch
- Lookup existing persistent controllers (bsc#1179825)
  * add 0003-nvme-discover-lookup-existing-persistent-controllers.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1624276800">- Do not print error message when opening controller (bsc#1186719)
  * add 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1628683200">- Fix failures during 'nvme list' (bsc#1186719)
  * add 0005-nvme-ioctl-return-1-on-failure-from-nvme_get_nsid.patch
  * add 0006-nvme-topology-scan-all-controllers-in-scan_subsystem.patch
- Permit integer as KATO argument (bsc#1182591)
  * add 0007-fabrics-permit-kato-int-argument-for-discovery-contr.patch
- Skip connect if transport type doesn't match (bsc#1187287 bsc#1187860)
  * add 0008-fabrics-skip-connect-if-transport-type-doesn-t-match.patch
- Ignore non live controllers when scanning subsystems (bsc#1186719 bsc#1187287)
  * add 0009-nvme-topology-fix-controller-check-in-scan_subsystem.patch
- Remove UUID validation heuristic (bsc#1187890)
  * add 0010-gen-hostnqn-Remove-UUID-validation-heuristic.patch
  * update 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Do not segfault when controller is not available (bsc#1189046)
  * add 0011-nvme-print-fix-nvme-list-segfault-if-controller-is-u.patch
- Use correct default port for discovery (bsc#1189195 bsc#1187858)
  * add 0012-fabrics-add-default-port-number-for-NVMe-TCP-I-O-con.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1637236800">- Allow -1 as ctrl_loss_tmo value (bsc#1192348)
  * add 0013-nvme-cli-ctrl-loss-tmo-should-accept-1-as-value.patch
- Fix segfauls while discovering (bsc#1191935)
  * add 0014-Input-expects-device-name-without-dev.patch
  * add 0015-fabrics-fix-nvme-discover-segfault-if-sysfs-path-is-.patch
  * add 0016-fabrics-Only-free-initialized-valued-on-exit.patch
  * add 0017-nvme-print-add-discovery-async-event-config-field.patch
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
- Context udpate
  * refresh 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch
- Adding missing hunk (bsc#1182591)
  * update 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
- Use pkg-config for libuuid dependency setup
  * add 0103-build-use-pkg-config-for-libuuid-detection.patch</changelog>
  <changelog author="dwagner@suse.de" date="1643198400">- fabrics: fix 'nvme connect' segfault if transport type is omitted (bsc#1193540)
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
  * add 0019-fabrics-update-discovery.conf-error-message.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649332800">- Don't print error on failed to open in nvme-topology.c (bsc#1198158)
  * add 0020-Don-t-print-error-on-failed-to-open-in-nvme-topology.patch</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- Allow selecting the network interface for connections (bsc#1199670)
  * add 0021-Add-host-iface-option.patch
- Support unique discovery subsystem NQN (bsc#1199865 bsc#1192761)
  * add 0022-fabrics-decode-current-discovery-subsystem.patch
  * add 0023-fabrics-support-unique-discovery-subsystem-NQN.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fix infinite loop on invalid parameters (bsc#1200644)
  * add 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)</changelog>
</package>
<package pkgid="9b1740281f3058697ec85ed99b9ea84c39e0906bfdf567354201461b2957e34f" name="nvme-cli" arch="src">
  <version epoch="0" ver="1.13" rel="150300.3.20.1"/>
  <changelog author="sschricker@suse.com" date="1555070400">- Add new 'ontapdevices' command and corresponding documentation.
  Requested in (bsc#1131930).
  + 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  + 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  + 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Revert stop-on-failure patch for connect-all, which caused
  unintended behaviour (bsc#1132124)
  + 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557144000">- Increase size of ONTAP namespace path variable
  + 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
- Fix failing service on devices without fc-hardware (bsc#1133594)
  + 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- No longer convert via obsolete DocBook 4.5 format, but rather via
  DocBook 5.x. This due to asciidoctor 2.x no longer supporting
  DocBook 4.x
  + 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557403200">- Update to version 1.8.1+git41.2c43c51:
  * nvme-print: remove Virtual Management support from ONCS
  * nvme-print: update self-test log to include 'aborted due to
    sanitize'
  * move to DocBook 5
  * nvme-cli: add missing endianness conversions for telemetry log
    page
  * property: Fit print size for a property
  * Add Disable IO flag to wdc_dump_dui_data function
  * Reorder primary commands
  * nvme-cli: add identify secondary controller list
  * sanitize/get-telemetry-log: Print nvme status in case ret &gt; 0
  * print: Introduce show_nvme_status to print nvme status
  * ioctl: Fix wrong return case of get_property
  * ioctl: Fix double-free in a loop of get_property
  * improved Documentation
  * fix compilation with GCC-8
  * fix CFLAGS parameter
  * nvme-cli: fix compilation with uint64_t cast
  * nvme-cli: minor cleanup for submit_io()
  * nvme-cli: align all the macros
  * wdc: Change device capability checking
  * wdc: Add additional device for vs-internal-log
  * wdc: Add device unit info log extraction
  * wdc: Add get drive status command
  * wdc: Add clear assert dump status command
  * wdc: Add drive resize command
  * wdc: Update device capabilities for clear pcie corr
  * wdc: Update file parameter checking
  * wdc: Add command to extract NAND statistics
  * wdc: Add data area extraction for DUI command
  * wdc: Additional device capabilities check
  * nvme-cli: fix fc trtype string
  * NVMe-CLI WDC Plugin - add support for additional SN840 device ID.
  * WDC plugin Change vs-internal-log Command to Save Partial E6 Log Data.
  * WDC Plugins vs-internal-log command unsupported on SN340.
  * Fix print format specifiers
  * Fix format block size usage
  * Add reporting of Virtual Management support to id-ctrl
  * Fix possible NULL pointer dereferences
  * Fix possible memory leak on get-internal-log
  * Print timestamp as a date and time string
  * nvme-cli: add netapp ontapdevices command
  * Add FreeBSD installation instructions
  * Adding a helper to format command
  * fabrics: Return negative errno when asprintf() fails
  * fabrics: Return negative errno to check remove_ctrl() is failed
  * nvme: Support raw_binary and json format for show-regs
  * ioctl: Free memory if get_property for fabrics failed
  * nvme: Use ARRAY_SIZE() macro in common.h
  * nvme: Unify min(), max() macro as a common one
  * nvme: Simplify description for virt-mgmt
  * nvme: Simplify virt-mgmt options to lowercase
  * nvme-print: Fix evaluation of ctratt on pretty print
  * nvme: print I/O error to stderr
- Drop obsolete patches:
  - 0001-wdc-Change-device-capability-checking.patch
  - 0002-wdc-Add-additional-device-for-vs-internal-log.patch
  - 0003-generate-new-documentation.patch
  - 0004-Fix-compilation-with-GCC-8.patch
  - 0005-Fix-CFLAGS-parameter.patch
  - 0006-nvme-cli-fix-compilation-with-uint64_t-cast.patch
  - 0007-Regen-docs.patch
  - 0008-nvme-cli-minor-cleanup-for-submit_io.patch
  - 0009-Regen-documentation.patch
  - 0010-nvme-cli-fix-fc-trtype-string.patch
  - 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  - 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  - 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch
  - 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
  - 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch
  - 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Rename downstream patch:
  + 0001-nvme_fc-auto-connect-scripts.patch
  + 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  + 0003-Add-nvmefc-connect.target.patch
  + 0004-Change-service-to-type-simple.patch
  + 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  - 0100-nvme_fc-auto-connect-scripts.patch
  - 0101-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  - 0102-Add-nvmefc-connect.target.patch
  - 0103-Change-service-to-type-simple.patch
  - 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="sschricker@suse.com" date="1558612800">- Add new subpackage containing the nvme-cli regress script
- Add script to determine host NQN based on the system UUID
  + 0008-nvme-cli-Add-script-to-determine-host-NQN.patch
- Add new udev rule for NetApp E-Series and adjust udev rule naming
  scheme accordingly. (bsc#1124564)
  + 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  + 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
- Update to version 1.8.1+git64.b969cf0:
  * fix json print for list-subsys command
  * Add Virtium plugin extension document
  * Add Virtium plugin extension
  * nvme.h: Fix typos in status code values
  * nvme-cli: remove unused NVME_AER_NOTICE_
  * list-ctrl, create-ns, format: Do not return directly without
    freeing fd</changelog>
  <changelog author="sschricker@suse.com" date="1564142400">- Update to version 1.8.1+git135.9bab71e:
  * various documentation improvements
  * nvme-cli: Restore support for older gcc versions
  * [NVMe-CLI] Add support for larger data sizes needed to get DUI data.
  * [Log] Memblaze add more log infomation for S.M.A.R.T.
  * nvme: add Verify command
  * lnvm: do not print 0 when the arg is not given
  * lnvm: remove redundant whitespace in lnvm_init()
  * nvme: clean up goto labels without whitespace
  * format: check BLKRRPART failure
  * [NVMe-CLI] Add support for SN730 to WDC plugin commmands
  * Add verbose capability to get DUI function to improve debug
  * nvme-print: Show value for Transport SGL Data Block Descriptor support
  * [NVMe-CLI] WDC: Add support for 64 bit data addresses in Get DUI Data functions
  * nvme-cli: Fix more endianness issues
  * nvme-print: add JSON for NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * fabrics: Return errno mapped for fabrics error status
  * fabrics: return error when discovery retry exhausted
  * nvme: Return errno mapped for nvme error status
  * nvme-status: Introduce nvme status module to map errno
  * nvme: Return negative error value for internal errors
  * fabrics: Do not return in the middle of the subcommand
  * nvme: Do not return in the middle of the subcommand
  * nvme-cli: Report the NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * Introduce NVMe 1.4 Identify Namespace fields in struct nvme_id_ns
  * nvme-cli: Skip properties that are not supported
  * Fix various bugs related to endianness bugs
  * NVMe-Cli Shannon Plugin-add support for shannon systems.
  * nvme-print: fix json object memory leak
  * fabrics: Fix memory leak of subsys list
  * nvme: update description for "nvme list" command
  * nvme: update list-ns nsid option
  * nvme-print: add pretty print for estimated sanitize time
  * add namespace to json output of nvme list
  * add free call for json object for commands show-regs
  * add newline for command show-regs
  * nvme-cli: remove unnecessary initialize of local var
  * nvme-cli: don't try to disconnect for ctrl with pcie transport
  * Fix sprintf truncate
- Reorder install steps: Install systemd services first, since they
  are required for the udev rules, avoiding a theoretical race
  condition.</changelog>
  <changelog author="hare@suse.com" date="1574078400">- Update to version 1.9+git122.c5097d5:
  * [NVMe-CLI] Get DUI for SN-340 failing with Data Area 4 - Buffer Misalignment
  * Minor intel-nvme print refactor
  * Use simpler nvme ioctl api for admin
  * Relocate functions and constants to the files that use them
  * Move all spec defined structs to single file
  * Update build rules for .c with no .h
  * Update my email address
  * Makefile: fix cleaning subdirectories
  * remove unused "paths" controller field
  * reign in line lengths
  * Add print for directive receive
  * Unify print routines
  * regenerate documentation
  * fix fw-download reference to committing fw
  * argconfig: Remove unused paramters
  * fix huawei filter to search all namespaces
  * nvme-cli: Support for hugetlbfs
  * Remove all 'struct nvme_command' usage
  * nvme-cli: Update PMR Capability and PMR Status 	1. Adding Controller Memory Space Supported(CMSS) in PMRCAP 	2. Adding Persistent Memory Region Status(CBAI) in PMRSTS
  * nvme-cli: Update Controller Capabilities Register 	1. Add Controller Memory Buffer Supported (CMBS)
  * nvme-cli: Update NVMe Registers 	1. Add Controller Memory Buffer Memory Space Control (CMBMSC) 	2. Add Controller Memory Buffer Status (CMBSTS) 	3. Add Persistent Memory Region Memory Space Control (PMRMSC)
  * fixup attach-ns documentation
  * Add files via upload
  * [NVMe-CLI] Updates and fixes to WDC plugin command vs-internal-log for the SN340 drive.
  * Regen docs, add host-nqn man page
  * [NVMe-ClI] Add Documentation files for clear-fw-activate-history command
  * [NVMe-CLI] Add clear-fw-activate-history WDC plugin command
  * fix namespace checks for legacy list
  * Reset wdc_do_cap_dui default parameters to the proper values
  * README.md: Mention the OpenEmbedded/Yocto recipe
  * Intel plugin: Adding fields to id-ctrl VU region Per https://github.com/linux-nvme/nvme-cli/pull/584/commits/f33510efbf5192116e5757d13a02463d446a1dc5#r332178975 removing pack pragma on vu_id_ctrl_field struct.
  * udev: convert the discovery event handler to the kernel support
  * Use a systemd app-specific machine ID for hostnqn
  * nvme-cli: Add 'transport type' error to the error log
  * nvme-cli: Update nvme_endurance_group_log structure
  * Adding fields to id-ctrl VU reigon for Intel DC drives
  * Check return value of scandir
  * nvme-cli: Add namespace-id option to self-test-log
  * Report invalid output format for 'list' command
  * Provide no-binary output format help text
  * regen documentation
  * Documentation: nvme-wdc-vs-fw-activate-history(1,html) generated
  * nvme-cli/fabrics: Add tos param to connect cmd
  * nvme.spec.in: fix rpm build error
  * Correct self-test-log output
  * nvme: Add 'Endurance Group Critical Warning Summary' to the Smart/Health information Log
  * [NVMe-CLI] Documentation file for WDC vs-fw-activate-history command.
  * [NVMe-CLI] Add new WDC plugin command vs-fw-activate-history.
  * make: install-hostparams depends on install-etc
  * MAINT: compile warning error on 32 bit system
  * nvme-print: fix to print ctrltype when human-readable
  * nvme: add Persistent Memory Region(PMR) Write Elasticity Status Registers
  * [NVMe-CLI] Fix Potential Memory Leak with vs-internal-log command.
  * regen docs
  * fix admin-passthru documentation typo
  * [NVMe-CLI] Fix empty file issue with vs-internal-log wdc plugin command
  * nvme-cli: Fix namespace list output
  * Fix builds for missing uuid
  * Revert "remove LIBUUID things from nvme.h"
  * Revert "nvme-cli: Fix compile on non-libuuid machines"
  * Revert "fix uuid include typo"
  * [NVMe-CLI] Fix offset parameter size for vs-internal-log wdc plugin command.
  * remove LIBUUID things from nvme.h
  * fix build error due to asprintf()
  * id-ctrl: show Flush command behavior in VWC
  * fix uuid include typo
  * nvme-cli: Fix compile on non-libuuid machines
  * [NVMe-CLI] Add updated documentation for additional parameters to specify file size   in vs-internal-log command.
  * Regen docs
  * nvme-cli: Code cleanup
  * nvme-cli: Macro'ify argument defines
  * nvme-cli: Code reorg
  * [NVMe-CLI] Add support to specify file size in get DUI data for SN340.
  * Regenerate documentation
  * nvme-cli: Make 'list' more useful
  * id-ctrl: show Persistent Event Log support in LPA
  * id-ctrl: show Persistent Event Log Size(PELS)
  * id-ctrl: show Endurance Group Maximum ID(ENDGIDMAX)
  * id-ctrl: show FRU Globally Unique Identifier(FGUID)
  * id-ctrl: show Controller Type(CNTRLTYPE)
  * id-ctrl: update id-ctrl header for 1.4
  * systemd: fix echo call with absolute path
  * nvmf-autoconnect: fix absolute path for systemctl
  * make: install udev rules in sysconfdir
  * Add an example for attach-ns
  * make: fix discovery.conf override
  * fabrics: fix loop connect-all
  * nvme: fix compilation error
  * nvme-cli: Enhance format FNA detection
  * nvme-cli: Warn and delay before formatting
  * nvme-cli: prefill metadata buffers
  * Fixed bash-nvme-completion.sh typo
  * Tag release: v1.9
  * Regen docs
  * nvme: UUIDs for Vendor-Specific Information
  * nvme: add Persistent Memory Region (PMR) registers
  * get-lba-status: add Get LBA Status command
  * Added openSUSE Leap to README.md
  * id-ctrl: add 1.4 features to OAES
  * Update packaging state in Arch Linux
  * Fix code block style in the first section
  * nvme-cli: nvmf auto-connect scripts
  * nvme-cli: add --quiet option
  * nvme-cli: Expand --device argument processing
  * nvme-cli: Add routine to search for controller with specific attributes
  * nvme-cli: Add routine to compare ctrl_list_item to connect args
  * nvme-cli: extend ctrl_list_item for connect attributes
  * nvme-cli: Refactor to create a get_nvme_ctrl_info routine
  * nvme-cli: allow discover to address discovery controller by persistent name
  * nvme-cli: support persistent connections to a discovery controller
  * nvme-cli: ignore arguments that pass in "none"
  * nvme-print: show new CMBLOC bit fields added in NVMe 1.4
  * nvme: add support for Namespace Granularity
  * nvme: sanitize enhancements
  * nvme-cli: Update manpages to reflect discovery particulars
  * nvme-cli: mask out invalid options during discovery
  * nvme-cli: do not use 'queue_size' and 'nr_io_queues' for discovery controller
  * nvme: Enhanced Command Retry
  * id-ctrl: add an indicator for get lba status capability
  * nvme: change format default namespace id
  * lnvm: introduce alias geometry for id-ns for lnvm
  * lnvm: introduce chunk-log command for chunk info
  * lnvm: make data_len to sizeof() instead of magic number
- Add patches from SLE15:
  * 0101-nvme-add-iopolicy-rules-for-netapp.patch
  * 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Drop patches merged with upstream:
  * 0001-nvme_fc-auto-connect-scripts.patch
  * 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  * 0003-Add-nvmefc-connect.target.patch
  * 0004-Change-service-to-type-simple.patch
  * 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  * 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  * 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
  * 0008-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="hare@suse.de" date="1574164800">- Add libhugetlbfs to the list of build requirements</changelog>
  <changelog author="hare@suse.com" date="1579176000">- Update to version 1.10.1+git2.797ec65:
  * Makefile: generate Dracut config according to UDEVDIR
  * Add additional smart log critical warn decoding
  * New tag for missing docs
  * Add new wdc documentation
  * Release v1.10
  * Regen documentation
  * Use asprintf for long names
  * [NVME-CLI] Add documentation file for vs-error-reason-identifier WDC            plugin command. [NVME-CLI] Minor updates/corrections to the clear-fw-activate-history            and vs-fw-activate-history command help text.
  * [NVME-CLI] Add support for WDC plugin command - vs-error-reason-identifier [NVME-CLI] Reverse enable/disable bit on the vs-telemetry-controller-option            WDC plugin command
  * Fix systemd service script use of CONNECT_ARGS env var
  * Shannon Plugin update.
  * Doc/Makefile: Introduce 'quiet' build option
  * Makefile: use 'quiet' compile
  * Makefile: Use special variables
  * micron: don't ignore 'system()' return value
  * Fix libhugetlbfs flags
  * Regenerate documentation
  * Micron plugin updates
  * README.md: Mention the buildroot package
  * nvmf-autoconnect: add udev rules to set iopolicy for certain NetApp devices
  * Fix intel json latency statistics output format
  * intel: Add function lat-stats to cli Adds the lat-stats function to intel plugin. If lat-stats-tracking is enabled, lat-stats will print out latency statistics according to the user's desired format.
  * [NVMe-CLI] Update documentation for telemetry data retrieval to vs-internal-log wdc plugin command.
  * [NVMe-CLI] Add support to retrieve telemetry data in vs-internal-log
  * [nvme-cli] Add documentation file for new  wdc plugin command - vs-telemetry-controller-option
  * [nvme-cli] Add support for wdc plugin command - vs-telemetry-controller-option
  * Fix typo (bulit -&gt; built)
  * Warn on admin-passthru opcode not matching read/write flag
  * MAINT: Fix format compile warning error on 32 bit system
  * nvme-cli: Check for sysfs interface before NVMe discovery
  * Revert "Add Dera plugin extension."
  * Revert "Add Dera plugin extension."
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Improve self test log command
  * nvme-cli: Update err to 0 in get_telemetry_log
  * fixup up self-test log when no test is in progress
  * nvme-cli: Update err value to 0 in get_ns_id func.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * nvme.c: create-ns arguments are added
- Remove patch merged with upstream
  * Delete 0101-nvme-add-iopolicy-rules-for-netapp.patch</changelog>
  <changelog author="hare@suse.com" date="1580126400">- Update to version 1.10.1+git9.872e6b0:
  * fabrics: fix connection args parsing
  * nvmf-autoconnect.service
  * Fix status displayed by vs-telemetry-controller-option wdc plugin command.
  * Provide documentation for log page directory WDC plugin command
  * Provide WDC plugin command to dump log page directory
  * Tests: Hande string encoding and handling failures
  * Makefile: use UDEVRULESDIR instead of UDEVDIR
- Rename 'nvme-det-hostnqn' script to 'nvme-gen-hostnqn'</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.12
  * Corrected text output in FW activation history
  * nvme: allow addr family to recognize loop
  * Add log page CA parsing
  * nvme status code updates based nvme spec v1.4
  * Provide documentation for log page directory WDC plugin command
  * Fix status displayed by vs-telemetry-controller-option wdc plugin
  * fabrics: ignore hostnqn file if its empty</changelog>
  <changelog author="daniel.wagner@suse.com" date="1603454400">- update to 1.13
  * support for zoned command set
  * Identify I/O Command Set data structure command added
  * Added new namespace list command on list-ns, 4056 modification added
  * Added temperature information getting and text formatting
  * Implemented additional statistics to display
  * nvme: add support for non shared namespaces</changelog>
  <changelog author="daniel.wagner@suse.com" date="1621339200">- Add KATO fixes for NVMEoF (bsc#1182591)
  * add 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
  * add 0002-print-device-name-when-creating-a-persistent-device.patch
- Lookup existing persistent controllers (bsc#1179825)
  * add 0003-nvme-discover-lookup-existing-persistent-controllers.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1624276800">- Do not print error message when opening controller (bsc#1186719)
  * add 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1628683200">- Fix failures during 'nvme list' (bsc#1186719)
  * add 0005-nvme-ioctl-return-1-on-failure-from-nvme_get_nsid.patch
  * add 0006-nvme-topology-scan-all-controllers-in-scan_subsystem.patch
- Permit integer as KATO argument (bsc#1182591)
  * add 0007-fabrics-permit-kato-int-argument-for-discovery-contr.patch
- Skip connect if transport type doesn't match (bsc#1187287 bsc#1187860)
  * add 0008-fabrics-skip-connect-if-transport-type-doesn-t-match.patch
- Ignore non live controllers when scanning subsystems (bsc#1186719 bsc#1187287)
  * add 0009-nvme-topology-fix-controller-check-in-scan_subsystem.patch
- Remove UUID validation heuristic (bsc#1187890)
  * add 0010-gen-hostnqn-Remove-UUID-validation-heuristic.patch
  * update 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Do not segfault when controller is not available (bsc#1189046)
  * add 0011-nvme-print-fix-nvme-list-segfault-if-controller-is-u.patch
- Use correct default port for discovery (bsc#1189195 bsc#1187858)
  * add 0012-fabrics-add-default-port-number-for-NVMe-TCP-I-O-con.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1637236800">- Allow -1 as ctrl_loss_tmo value (bsc#1192348)
  * add 0013-nvme-cli-ctrl-loss-tmo-should-accept-1-as-value.patch
- Fix segfauls while discovering (bsc#1191935)
  * add 0014-Input-expects-device-name-without-dev.patch
  * add 0015-fabrics-fix-nvme-discover-segfault-if-sysfs-path-is-.patch
  * add 0016-fabrics-Only-free-initialized-valued-on-exit.patch
  * add 0017-nvme-print-add-discovery-async-event-config-field.patch
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
- Context udpate
  * refresh 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch
- Adding missing hunk (bsc#1182591)
  * update 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
- Use pkg-config for libuuid dependency setup
  * add 0103-build-use-pkg-config-for-libuuid-detection.patch</changelog>
  <changelog author="dwagner@suse.de" date="1643198400">- fabrics: fix 'nvme connect' segfault if transport type is omitted (bsc#1193540)
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
  * add 0019-fabrics-update-discovery.conf-error-message.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649332800">- Don't print error on failed to open in nvme-topology.c (bsc#1198158)
  * add 0020-Don-t-print-error-on-failed-to-open-in-nvme-topology.patch</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- Allow selecting the network interface for connections (bsc#1199670)
  * add 0021-Add-host-iface-option.patch
- Support unique discovery subsystem NQN (bsc#1199865 bsc#1192761)
  * add 0022-fabrics-decode-current-discovery-subsystem.patch
  * add 0023-fabrics-support-unique-discovery-subsystem-NQN.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fix infinite loop on invalid parameters (bsc#1200644)
  * add 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)</changelog>
</package>
<package pkgid="920abaab95d7c7ae03404250bdd59918cd3d608a47219c9ea1428a610382f452" name="nvme-cli" arch="x86_64">
  <version epoch="0" ver="1.13" rel="150300.3.20.1"/>
  <changelog author="sschricker@suse.com" date="1555070400">- Add new 'ontapdevices' command and corresponding documentation.
  Requested in (bsc#1131930).
  + 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  + 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  + 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Revert stop-on-failure patch for connect-all, which caused
  unintended behaviour (bsc#1132124)
  + 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557144000">- Increase size of ONTAP namespace path variable
  + 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
- Fix failing service on devices without fc-hardware (bsc#1133594)
  + 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- No longer convert via obsolete DocBook 4.5 format, but rather via
  DocBook 5.x. This due to asciidoctor 2.x no longer supporting
  DocBook 4.x
  + 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557403200">- Update to version 1.8.1+git41.2c43c51:
  * nvme-print: remove Virtual Management support from ONCS
  * nvme-print: update self-test log to include 'aborted due to
    sanitize'
  * move to DocBook 5
  * nvme-cli: add missing endianness conversions for telemetry log
    page
  * property: Fit print size for a property
  * Add Disable IO flag to wdc_dump_dui_data function
  * Reorder primary commands
  * nvme-cli: add identify secondary controller list
  * sanitize/get-telemetry-log: Print nvme status in case ret &gt; 0
  * print: Introduce show_nvme_status to print nvme status
  * ioctl: Fix wrong return case of get_property
  * ioctl: Fix double-free in a loop of get_property
  * improved Documentation
  * fix compilation with GCC-8
  * fix CFLAGS parameter
  * nvme-cli: fix compilation with uint64_t cast
  * nvme-cli: minor cleanup for submit_io()
  * nvme-cli: align all the macros
  * wdc: Change device capability checking
  * wdc: Add additional device for vs-internal-log
  * wdc: Add device unit info log extraction
  * wdc: Add get drive status command
  * wdc: Add clear assert dump status command
  * wdc: Add drive resize command
  * wdc: Update device capabilities for clear pcie corr
  * wdc: Update file parameter checking
  * wdc: Add command to extract NAND statistics
  * wdc: Add data area extraction for DUI command
  * wdc: Additional device capabilities check
  * nvme-cli: fix fc trtype string
  * NVMe-CLI WDC Plugin - add support for additional SN840 device ID.
  * WDC plugin Change vs-internal-log Command to Save Partial E6 Log Data.
  * WDC Plugins vs-internal-log command unsupported on SN340.
  * Fix print format specifiers
  * Fix format block size usage
  * Add reporting of Virtual Management support to id-ctrl
  * Fix possible NULL pointer dereferences
  * Fix possible memory leak on get-internal-log
  * Print timestamp as a date and time string
  * nvme-cli: add netapp ontapdevices command
  * Add FreeBSD installation instructions
  * Adding a helper to format command
  * fabrics: Return negative errno when asprintf() fails
  * fabrics: Return negative errno to check remove_ctrl() is failed
  * nvme: Support raw_binary and json format for show-regs
  * ioctl: Free memory if get_property for fabrics failed
  * nvme: Use ARRAY_SIZE() macro in common.h
  * nvme: Unify min(), max() macro as a common one
  * nvme: Simplify description for virt-mgmt
  * nvme: Simplify virt-mgmt options to lowercase
  * nvme-print: Fix evaluation of ctratt on pretty print
  * nvme: print I/O error to stderr
- Drop obsolete patches:
  - 0001-wdc-Change-device-capability-checking.patch
  - 0002-wdc-Add-additional-device-for-vs-internal-log.patch
  - 0003-generate-new-documentation.patch
  - 0004-Fix-compilation-with-GCC-8.patch
  - 0005-Fix-CFLAGS-parameter.patch
  - 0006-nvme-cli-fix-compilation-with-uint64_t-cast.patch
  - 0007-Regen-docs.patch
  - 0008-nvme-cli-minor-cleanup-for-submit_io.patch
  - 0009-Regen-documentation.patch
  - 0010-nvme-cli-fix-fc-trtype-string.patch
  - 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  - 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  - 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch
  - 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
  - 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch
  - 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Rename downstream patch:
  + 0001-nvme_fc-auto-connect-scripts.patch
  + 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  + 0003-Add-nvmefc-connect.target.patch
  + 0004-Change-service-to-type-simple.patch
  + 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  - 0100-nvme_fc-auto-connect-scripts.patch
  - 0101-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  - 0102-Add-nvmefc-connect.target.patch
  - 0103-Change-service-to-type-simple.patch
  - 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="sschricker@suse.com" date="1558612800">- Add new subpackage containing the nvme-cli regress script
- Add script to determine host NQN based on the system UUID
  + 0008-nvme-cli-Add-script-to-determine-host-NQN.patch
- Add new udev rule for NetApp E-Series and adjust udev rule naming
  scheme accordingly. (bsc#1124564)
  + 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  + 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
- Update to version 1.8.1+git64.b969cf0:
  * fix json print for list-subsys command
  * Add Virtium plugin extension document
  * Add Virtium plugin extension
  * nvme.h: Fix typos in status code values
  * nvme-cli: remove unused NVME_AER_NOTICE_
  * list-ctrl, create-ns, format: Do not return directly without
    freeing fd</changelog>
  <changelog author="sschricker@suse.com" date="1564142400">- Update to version 1.8.1+git135.9bab71e:
  * various documentation improvements
  * nvme-cli: Restore support for older gcc versions
  * [NVMe-CLI] Add support for larger data sizes needed to get DUI data.
  * [Log] Memblaze add more log infomation for S.M.A.R.T.
  * nvme: add Verify command
  * lnvm: do not print 0 when the arg is not given
  * lnvm: remove redundant whitespace in lnvm_init()
  * nvme: clean up goto labels without whitespace
  * format: check BLKRRPART failure
  * [NVMe-CLI] Add support for SN730 to WDC plugin commmands
  * Add verbose capability to get DUI function to improve debug
  * nvme-print: Show value for Transport SGL Data Block Descriptor support
  * [NVMe-CLI] WDC: Add support for 64 bit data addresses in Get DUI Data functions
  * nvme-cli: Fix more endianness issues
  * nvme-print: add JSON for NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * fabrics: Return errno mapped for fabrics error status
  * fabrics: return error when discovery retry exhausted
  * nvme: Return errno mapped for nvme error status
  * nvme-status: Introduce nvme status module to map errno
  * nvme: Return negative error value for internal errors
  * fabrics: Do not return in the middle of the subcommand
  * nvme: Do not return in the middle of the subcommand
  * nvme-cli: Report the NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * Introduce NVMe 1.4 Identify Namespace fields in struct nvme_id_ns
  * nvme-cli: Skip properties that are not supported
  * Fix various bugs related to endianness bugs
  * NVMe-Cli Shannon Plugin-add support for shannon systems.
  * nvme-print: fix json object memory leak
  * fabrics: Fix memory leak of subsys list
  * nvme: update description for "nvme list" command
  * nvme: update list-ns nsid option
  * nvme-print: add pretty print for estimated sanitize time
  * add namespace to json output of nvme list
  * add free call for json object for commands show-regs
  * add newline for command show-regs
  * nvme-cli: remove unnecessary initialize of local var
  * nvme-cli: don't try to disconnect for ctrl with pcie transport
  * Fix sprintf truncate
- Reorder install steps: Install systemd services first, since they
  are required for the udev rules, avoiding a theoretical race
  condition.</changelog>
  <changelog author="hare@suse.com" date="1574078400">- Update to version 1.9+git122.c5097d5:
  * [NVMe-CLI] Get DUI for SN-340 failing with Data Area 4 - Buffer Misalignment
  * Minor intel-nvme print refactor
  * Use simpler nvme ioctl api for admin
  * Relocate functions and constants to the files that use them
  * Move all spec defined structs to single file
  * Update build rules for .c with no .h
  * Update my email address
  * Makefile: fix cleaning subdirectories
  * remove unused "paths" controller field
  * reign in line lengths
  * Add print for directive receive
  * Unify print routines
  * regenerate documentation
  * fix fw-download reference to committing fw
  * argconfig: Remove unused paramters
  * fix huawei filter to search all namespaces
  * nvme-cli: Support for hugetlbfs
  * Remove all 'struct nvme_command' usage
  * nvme-cli: Update PMR Capability and PMR Status 	1. Adding Controller Memory Space Supported(CMSS) in PMRCAP 	2. Adding Persistent Memory Region Status(CBAI) in PMRSTS
  * nvme-cli: Update Controller Capabilities Register 	1. Add Controller Memory Buffer Supported (CMBS)
  * nvme-cli: Update NVMe Registers 	1. Add Controller Memory Buffer Memory Space Control (CMBMSC) 	2. Add Controller Memory Buffer Status (CMBSTS) 	3. Add Persistent Memory Region Memory Space Control (PMRMSC)
  * fixup attach-ns documentation
  * Add files via upload
  * [NVMe-CLI] Updates and fixes to WDC plugin command vs-internal-log for the SN340 drive.
  * Regen docs, add host-nqn man page
  * [NVMe-ClI] Add Documentation files for clear-fw-activate-history command
  * [NVMe-CLI] Add clear-fw-activate-history WDC plugin command
  * fix namespace checks for legacy list
  * Reset wdc_do_cap_dui default parameters to the proper values
  * README.md: Mention the OpenEmbedded/Yocto recipe
  * Intel plugin: Adding fields to id-ctrl VU region Per https://github.com/linux-nvme/nvme-cli/pull/584/commits/f33510efbf5192116e5757d13a02463d446a1dc5#r332178975 removing pack pragma on vu_id_ctrl_field struct.
  * udev: convert the discovery event handler to the kernel support
  * Use a systemd app-specific machine ID for hostnqn
  * nvme-cli: Add 'transport type' error to the error log
  * nvme-cli: Update nvme_endurance_group_log structure
  * Adding fields to id-ctrl VU reigon for Intel DC drives
  * Check return value of scandir
  * nvme-cli: Add namespace-id option to self-test-log
  * Report invalid output format for 'list' command
  * Provide no-binary output format help text
  * regen documentation
  * Documentation: nvme-wdc-vs-fw-activate-history(1,html) generated
  * nvme-cli/fabrics: Add tos param to connect cmd
  * nvme.spec.in: fix rpm build error
  * Correct self-test-log output
  * nvme: Add 'Endurance Group Critical Warning Summary' to the Smart/Health information Log
  * [NVMe-CLI] Documentation file for WDC vs-fw-activate-history command.
  * [NVMe-CLI] Add new WDC plugin command vs-fw-activate-history.
  * make: install-hostparams depends on install-etc
  * MAINT: compile warning error on 32 bit system
  * nvme-print: fix to print ctrltype when human-readable
  * nvme: add Persistent Memory Region(PMR) Write Elasticity Status Registers
  * [NVMe-CLI] Fix Potential Memory Leak with vs-internal-log command.
  * regen docs
  * fix admin-passthru documentation typo
  * [NVMe-CLI] Fix empty file issue with vs-internal-log wdc plugin command
  * nvme-cli: Fix namespace list output
  * Fix builds for missing uuid
  * Revert "remove LIBUUID things from nvme.h"
  * Revert "nvme-cli: Fix compile on non-libuuid machines"
  * Revert "fix uuid include typo"
  * [NVMe-CLI] Fix offset parameter size for vs-internal-log wdc plugin command.
  * remove LIBUUID things from nvme.h
  * fix build error due to asprintf()
  * id-ctrl: show Flush command behavior in VWC
  * fix uuid include typo
  * nvme-cli: Fix compile on non-libuuid machines
  * [NVMe-CLI] Add updated documentation for additional parameters to specify file size   in vs-internal-log command.
  * Regen docs
  * nvme-cli: Code cleanup
  * nvme-cli: Macro'ify argument defines
  * nvme-cli: Code reorg
  * [NVMe-CLI] Add support to specify file size in get DUI data for SN340.
  * Regenerate documentation
  * nvme-cli: Make 'list' more useful
  * id-ctrl: show Persistent Event Log support in LPA
  * id-ctrl: show Persistent Event Log Size(PELS)
  * id-ctrl: show Endurance Group Maximum ID(ENDGIDMAX)
  * id-ctrl: show FRU Globally Unique Identifier(FGUID)
  * id-ctrl: show Controller Type(CNTRLTYPE)
  * id-ctrl: update id-ctrl header for 1.4
  * systemd: fix echo call with absolute path
  * nvmf-autoconnect: fix absolute path for systemctl
  * make: install udev rules in sysconfdir
  * Add an example for attach-ns
  * make: fix discovery.conf override
  * fabrics: fix loop connect-all
  * nvme: fix compilation error
  * nvme-cli: Enhance format FNA detection
  * nvme-cli: Warn and delay before formatting
  * nvme-cli: prefill metadata buffers
  * Fixed bash-nvme-completion.sh typo
  * Tag release: v1.9
  * Regen docs
  * nvme: UUIDs for Vendor-Specific Information
  * nvme: add Persistent Memory Region (PMR) registers
  * get-lba-status: add Get LBA Status command
  * Added openSUSE Leap to README.md
  * id-ctrl: add 1.4 features to OAES
  * Update packaging state in Arch Linux
  * Fix code block style in the first section
  * nvme-cli: nvmf auto-connect scripts
  * nvme-cli: add --quiet option
  * nvme-cli: Expand --device argument processing
  * nvme-cli: Add routine to search for controller with specific attributes
  * nvme-cli: Add routine to compare ctrl_list_item to connect args
  * nvme-cli: extend ctrl_list_item for connect attributes
  * nvme-cli: Refactor to create a get_nvme_ctrl_info routine
  * nvme-cli: allow discover to address discovery controller by persistent name
  * nvme-cli: support persistent connections to a discovery controller
  * nvme-cli: ignore arguments that pass in "none"
  * nvme-print: show new CMBLOC bit fields added in NVMe 1.4
  * nvme: add support for Namespace Granularity
  * nvme: sanitize enhancements
  * nvme-cli: Update manpages to reflect discovery particulars
  * nvme-cli: mask out invalid options during discovery
  * nvme-cli: do not use 'queue_size' and 'nr_io_queues' for discovery controller
  * nvme: Enhanced Command Retry
  * id-ctrl: add an indicator for get lba status capability
  * nvme: change format default namespace id
  * lnvm: introduce alias geometry for id-ns for lnvm
  * lnvm: introduce chunk-log command for chunk info
  * lnvm: make data_len to sizeof() instead of magic number
- Add patches from SLE15:
  * 0101-nvme-add-iopolicy-rules-for-netapp.patch
  * 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Drop patches merged with upstream:
  * 0001-nvme_fc-auto-connect-scripts.patch
  * 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  * 0003-Add-nvmefc-connect.target.patch
  * 0004-Change-service-to-type-simple.patch
  * 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  * 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  * 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
  * 0008-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="hare@suse.de" date="1574164800">- Add libhugetlbfs to the list of build requirements</changelog>
  <changelog author="hare@suse.com" date="1579176000">- Update to version 1.10.1+git2.797ec65:
  * Makefile: generate Dracut config according to UDEVDIR
  * Add additional smart log critical warn decoding
  * New tag for missing docs
  * Add new wdc documentation
  * Release v1.10
  * Regen documentation
  * Use asprintf for long names
  * [NVME-CLI] Add documentation file for vs-error-reason-identifier WDC            plugin command. [NVME-CLI] Minor updates/corrections to the clear-fw-activate-history            and vs-fw-activate-history command help text.
  * [NVME-CLI] Add support for WDC plugin command - vs-error-reason-identifier [NVME-CLI] Reverse enable/disable bit on the vs-telemetry-controller-option            WDC plugin command
  * Fix systemd service script use of CONNECT_ARGS env var
  * Shannon Plugin update.
  * Doc/Makefile: Introduce 'quiet' build option
  * Makefile: use 'quiet' compile
  * Makefile: Use special variables
  * micron: don't ignore 'system()' return value
  * Fix libhugetlbfs flags
  * Regenerate documentation
  * Micron plugin updates
  * README.md: Mention the buildroot package
  * nvmf-autoconnect: add udev rules to set iopolicy for certain NetApp devices
  * Fix intel json latency statistics output format
  * intel: Add function lat-stats to cli Adds the lat-stats function to intel plugin. If lat-stats-tracking is enabled, lat-stats will print out latency statistics according to the user's desired format.
  * [NVMe-CLI] Update documentation for telemetry data retrieval to vs-internal-log wdc plugin command.
  * [NVMe-CLI] Add support to retrieve telemetry data in vs-internal-log
  * [nvme-cli] Add documentation file for new  wdc plugin command - vs-telemetry-controller-option
  * [nvme-cli] Add support for wdc plugin command - vs-telemetry-controller-option
  * Fix typo (bulit -&gt; built)
  * Warn on admin-passthru opcode not matching read/write flag
  * MAINT: Fix format compile warning error on 32 bit system
  * nvme-cli: Check for sysfs interface before NVMe discovery
  * Revert "Add Dera plugin extension."
  * Revert "Add Dera plugin extension."
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Improve self test log command
  * nvme-cli: Update err to 0 in get_telemetry_log
  * fixup up self-test log when no test is in progress
  * nvme-cli: Update err value to 0 in get_ns_id func.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * nvme.c: create-ns arguments are added
- Remove patch merged with upstream
  * Delete 0101-nvme-add-iopolicy-rules-for-netapp.patch</changelog>
  <changelog author="hare@suse.com" date="1580126400">- Update to version 1.10.1+git9.872e6b0:
  * fabrics: fix connection args parsing
  * nvmf-autoconnect.service
  * Fix status displayed by vs-telemetry-controller-option wdc plugin command.
  * Provide documentation for log page directory WDC plugin command
  * Provide WDC plugin command to dump log page directory
  * Tests: Hande string encoding and handling failures
  * Makefile: use UDEVRULESDIR instead of UDEVDIR
- Rename 'nvme-det-hostnqn' script to 'nvme-gen-hostnqn'</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.12
  * Corrected text output in FW activation history
  * nvme: allow addr family to recognize loop
  * Add log page CA parsing
  * nvme status code updates based nvme spec v1.4
  * Provide documentation for log page directory WDC plugin command
  * Fix status displayed by vs-telemetry-controller-option wdc plugin
  * fabrics: ignore hostnqn file if its empty</changelog>
  <changelog author="daniel.wagner@suse.com" date="1603454400">- update to 1.13
  * support for zoned command set
  * Identify I/O Command Set data structure command added
  * Added new namespace list command on list-ns, 4056 modification added
  * Added temperature information getting and text formatting
  * Implemented additional statistics to display
  * nvme: add support for non shared namespaces</changelog>
  <changelog author="daniel.wagner@suse.com" date="1621339200">- Add KATO fixes for NVMEoF (bsc#1182591)
  * add 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
  * add 0002-print-device-name-when-creating-a-persistent-device.patch
- Lookup existing persistent controllers (bsc#1179825)
  * add 0003-nvme-discover-lookup-existing-persistent-controllers.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1624276800">- Do not print error message when opening controller (bsc#1186719)
  * add 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1628683200">- Fix failures during 'nvme list' (bsc#1186719)
  * add 0005-nvme-ioctl-return-1-on-failure-from-nvme_get_nsid.patch
  * add 0006-nvme-topology-scan-all-controllers-in-scan_subsystem.patch
- Permit integer as KATO argument (bsc#1182591)
  * add 0007-fabrics-permit-kato-int-argument-for-discovery-contr.patch
- Skip connect if transport type doesn't match (bsc#1187287 bsc#1187860)
  * add 0008-fabrics-skip-connect-if-transport-type-doesn-t-match.patch
- Ignore non live controllers when scanning subsystems (bsc#1186719 bsc#1187287)
  * add 0009-nvme-topology-fix-controller-check-in-scan_subsystem.patch
- Remove UUID validation heuristic (bsc#1187890)
  * add 0010-gen-hostnqn-Remove-UUID-validation-heuristic.patch
  * update 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Do not segfault when controller is not available (bsc#1189046)
  * add 0011-nvme-print-fix-nvme-list-segfault-if-controller-is-u.patch
- Use correct default port for discovery (bsc#1189195 bsc#1187858)
  * add 0012-fabrics-add-default-port-number-for-NVMe-TCP-I-O-con.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1637236800">- Allow -1 as ctrl_loss_tmo value (bsc#1192348)
  * add 0013-nvme-cli-ctrl-loss-tmo-should-accept-1-as-value.patch
- Fix segfauls while discovering (bsc#1191935)
  * add 0014-Input-expects-device-name-without-dev.patch
  * add 0015-fabrics-fix-nvme-discover-segfault-if-sysfs-path-is-.patch
  * add 0016-fabrics-Only-free-initialized-valued-on-exit.patch
  * add 0017-nvme-print-add-discovery-async-event-config-field.patch
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
- Context udpate
  * refresh 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch
- Adding missing hunk (bsc#1182591)
  * update 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
- Use pkg-config for libuuid dependency setup
  * add 0103-build-use-pkg-config-for-libuuid-detection.patch</changelog>
  <changelog author="dwagner@suse.de" date="1643198400">- fabrics: fix 'nvme connect' segfault if transport type is omitted (bsc#1193540)
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
  * add 0019-fabrics-update-discovery.conf-error-message.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649332800">- Don't print error on failed to open in nvme-topology.c (bsc#1198158)
  * add 0020-Don-t-print-error-on-failed-to-open-in-nvme-topology.patch</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- Allow selecting the network interface for connections (bsc#1199670)
  * add 0021-Add-host-iface-option.patch
- Support unique discovery subsystem NQN (bsc#1199865 bsc#1192761)
  * add 0022-fabrics-decode-current-discovery-subsystem.patch
  * add 0023-fabrics-support-unique-discovery-subsystem-NQN.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fix infinite loop on invalid parameters (bsc#1200644)
  * add 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)</changelog>
</package>
<package pkgid="bf48cc6428b815cae047e0921fc4f714393b6d193e466e179d889b740a936ed7" name="nvme-cli" arch="aarch64">
  <version epoch="0" ver="1.13" rel="150300.3.23.2"/>
  <changelog author="sschricker@suse.com" date="1557144000">- Increase size of ONTAP namespace path variable
  + 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
- Fix failing service on devices without fc-hardware (bsc#1133594)
  + 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- No longer convert via obsolete DocBook 4.5 format, but rather via
  DocBook 5.x. This due to asciidoctor 2.x no longer supporting
  DocBook 4.x
  + 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557403200">- Update to version 1.8.1+git41.2c43c51:
  * nvme-print: remove Virtual Management support from ONCS
  * nvme-print: update self-test log to include 'aborted due to
    sanitize'
  * move to DocBook 5
  * nvme-cli: add missing endianness conversions for telemetry log
    page
  * property: Fit print size for a property
  * Add Disable IO flag to wdc_dump_dui_data function
  * Reorder primary commands
  * nvme-cli: add identify secondary controller list
  * sanitize/get-telemetry-log: Print nvme status in case ret &gt; 0
  * print: Introduce show_nvme_status to print nvme status
  * ioctl: Fix wrong return case of get_property
  * ioctl: Fix double-free in a loop of get_property
  * improved Documentation
  * fix compilation with GCC-8
  * fix CFLAGS parameter
  * nvme-cli: fix compilation with uint64_t cast
  * nvme-cli: minor cleanup for submit_io()
  * nvme-cli: align all the macros
  * wdc: Change device capability checking
  * wdc: Add additional device for vs-internal-log
  * wdc: Add device unit info log extraction
  * wdc: Add get drive status command
  * wdc: Add clear assert dump status command
  * wdc: Add drive resize command
  * wdc: Update device capabilities for clear pcie corr
  * wdc: Update file parameter checking
  * wdc: Add command to extract NAND statistics
  * wdc: Add data area extraction for DUI command
  * wdc: Additional device capabilities check
  * nvme-cli: fix fc trtype string
  * NVMe-CLI WDC Plugin - add support for additional SN840 device ID.
  * WDC plugin Change vs-internal-log Command to Save Partial E6 Log Data.
  * WDC Plugins vs-internal-log command unsupported on SN340.
  * Fix print format specifiers
  * Fix format block size usage
  * Add reporting of Virtual Management support to id-ctrl
  * Fix possible NULL pointer dereferences
  * Fix possible memory leak on get-internal-log
  * Print timestamp as a date and time string
  * nvme-cli: add netapp ontapdevices command
  * Add FreeBSD installation instructions
  * Adding a helper to format command
  * fabrics: Return negative errno when asprintf() fails
  * fabrics: Return negative errno to check remove_ctrl() is failed
  * nvme: Support raw_binary and json format for show-regs
  * ioctl: Free memory if get_property for fabrics failed
  * nvme: Use ARRAY_SIZE() macro in common.h
  * nvme: Unify min(), max() macro as a common one
  * nvme: Simplify description for virt-mgmt
  * nvme: Simplify virt-mgmt options to lowercase
  * nvme-print: Fix evaluation of ctratt on pretty print
  * nvme: print I/O error to stderr
- Drop obsolete patches:
  - 0001-wdc-Change-device-capability-checking.patch
  - 0002-wdc-Add-additional-device-for-vs-internal-log.patch
  - 0003-generate-new-documentation.patch
  - 0004-Fix-compilation-with-GCC-8.patch
  - 0005-Fix-CFLAGS-parameter.patch
  - 0006-nvme-cli-fix-compilation-with-uint64_t-cast.patch
  - 0007-Regen-docs.patch
  - 0008-nvme-cli-minor-cleanup-for-submit_io.patch
  - 0009-Regen-documentation.patch
  - 0010-nvme-cli-fix-fc-trtype-string.patch
  - 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  - 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  - 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch
  - 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
  - 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch
  - 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Rename downstream patch:
  + 0001-nvme_fc-auto-connect-scripts.patch
  + 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  + 0003-Add-nvmefc-connect.target.patch
  + 0004-Change-service-to-type-simple.patch
  + 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  - 0100-nvme_fc-auto-connect-scripts.patch
  - 0101-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  - 0102-Add-nvmefc-connect.target.patch
  - 0103-Change-service-to-type-simple.patch
  - 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="sschricker@suse.com" date="1558612800">- Add new subpackage containing the nvme-cli regress script
- Add script to determine host NQN based on the system UUID
  + 0008-nvme-cli-Add-script-to-determine-host-NQN.patch
- Add new udev rule for NetApp E-Series and adjust udev rule naming
  scheme accordingly. (bsc#1124564)
  + 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  + 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
- Update to version 1.8.1+git64.b969cf0:
  * fix json print for list-subsys command
  * Add Virtium plugin extension document
  * Add Virtium plugin extension
  * nvme.h: Fix typos in status code values
  * nvme-cli: remove unused NVME_AER_NOTICE_
  * list-ctrl, create-ns, format: Do not return directly without
    freeing fd</changelog>
  <changelog author="sschricker@suse.com" date="1564142400">- Update to version 1.8.1+git135.9bab71e:
  * various documentation improvements
  * nvme-cli: Restore support for older gcc versions
  * [NVMe-CLI] Add support for larger data sizes needed to get DUI data.
  * [Log] Memblaze add more log infomation for S.M.A.R.T.
  * nvme: add Verify command
  * lnvm: do not print 0 when the arg is not given
  * lnvm: remove redundant whitespace in lnvm_init()
  * nvme: clean up goto labels without whitespace
  * format: check BLKRRPART failure
  * [NVMe-CLI] Add support for SN730 to WDC plugin commmands
  * Add verbose capability to get DUI function to improve debug
  * nvme-print: Show value for Transport SGL Data Block Descriptor support
  * [NVMe-CLI] WDC: Add support for 64 bit data addresses in Get DUI Data functions
  * nvme-cli: Fix more endianness issues
  * nvme-print: add JSON for NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * fabrics: Return errno mapped for fabrics error status
  * fabrics: return error when discovery retry exhausted
  * nvme: Return errno mapped for nvme error status
  * nvme-status: Introduce nvme status module to map errno
  * nvme: Return negative error value for internal errors
  * fabrics: Do not return in the middle of the subcommand
  * nvme: Do not return in the middle of the subcommand
  * nvme-cli: Report the NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * Introduce NVMe 1.4 Identify Namespace fields in struct nvme_id_ns
  * nvme-cli: Skip properties that are not supported
  * Fix various bugs related to endianness bugs
  * NVMe-Cli Shannon Plugin-add support for shannon systems.
  * nvme-print: fix json object memory leak
  * fabrics: Fix memory leak of subsys list
  * nvme: update description for "nvme list" command
  * nvme: update list-ns nsid option
  * nvme-print: add pretty print for estimated sanitize time
  * add namespace to json output of nvme list
  * add free call for json object for commands show-regs
  * add newline for command show-regs
  * nvme-cli: remove unnecessary initialize of local var
  * nvme-cli: don't try to disconnect for ctrl with pcie transport
  * Fix sprintf truncate
- Reorder install steps: Install systemd services first, since they
  are required for the udev rules, avoiding a theoretical race
  condition.</changelog>
  <changelog author="hare@suse.com" date="1574078400">- Update to version 1.9+git122.c5097d5:
  * [NVMe-CLI] Get DUI for SN-340 failing with Data Area 4 - Buffer Misalignment
  * Minor intel-nvme print refactor
  * Use simpler nvme ioctl api for admin
  * Relocate functions and constants to the files that use them
  * Move all spec defined structs to single file
  * Update build rules for .c with no .h
  * Update my email address
  * Makefile: fix cleaning subdirectories
  * remove unused "paths" controller field
  * reign in line lengths
  * Add print for directive receive
  * Unify print routines
  * regenerate documentation
  * fix fw-download reference to committing fw
  * argconfig: Remove unused paramters
  * fix huawei filter to search all namespaces
  * nvme-cli: Support for hugetlbfs
  * Remove all 'struct nvme_command' usage
  * nvme-cli: Update PMR Capability and PMR Status 	1. Adding Controller Memory Space Supported(CMSS) in PMRCAP 	2. Adding Persistent Memory Region Status(CBAI) in PMRSTS
  * nvme-cli: Update Controller Capabilities Register 	1. Add Controller Memory Buffer Supported (CMBS)
  * nvme-cli: Update NVMe Registers 	1. Add Controller Memory Buffer Memory Space Control (CMBMSC) 	2. Add Controller Memory Buffer Status (CMBSTS) 	3. Add Persistent Memory Region Memory Space Control (PMRMSC)
  * fixup attach-ns documentation
  * Add files via upload
  * [NVMe-CLI] Updates and fixes to WDC plugin command vs-internal-log for the SN340 drive.
  * Regen docs, add host-nqn man page
  * [NVMe-ClI] Add Documentation files for clear-fw-activate-history command
  * [NVMe-CLI] Add clear-fw-activate-history WDC plugin command
  * fix namespace checks for legacy list
  * Reset wdc_do_cap_dui default parameters to the proper values
  * README.md: Mention the OpenEmbedded/Yocto recipe
  * Intel plugin: Adding fields to id-ctrl VU region Per https://github.com/linux-nvme/nvme-cli/pull/584/commits/f33510efbf5192116e5757d13a02463d446a1dc5#r332178975 removing pack pragma on vu_id_ctrl_field struct.
  * udev: convert the discovery event handler to the kernel support
  * Use a systemd app-specific machine ID for hostnqn
  * nvme-cli: Add 'transport type' error to the error log
  * nvme-cli: Update nvme_endurance_group_log structure
  * Adding fields to id-ctrl VU reigon for Intel DC drives
  * Check return value of scandir
  * nvme-cli: Add namespace-id option to self-test-log
  * Report invalid output format for 'list' command
  * Provide no-binary output format help text
  * regen documentation
  * Documentation: nvme-wdc-vs-fw-activate-history(1,html) generated
  * nvme-cli/fabrics: Add tos param to connect cmd
  * nvme.spec.in: fix rpm build error
  * Correct self-test-log output
  * nvme: Add 'Endurance Group Critical Warning Summary' to the Smart/Health information Log
  * [NVMe-CLI] Documentation file for WDC vs-fw-activate-history command.
  * [NVMe-CLI] Add new WDC plugin command vs-fw-activate-history.
  * make: install-hostparams depends on install-etc
  * MAINT: compile warning error on 32 bit system
  * nvme-print: fix to print ctrltype when human-readable
  * nvme: add Persistent Memory Region(PMR) Write Elasticity Status Registers
  * [NVMe-CLI] Fix Potential Memory Leak with vs-internal-log command.
  * regen docs
  * fix admin-passthru documentation typo
  * [NVMe-CLI] Fix empty file issue with vs-internal-log wdc plugin command
  * nvme-cli: Fix namespace list output
  * Fix builds for missing uuid
  * Revert "remove LIBUUID things from nvme.h"
  * Revert "nvme-cli: Fix compile on non-libuuid machines"
  * Revert "fix uuid include typo"
  * [NVMe-CLI] Fix offset parameter size for vs-internal-log wdc plugin command.
  * remove LIBUUID things from nvme.h
  * fix build error due to asprintf()
  * id-ctrl: show Flush command behavior in VWC
  * fix uuid include typo
  * nvme-cli: Fix compile on non-libuuid machines
  * [NVMe-CLI] Add updated documentation for additional parameters to specify file size   in vs-internal-log command.
  * Regen docs
  * nvme-cli: Code cleanup
  * nvme-cli: Macro'ify argument defines
  * nvme-cli: Code reorg
  * [NVMe-CLI] Add support to specify file size in get DUI data for SN340.
  * Regenerate documentation
  * nvme-cli: Make 'list' more useful
  * id-ctrl: show Persistent Event Log support in LPA
  * id-ctrl: show Persistent Event Log Size(PELS)
  * id-ctrl: show Endurance Group Maximum ID(ENDGIDMAX)
  * id-ctrl: show FRU Globally Unique Identifier(FGUID)
  * id-ctrl: show Controller Type(CNTRLTYPE)
  * id-ctrl: update id-ctrl header for 1.4
  * systemd: fix echo call with absolute path
  * nvmf-autoconnect: fix absolute path for systemctl
  * make: install udev rules in sysconfdir
  * Add an example for attach-ns
  * make: fix discovery.conf override
  * fabrics: fix loop connect-all
  * nvme: fix compilation error
  * nvme-cli: Enhance format FNA detection
  * nvme-cli: Warn and delay before formatting
  * nvme-cli: prefill metadata buffers
  * Fixed bash-nvme-completion.sh typo
  * Tag release: v1.9
  * Regen docs
  * nvme: UUIDs for Vendor-Specific Information
  * nvme: add Persistent Memory Region (PMR) registers
  * get-lba-status: add Get LBA Status command
  * Added openSUSE Leap to README.md
  * id-ctrl: add 1.4 features to OAES
  * Update packaging state in Arch Linux
  * Fix code block style in the first section
  * nvme-cli: nvmf auto-connect scripts
  * nvme-cli: add --quiet option
  * nvme-cli: Expand --device argument processing
  * nvme-cli: Add routine to search for controller with specific attributes
  * nvme-cli: Add routine to compare ctrl_list_item to connect args
  * nvme-cli: extend ctrl_list_item for connect attributes
  * nvme-cli: Refactor to create a get_nvme_ctrl_info routine
  * nvme-cli: allow discover to address discovery controller by persistent name
  * nvme-cli: support persistent connections to a discovery controller
  * nvme-cli: ignore arguments that pass in "none"
  * nvme-print: show new CMBLOC bit fields added in NVMe 1.4
  * nvme: add support for Namespace Granularity
  * nvme: sanitize enhancements
  * nvme-cli: Update manpages to reflect discovery particulars
  * nvme-cli: mask out invalid options during discovery
  * nvme-cli: do not use 'queue_size' and 'nr_io_queues' for discovery controller
  * nvme: Enhanced Command Retry
  * id-ctrl: add an indicator for get lba status capability
  * nvme: change format default namespace id
  * lnvm: introduce alias geometry for id-ns for lnvm
  * lnvm: introduce chunk-log command for chunk info
  * lnvm: make data_len to sizeof() instead of magic number
- Add patches from SLE15:
  * 0101-nvme-add-iopolicy-rules-for-netapp.patch
  * 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Drop patches merged with upstream:
  * 0001-nvme_fc-auto-connect-scripts.patch
  * 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  * 0003-Add-nvmefc-connect.target.patch
  * 0004-Change-service-to-type-simple.patch
  * 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  * 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  * 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
  * 0008-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="hare@suse.de" date="1574164800">- Add libhugetlbfs to the list of build requirements</changelog>
  <changelog author="hare@suse.com" date="1579176000">- Update to version 1.10.1+git2.797ec65:
  * Makefile: generate Dracut config according to UDEVDIR
  * Add additional smart log critical warn decoding
  * New tag for missing docs
  * Add new wdc documentation
  * Release v1.10
  * Regen documentation
  * Use asprintf for long names
  * [NVME-CLI] Add documentation file for vs-error-reason-identifier WDC            plugin command. [NVME-CLI] Minor updates/corrections to the clear-fw-activate-history            and vs-fw-activate-history command help text.
  * [NVME-CLI] Add support for WDC plugin command - vs-error-reason-identifier [NVME-CLI] Reverse enable/disable bit on the vs-telemetry-controller-option            WDC plugin command
  * Fix systemd service script use of CONNECT_ARGS env var
  * Shannon Plugin update.
  * Doc/Makefile: Introduce 'quiet' build option
  * Makefile: use 'quiet' compile
  * Makefile: Use special variables
  * micron: don't ignore 'system()' return value
  * Fix libhugetlbfs flags
  * Regenerate documentation
  * Micron plugin updates
  * README.md: Mention the buildroot package
  * nvmf-autoconnect: add udev rules to set iopolicy for certain NetApp devices
  * Fix intel json latency statistics output format
  * intel: Add function lat-stats to cli Adds the lat-stats function to intel plugin. If lat-stats-tracking is enabled, lat-stats will print out latency statistics according to the user's desired format.
  * [NVMe-CLI] Update documentation for telemetry data retrieval to vs-internal-log wdc plugin command.
  * [NVMe-CLI] Add support to retrieve telemetry data in vs-internal-log
  * [nvme-cli] Add documentation file for new  wdc plugin command - vs-telemetry-controller-option
  * [nvme-cli] Add support for wdc plugin command - vs-telemetry-controller-option
  * Fix typo (bulit -&gt; built)
  * Warn on admin-passthru opcode not matching read/write flag
  * MAINT: Fix format compile warning error on 32 bit system
  * nvme-cli: Check for sysfs interface before NVMe discovery
  * Revert "Add Dera plugin extension."
  * Revert "Add Dera plugin extension."
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Improve self test log command
  * nvme-cli: Update err to 0 in get_telemetry_log
  * fixup up self-test log when no test is in progress
  * nvme-cli: Update err value to 0 in get_ns_id func.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * nvme.c: create-ns arguments are added
- Remove patch merged with upstream
  * Delete 0101-nvme-add-iopolicy-rules-for-netapp.patch</changelog>
  <changelog author="hare@suse.com" date="1580126400">- Update to version 1.10.1+git9.872e6b0:
  * fabrics: fix connection args parsing
  * nvmf-autoconnect.service
  * Fix status displayed by vs-telemetry-controller-option wdc plugin command.
  * Provide documentation for log page directory WDC plugin command
  * Provide WDC plugin command to dump log page directory
  * Tests: Hande string encoding and handling failures
  * Makefile: use UDEVRULESDIR instead of UDEVDIR
- Rename 'nvme-det-hostnqn' script to 'nvme-gen-hostnqn'</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.12
  * Corrected text output in FW activation history
  * nvme: allow addr family to recognize loop
  * Add log page CA parsing
  * nvme status code updates based nvme spec v1.4
  * Provide documentation for log page directory WDC plugin command
  * Fix status displayed by vs-telemetry-controller-option wdc plugin
  * fabrics: ignore hostnqn file if its empty</changelog>
  <changelog author="daniel.wagner@suse.com" date="1603454400">- update to 1.13
  * support for zoned command set
  * Identify I/O Command Set data structure command added
  * Added new namespace list command on list-ns, 4056 modification added
  * Added temperature information getting and text formatting
  * Implemented additional statistics to display
  * nvme: add support for non shared namespaces</changelog>
  <changelog author="daniel.wagner@suse.com" date="1621339200">- Add KATO fixes for NVMEoF (bsc#1182591)
  * add 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
  * add 0002-print-device-name-when-creating-a-persistent-device.patch
- Lookup existing persistent controllers (bsc#1179825)
  * add 0003-nvme-discover-lookup-existing-persistent-controllers.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1624276800">- Do not print error message when opening controller (bsc#1186719)
  * add 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1628683200">- Fix failures during 'nvme list' (bsc#1186719)
  * add 0005-nvme-ioctl-return-1-on-failure-from-nvme_get_nsid.patch
  * add 0006-nvme-topology-scan-all-controllers-in-scan_subsystem.patch
- Permit integer as KATO argument (bsc#1182591)
  * add 0007-fabrics-permit-kato-int-argument-for-discovery-contr.patch
- Skip connect if transport type doesn't match (bsc#1187287 bsc#1187860)
  * add 0008-fabrics-skip-connect-if-transport-type-doesn-t-match.patch
- Ignore non live controllers when scanning subsystems (bsc#1186719 bsc#1187287)
  * add 0009-nvme-topology-fix-controller-check-in-scan_subsystem.patch
- Remove UUID validation heuristic (bsc#1187890)
  * add 0010-gen-hostnqn-Remove-UUID-validation-heuristic.patch
  * update 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Do not segfault when controller is not available (bsc#1189046)
  * add 0011-nvme-print-fix-nvme-list-segfault-if-controller-is-u.patch
- Use correct default port for discovery (bsc#1189195 bsc#1187858)
  * add 0012-fabrics-add-default-port-number-for-NVMe-TCP-I-O-con.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1637236800">- Allow -1 as ctrl_loss_tmo value (bsc#1192348)
  * add 0013-nvme-cli-ctrl-loss-tmo-should-accept-1-as-value.patch
- Fix segfauls while discovering (bsc#1191935)
  * add 0014-Input-expects-device-name-without-dev.patch
  * add 0015-fabrics-fix-nvme-discover-segfault-if-sysfs-path-is-.patch
  * add 0016-fabrics-Only-free-initialized-valued-on-exit.patch
  * add 0017-nvme-print-add-discovery-async-event-config-field.patch
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
- Context udpate
  * refresh 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch
- Adding missing hunk (bsc#1182591)
  * update 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
- Use pkg-config for libuuid dependency setup
  * add 0103-build-use-pkg-config-for-libuuid-detection.patch</changelog>
  <changelog author="dwagner@suse.de" date="1643198400">- fabrics: fix 'nvme connect' segfault if transport type is omitted (bsc#1193540)
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
  * add 0019-fabrics-update-discovery.conf-error-message.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649332800">- Don't print error on failed to open in nvme-topology.c (bsc#1198158)
  * add 0020-Don-t-print-error-on-failed-to-open-in-nvme-topology.patch</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- Allow selecting the network interface for connections (bsc#1199670)
  * add 0021-Add-host-iface-option.patch
- Support unique discovery subsystem NQN (bsc#1199865 bsc#1192761)
  * add 0022-fabrics-decode-current-discovery-subsystem.patch
  * add 0023-fabrics-support-unique-discovery-subsystem-NQN.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fix infinite loop on invalid parameters (bsc#1200644)
  * add 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)</changelog>
  <changelog author="dwagner@suse.de" date="1668427200">- Drop support for unique discovery subsystem NQN (bsc#1199865 bsc#1192761 bsc#1204827)
  * remove 0022-fabrics-decode-current-discovery-subsystem.patch
  * remove 0023-fabrics-support-unique-discovery-subsystem-NQN.patch
  * rename 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch to
    0022-fabrics-fix-infinite-loop-on-invalid-parameters.patch</changelog>
</package>
<package pkgid="21bd9e3e174541984ecdd3741c4d674abcad748f5a6f1dd9fb50bb15492e3aa7" name="nvme-cli" arch="src">
  <version epoch="0" ver="1.13" rel="150300.3.23.2"/>
  <changelog author="sschricker@suse.com" date="1557144000">- Increase size of ONTAP namespace path variable
  + 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
- Fix failing service on devices without fc-hardware (bsc#1133594)
  + 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- No longer convert via obsolete DocBook 4.5 format, but rather via
  DocBook 5.x. This due to asciidoctor 2.x no longer supporting
  DocBook 4.x
  + 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557403200">- Update to version 1.8.1+git41.2c43c51:
  * nvme-print: remove Virtual Management support from ONCS
  * nvme-print: update self-test log to include 'aborted due to
    sanitize'
  * move to DocBook 5
  * nvme-cli: add missing endianness conversions for telemetry log
    page
  * property: Fit print size for a property
  * Add Disable IO flag to wdc_dump_dui_data function
  * Reorder primary commands
  * nvme-cli: add identify secondary controller list
  * sanitize/get-telemetry-log: Print nvme status in case ret &gt; 0
  * print: Introduce show_nvme_status to print nvme status
  * ioctl: Fix wrong return case of get_property
  * ioctl: Fix double-free in a loop of get_property
  * improved Documentation
  * fix compilation with GCC-8
  * fix CFLAGS parameter
  * nvme-cli: fix compilation with uint64_t cast
  * nvme-cli: minor cleanup for submit_io()
  * nvme-cli: align all the macros
  * wdc: Change device capability checking
  * wdc: Add additional device for vs-internal-log
  * wdc: Add device unit info log extraction
  * wdc: Add get drive status command
  * wdc: Add clear assert dump status command
  * wdc: Add drive resize command
  * wdc: Update device capabilities for clear pcie corr
  * wdc: Update file parameter checking
  * wdc: Add command to extract NAND statistics
  * wdc: Add data area extraction for DUI command
  * wdc: Additional device capabilities check
  * nvme-cli: fix fc trtype string
  * NVMe-CLI WDC Plugin - add support for additional SN840 device ID.
  * WDC plugin Change vs-internal-log Command to Save Partial E6 Log Data.
  * WDC Plugins vs-internal-log command unsupported on SN340.
  * Fix print format specifiers
  * Fix format block size usage
  * Add reporting of Virtual Management support to id-ctrl
  * Fix possible NULL pointer dereferences
  * Fix possible memory leak on get-internal-log
  * Print timestamp as a date and time string
  * nvme-cli: add netapp ontapdevices command
  * Add FreeBSD installation instructions
  * Adding a helper to format command
  * fabrics: Return negative errno when asprintf() fails
  * fabrics: Return negative errno to check remove_ctrl() is failed
  * nvme: Support raw_binary and json format for show-regs
  * ioctl: Free memory if get_property for fabrics failed
  * nvme: Use ARRAY_SIZE() macro in common.h
  * nvme: Unify min(), max() macro as a common one
  * nvme: Simplify description for virt-mgmt
  * nvme: Simplify virt-mgmt options to lowercase
  * nvme-print: Fix evaluation of ctratt on pretty print
  * nvme: print I/O error to stderr
- Drop obsolete patches:
  - 0001-wdc-Change-device-capability-checking.patch
  - 0002-wdc-Add-additional-device-for-vs-internal-log.patch
  - 0003-generate-new-documentation.patch
  - 0004-Fix-compilation-with-GCC-8.patch
  - 0005-Fix-CFLAGS-parameter.patch
  - 0006-nvme-cli-fix-compilation-with-uint64_t-cast.patch
  - 0007-Regen-docs.patch
  - 0008-nvme-cli-minor-cleanup-for-submit_io.patch
  - 0009-Regen-documentation.patch
  - 0010-nvme-cli-fix-fc-trtype-string.patch
  - 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  - 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  - 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch
  - 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
  - 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch
  - 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Rename downstream patch:
  + 0001-nvme_fc-auto-connect-scripts.patch
  + 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  + 0003-Add-nvmefc-connect.target.patch
  + 0004-Change-service-to-type-simple.patch
  + 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  - 0100-nvme_fc-auto-connect-scripts.patch
  - 0101-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  - 0102-Add-nvmefc-connect.target.patch
  - 0103-Change-service-to-type-simple.patch
  - 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="sschricker@suse.com" date="1558612800">- Add new subpackage containing the nvme-cli regress script
- Add script to determine host NQN based on the system UUID
  + 0008-nvme-cli-Add-script-to-determine-host-NQN.patch
- Add new udev rule for NetApp E-Series and adjust udev rule naming
  scheme accordingly. (bsc#1124564)
  + 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  + 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
- Update to version 1.8.1+git64.b969cf0:
  * fix json print for list-subsys command
  * Add Virtium plugin extension document
  * Add Virtium plugin extension
  * nvme.h: Fix typos in status code values
  * nvme-cli: remove unused NVME_AER_NOTICE_
  * list-ctrl, create-ns, format: Do not return directly without
    freeing fd</changelog>
  <changelog author="sschricker@suse.com" date="1564142400">- Update to version 1.8.1+git135.9bab71e:
  * various documentation improvements
  * nvme-cli: Restore support for older gcc versions
  * [NVMe-CLI] Add support for larger data sizes needed to get DUI data.
  * [Log] Memblaze add more log infomation for S.M.A.R.T.
  * nvme: add Verify command
  * lnvm: do not print 0 when the arg is not given
  * lnvm: remove redundant whitespace in lnvm_init()
  * nvme: clean up goto labels without whitespace
  * format: check BLKRRPART failure
  * [NVMe-CLI] Add support for SN730 to WDC plugin commmands
  * Add verbose capability to get DUI function to improve debug
  * nvme-print: Show value for Transport SGL Data Block Descriptor support
  * [NVMe-CLI] WDC: Add support for 64 bit data addresses in Get DUI Data functions
  * nvme-cli: Fix more endianness issues
  * nvme-print: add JSON for NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * fabrics: Return errno mapped for fabrics error status
  * fabrics: return error when discovery retry exhausted
  * nvme: Return errno mapped for nvme error status
  * nvme-status: Introduce nvme status module to map errno
  * nvme: Return negative error value for internal errors
  * fabrics: Do not return in the middle of the subcommand
  * nvme: Do not return in the middle of the subcommand
  * nvme-cli: Report the NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * Introduce NVMe 1.4 Identify Namespace fields in struct nvme_id_ns
  * nvme-cli: Skip properties that are not supported
  * Fix various bugs related to endianness bugs
  * NVMe-Cli Shannon Plugin-add support for shannon systems.
  * nvme-print: fix json object memory leak
  * fabrics: Fix memory leak of subsys list
  * nvme: update description for "nvme list" command
  * nvme: update list-ns nsid option
  * nvme-print: add pretty print for estimated sanitize time
  * add namespace to json output of nvme list
  * add free call for json object for commands show-regs
  * add newline for command show-regs
  * nvme-cli: remove unnecessary initialize of local var
  * nvme-cli: don't try to disconnect for ctrl with pcie transport
  * Fix sprintf truncate
- Reorder install steps: Install systemd services first, since they
  are required for the udev rules, avoiding a theoretical race
  condition.</changelog>
  <changelog author="hare@suse.com" date="1574078400">- Update to version 1.9+git122.c5097d5:
  * [NVMe-CLI] Get DUI for SN-340 failing with Data Area 4 - Buffer Misalignment
  * Minor intel-nvme print refactor
  * Use simpler nvme ioctl api for admin
  * Relocate functions and constants to the files that use them
  * Move all spec defined structs to single file
  * Update build rules for .c with no .h
  * Update my email address
  * Makefile: fix cleaning subdirectories
  * remove unused "paths" controller field
  * reign in line lengths
  * Add print for directive receive
  * Unify print routines
  * regenerate documentation
  * fix fw-download reference to committing fw
  * argconfig: Remove unused paramters
  * fix huawei filter to search all namespaces
  * nvme-cli: Support for hugetlbfs
  * Remove all 'struct nvme_command' usage
  * nvme-cli: Update PMR Capability and PMR Status 	1. Adding Controller Memory Space Supported(CMSS) in PMRCAP 	2. Adding Persistent Memory Region Status(CBAI) in PMRSTS
  * nvme-cli: Update Controller Capabilities Register 	1. Add Controller Memory Buffer Supported (CMBS)
  * nvme-cli: Update NVMe Registers 	1. Add Controller Memory Buffer Memory Space Control (CMBMSC) 	2. Add Controller Memory Buffer Status (CMBSTS) 	3. Add Persistent Memory Region Memory Space Control (PMRMSC)
  * fixup attach-ns documentation
  * Add files via upload
  * [NVMe-CLI] Updates and fixes to WDC plugin command vs-internal-log for the SN340 drive.
  * Regen docs, add host-nqn man page
  * [NVMe-ClI] Add Documentation files for clear-fw-activate-history command
  * [NVMe-CLI] Add clear-fw-activate-history WDC plugin command
  * fix namespace checks for legacy list
  * Reset wdc_do_cap_dui default parameters to the proper values
  * README.md: Mention the OpenEmbedded/Yocto recipe
  * Intel plugin: Adding fields to id-ctrl VU region Per https://github.com/linux-nvme/nvme-cli/pull/584/commits/f33510efbf5192116e5757d13a02463d446a1dc5#r332178975 removing pack pragma on vu_id_ctrl_field struct.
  * udev: convert the discovery event handler to the kernel support
  * Use a systemd app-specific machine ID for hostnqn
  * nvme-cli: Add 'transport type' error to the error log
  * nvme-cli: Update nvme_endurance_group_log structure
  * Adding fields to id-ctrl VU reigon for Intel DC drives
  * Check return value of scandir
  * nvme-cli: Add namespace-id option to self-test-log
  * Report invalid output format for 'list' command
  * Provide no-binary output format help text
  * regen documentation
  * Documentation: nvme-wdc-vs-fw-activate-history(1,html) generated
  * nvme-cli/fabrics: Add tos param to connect cmd
  * nvme.spec.in: fix rpm build error
  * Correct self-test-log output
  * nvme: Add 'Endurance Group Critical Warning Summary' to the Smart/Health information Log
  * [NVMe-CLI] Documentation file for WDC vs-fw-activate-history command.
  * [NVMe-CLI] Add new WDC plugin command vs-fw-activate-history.
  * make: install-hostparams depends on install-etc
  * MAINT: compile warning error on 32 bit system
  * nvme-print: fix to print ctrltype when human-readable
  * nvme: add Persistent Memory Region(PMR) Write Elasticity Status Registers
  * [NVMe-CLI] Fix Potential Memory Leak with vs-internal-log command.
  * regen docs
  * fix admin-passthru documentation typo
  * [NVMe-CLI] Fix empty file issue with vs-internal-log wdc plugin command
  * nvme-cli: Fix namespace list output
  * Fix builds for missing uuid
  * Revert "remove LIBUUID things from nvme.h"
  * Revert "nvme-cli: Fix compile on non-libuuid machines"
  * Revert "fix uuid include typo"
  * [NVMe-CLI] Fix offset parameter size for vs-internal-log wdc plugin command.
  * remove LIBUUID things from nvme.h
  * fix build error due to asprintf()
  * id-ctrl: show Flush command behavior in VWC
  * fix uuid include typo
  * nvme-cli: Fix compile on non-libuuid machines
  * [NVMe-CLI] Add updated documentation for additional parameters to specify file size   in vs-internal-log command.
  * Regen docs
  * nvme-cli: Code cleanup
  * nvme-cli: Macro'ify argument defines
  * nvme-cli: Code reorg
  * [NVMe-CLI] Add support to specify file size in get DUI data for SN340.
  * Regenerate documentation
  * nvme-cli: Make 'list' more useful
  * id-ctrl: show Persistent Event Log support in LPA
  * id-ctrl: show Persistent Event Log Size(PELS)
  * id-ctrl: show Endurance Group Maximum ID(ENDGIDMAX)
  * id-ctrl: show FRU Globally Unique Identifier(FGUID)
  * id-ctrl: show Controller Type(CNTRLTYPE)
  * id-ctrl: update id-ctrl header for 1.4
  * systemd: fix echo call with absolute path
  * nvmf-autoconnect: fix absolute path for systemctl
  * make: install udev rules in sysconfdir
  * Add an example for attach-ns
  * make: fix discovery.conf override
  * fabrics: fix loop connect-all
  * nvme: fix compilation error
  * nvme-cli: Enhance format FNA detection
  * nvme-cli: Warn and delay before formatting
  * nvme-cli: prefill metadata buffers
  * Fixed bash-nvme-completion.sh typo
  * Tag release: v1.9
  * Regen docs
  * nvme: UUIDs for Vendor-Specific Information
  * nvme: add Persistent Memory Region (PMR) registers
  * get-lba-status: add Get LBA Status command
  * Added openSUSE Leap to README.md
  * id-ctrl: add 1.4 features to OAES
  * Update packaging state in Arch Linux
  * Fix code block style in the first section
  * nvme-cli: nvmf auto-connect scripts
  * nvme-cli: add --quiet option
  * nvme-cli: Expand --device argument processing
  * nvme-cli: Add routine to search for controller with specific attributes
  * nvme-cli: Add routine to compare ctrl_list_item to connect args
  * nvme-cli: extend ctrl_list_item for connect attributes
  * nvme-cli: Refactor to create a get_nvme_ctrl_info routine
  * nvme-cli: allow discover to address discovery controller by persistent name
  * nvme-cli: support persistent connections to a discovery controller
  * nvme-cli: ignore arguments that pass in "none"
  * nvme-print: show new CMBLOC bit fields added in NVMe 1.4
  * nvme: add support for Namespace Granularity
  * nvme: sanitize enhancements
  * nvme-cli: Update manpages to reflect discovery particulars
  * nvme-cli: mask out invalid options during discovery
  * nvme-cli: do not use 'queue_size' and 'nr_io_queues' for discovery controller
  * nvme: Enhanced Command Retry
  * id-ctrl: add an indicator for get lba status capability
  * nvme: change format default namespace id
  * lnvm: introduce alias geometry for id-ns for lnvm
  * lnvm: introduce chunk-log command for chunk info
  * lnvm: make data_len to sizeof() instead of magic number
- Add patches from SLE15:
  * 0101-nvme-add-iopolicy-rules-for-netapp.patch
  * 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Drop patches merged with upstream:
  * 0001-nvme_fc-auto-connect-scripts.patch
  * 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  * 0003-Add-nvmefc-connect.target.patch
  * 0004-Change-service-to-type-simple.patch
  * 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  * 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  * 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
  * 0008-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="hare@suse.de" date="1574164800">- Add libhugetlbfs to the list of build requirements</changelog>
  <changelog author="hare@suse.com" date="1579176000">- Update to version 1.10.1+git2.797ec65:
  * Makefile: generate Dracut config according to UDEVDIR
  * Add additional smart log critical warn decoding
  * New tag for missing docs
  * Add new wdc documentation
  * Release v1.10
  * Regen documentation
  * Use asprintf for long names
  * [NVME-CLI] Add documentation file for vs-error-reason-identifier WDC            plugin command. [NVME-CLI] Minor updates/corrections to the clear-fw-activate-history            and vs-fw-activate-history command help text.
  * [NVME-CLI] Add support for WDC plugin command - vs-error-reason-identifier [NVME-CLI] Reverse enable/disable bit on the vs-telemetry-controller-option            WDC plugin command
  * Fix systemd service script use of CONNECT_ARGS env var
  * Shannon Plugin update.
  * Doc/Makefile: Introduce 'quiet' build option
  * Makefile: use 'quiet' compile
  * Makefile: Use special variables
  * micron: don't ignore 'system()' return value
  * Fix libhugetlbfs flags
  * Regenerate documentation
  * Micron plugin updates
  * README.md: Mention the buildroot package
  * nvmf-autoconnect: add udev rules to set iopolicy for certain NetApp devices
  * Fix intel json latency statistics output format
  * intel: Add function lat-stats to cli Adds the lat-stats function to intel plugin. If lat-stats-tracking is enabled, lat-stats will print out latency statistics according to the user's desired format.
  * [NVMe-CLI] Update documentation for telemetry data retrieval to vs-internal-log wdc plugin command.
  * [NVMe-CLI] Add support to retrieve telemetry data in vs-internal-log
  * [nvme-cli] Add documentation file for new  wdc plugin command - vs-telemetry-controller-option
  * [nvme-cli] Add support for wdc plugin command - vs-telemetry-controller-option
  * Fix typo (bulit -&gt; built)
  * Warn on admin-passthru opcode not matching read/write flag
  * MAINT: Fix format compile warning error on 32 bit system
  * nvme-cli: Check for sysfs interface before NVMe discovery
  * Revert "Add Dera plugin extension."
  * Revert "Add Dera plugin extension."
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Improve self test log command
  * nvme-cli: Update err to 0 in get_telemetry_log
  * fixup up self-test log when no test is in progress
  * nvme-cli: Update err value to 0 in get_ns_id func.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * nvme.c: create-ns arguments are added
- Remove patch merged with upstream
  * Delete 0101-nvme-add-iopolicy-rules-for-netapp.patch</changelog>
  <changelog author="hare@suse.com" date="1580126400">- Update to version 1.10.1+git9.872e6b0:
  * fabrics: fix connection args parsing
  * nvmf-autoconnect.service
  * Fix status displayed by vs-telemetry-controller-option wdc plugin command.
  * Provide documentation for log page directory WDC plugin command
  * Provide WDC plugin command to dump log page directory
  * Tests: Hande string encoding and handling failures
  * Makefile: use UDEVRULESDIR instead of UDEVDIR
- Rename 'nvme-det-hostnqn' script to 'nvme-gen-hostnqn'</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.12
  * Corrected text output in FW activation history
  * nvme: allow addr family to recognize loop
  * Add log page CA parsing
  * nvme status code updates based nvme spec v1.4
  * Provide documentation for log page directory WDC plugin command
  * Fix status displayed by vs-telemetry-controller-option wdc plugin
  * fabrics: ignore hostnqn file if its empty</changelog>
  <changelog author="daniel.wagner@suse.com" date="1603454400">- update to 1.13
  * support for zoned command set
  * Identify I/O Command Set data structure command added
  * Added new namespace list command on list-ns, 4056 modification added
  * Added temperature information getting and text formatting
  * Implemented additional statistics to display
  * nvme: add support for non shared namespaces</changelog>
  <changelog author="daniel.wagner@suse.com" date="1621339200">- Add KATO fixes for NVMEoF (bsc#1182591)
  * add 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
  * add 0002-print-device-name-when-creating-a-persistent-device.patch
- Lookup existing persistent controllers (bsc#1179825)
  * add 0003-nvme-discover-lookup-existing-persistent-controllers.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1624276800">- Do not print error message when opening controller (bsc#1186719)
  * add 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1628683200">- Fix failures during 'nvme list' (bsc#1186719)
  * add 0005-nvme-ioctl-return-1-on-failure-from-nvme_get_nsid.patch
  * add 0006-nvme-topology-scan-all-controllers-in-scan_subsystem.patch
- Permit integer as KATO argument (bsc#1182591)
  * add 0007-fabrics-permit-kato-int-argument-for-discovery-contr.patch
- Skip connect if transport type doesn't match (bsc#1187287 bsc#1187860)
  * add 0008-fabrics-skip-connect-if-transport-type-doesn-t-match.patch
- Ignore non live controllers when scanning subsystems (bsc#1186719 bsc#1187287)
  * add 0009-nvme-topology-fix-controller-check-in-scan_subsystem.patch
- Remove UUID validation heuristic (bsc#1187890)
  * add 0010-gen-hostnqn-Remove-UUID-validation-heuristic.patch
  * update 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Do not segfault when controller is not available (bsc#1189046)
  * add 0011-nvme-print-fix-nvme-list-segfault-if-controller-is-u.patch
- Use correct default port for discovery (bsc#1189195 bsc#1187858)
  * add 0012-fabrics-add-default-port-number-for-NVMe-TCP-I-O-con.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1637236800">- Allow -1 as ctrl_loss_tmo value (bsc#1192348)
  * add 0013-nvme-cli-ctrl-loss-tmo-should-accept-1-as-value.patch
- Fix segfauls while discovering (bsc#1191935)
  * add 0014-Input-expects-device-name-without-dev.patch
  * add 0015-fabrics-fix-nvme-discover-segfault-if-sysfs-path-is-.patch
  * add 0016-fabrics-Only-free-initialized-valued-on-exit.patch
  * add 0017-nvme-print-add-discovery-async-event-config-field.patch
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
- Context udpate
  * refresh 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch
- Adding missing hunk (bsc#1182591)
  * update 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
- Use pkg-config for libuuid dependency setup
  * add 0103-build-use-pkg-config-for-libuuid-detection.patch</changelog>
  <changelog author="dwagner@suse.de" date="1643198400">- fabrics: fix 'nvme connect' segfault if transport type is omitted (bsc#1193540)
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
  * add 0019-fabrics-update-discovery.conf-error-message.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649332800">- Don't print error on failed to open in nvme-topology.c (bsc#1198158)
  * add 0020-Don-t-print-error-on-failed-to-open-in-nvme-topology.patch</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- Allow selecting the network interface for connections (bsc#1199670)
  * add 0021-Add-host-iface-option.patch
- Support unique discovery subsystem NQN (bsc#1199865 bsc#1192761)
  * add 0022-fabrics-decode-current-discovery-subsystem.patch
  * add 0023-fabrics-support-unique-discovery-subsystem-NQN.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fix infinite loop on invalid parameters (bsc#1200644)
  * add 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)</changelog>
  <changelog author="dwagner@suse.de" date="1668427200">- Drop support for unique discovery subsystem NQN (bsc#1199865 bsc#1192761 bsc#1204827)
  * remove 0022-fabrics-decode-current-discovery-subsystem.patch
  * remove 0023-fabrics-support-unique-discovery-subsystem-NQN.patch
  * rename 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch to
    0022-fabrics-fix-infinite-loop-on-invalid-parameters.patch</changelog>
</package>
<package pkgid="7a051ae4aaac95fdf2c923fe6a1e43ddc0dc5ad2cbf3a1654ed2c4ffaed363c0" name="nvme-cli" arch="x86_64">
  <version epoch="0" ver="1.13" rel="150300.3.23.2"/>
  <changelog author="sschricker@suse.com" date="1557144000">- Increase size of ONTAP namespace path variable
  + 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
- Fix failing service on devices without fc-hardware (bsc#1133594)
  + 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- No longer convert via obsolete DocBook 4.5 format, but rather via
  DocBook 5.x. This due to asciidoctor 2.x no longer supporting
  DocBook 4.x
  + 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch</changelog>
  <changelog author="sschricker@suse.com" date="1557403200">- Update to version 1.8.1+git41.2c43c51:
  * nvme-print: remove Virtual Management support from ONCS
  * nvme-print: update self-test log to include 'aborted due to
    sanitize'
  * move to DocBook 5
  * nvme-cli: add missing endianness conversions for telemetry log
    page
  * property: Fit print size for a property
  * Add Disable IO flag to wdc_dump_dui_data function
  * Reorder primary commands
  * nvme-cli: add identify secondary controller list
  * sanitize/get-telemetry-log: Print nvme status in case ret &gt; 0
  * print: Introduce show_nvme_status to print nvme status
  * ioctl: Fix wrong return case of get_property
  * ioctl: Fix double-free in a loop of get_property
  * improved Documentation
  * fix compilation with GCC-8
  * fix CFLAGS parameter
  * nvme-cli: fix compilation with uint64_t cast
  * nvme-cli: minor cleanup for submit_io()
  * nvme-cli: align all the macros
  * wdc: Change device capability checking
  * wdc: Add additional device for vs-internal-log
  * wdc: Add device unit info log extraction
  * wdc: Add get drive status command
  * wdc: Add clear assert dump status command
  * wdc: Add drive resize command
  * wdc: Update device capabilities for clear pcie corr
  * wdc: Update file parameter checking
  * wdc: Add command to extract NAND statistics
  * wdc: Add data area extraction for DUI command
  * wdc: Additional device capabilities check
  * nvme-cli: fix fc trtype string
  * NVMe-CLI WDC Plugin - add support for additional SN840 device ID.
  * WDC plugin Change vs-internal-log Command to Save Partial E6 Log Data.
  * WDC Plugins vs-internal-log command unsupported on SN340.
  * Fix print format specifiers
  * Fix format block size usage
  * Add reporting of Virtual Management support to id-ctrl
  * Fix possible NULL pointer dereferences
  * Fix possible memory leak on get-internal-log
  * Print timestamp as a date and time string
  * nvme-cli: add netapp ontapdevices command
  * Add FreeBSD installation instructions
  * Adding a helper to format command
  * fabrics: Return negative errno when asprintf() fails
  * fabrics: Return negative errno to check remove_ctrl() is failed
  * nvme: Support raw_binary and json format for show-regs
  * ioctl: Free memory if get_property for fabrics failed
  * nvme: Use ARRAY_SIZE() macro in common.h
  * nvme: Unify min(), max() macro as a common one
  * nvme: Simplify description for virt-mgmt
  * nvme: Simplify virt-mgmt options to lowercase
  * nvme-print: Fix evaluation of ctratt on pretty print
  * nvme: print I/O error to stderr
- Drop obsolete patches:
  - 0001-wdc-Change-device-capability-checking.patch
  - 0002-wdc-Add-additional-device-for-vs-internal-log.patch
  - 0003-generate-new-documentation.patch
  - 0004-Fix-compilation-with-GCC-8.patch
  - 0005-Fix-CFLAGS-parameter.patch
  - 0006-nvme-cli-fix-compilation-with-uint64_t-cast.patch
  - 0007-Regen-docs.patch
  - 0008-nvme-cli-minor-cleanup-for-submit_io.patch
  - 0009-Regen-documentation.patch
  - 0010-nvme-cli-fix-fc-trtype-string.patch
  - 0011-nvme-cli-add-netapp-ontapdevices-command.patch
  - 0012-nvme-cli-add-netapp-ontapdevices-man-page.patch
  - 0013-nvme-cli-Revert-stop-on-failure-with-connect-all.patch
  - 0014-nvme-cli-Increase-size-of-ONTAP-namespace-path-varia.patch
  - 0015-DOC-Move-to-DocBook-5-when-using-asciidoctor.patch
  - 0104-nvme-cli-Fix-documentation-syntax-and-typo.patch
- Rename downstream patch:
  + 0001-nvme_fc-auto-connect-scripts.patch
  + 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  + 0003-Add-nvmefc-connect.target.patch
  + 0004-Change-service-to-type-simple.patch
  + 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  - 0100-nvme_fc-auto-connect-scripts.patch
  - 0101-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  - 0102-Add-nvmefc-connect.target.patch
  - 0103-Change-service-to-type-simple.patch
  - 0105-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch</changelog>
  <changelog author="sschricker@suse.com" date="1558612800">- Add new subpackage containing the nvme-cli regress script
- Add script to determine host NQN based on the system UUID
  + 0008-nvme-cli-Add-script-to-determine-host-NQN.patch
- Add new udev rule for NetApp E-Series and adjust udev rule naming
  scheme accordingly. (bsc#1124564)
  + 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  + 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
- Update to version 1.8.1+git64.b969cf0:
  * fix json print for list-subsys command
  * Add Virtium plugin extension document
  * Add Virtium plugin extension
  * nvme.h: Fix typos in status code values
  * nvme-cli: remove unused NVME_AER_NOTICE_
  * list-ctrl, create-ns, format: Do not return directly without
    freeing fd</changelog>
  <changelog author="sschricker@suse.com" date="1564142400">- Update to version 1.8.1+git135.9bab71e:
  * various documentation improvements
  * nvme-cli: Restore support for older gcc versions
  * [NVMe-CLI] Add support for larger data sizes needed to get DUI data.
  * [Log] Memblaze add more log infomation for S.M.A.R.T.
  * nvme: add Verify command
  * lnvm: do not print 0 when the arg is not given
  * lnvm: remove redundant whitespace in lnvm_init()
  * nvme: clean up goto labels without whitespace
  * format: check BLKRRPART failure
  * [NVMe-CLI] Add support for SN730 to WDC plugin commmands
  * Add verbose capability to get DUI function to improve debug
  * nvme-print: Show value for Transport SGL Data Block Descriptor support
  * [NVMe-CLI] WDC: Add support for 64 bit data addresses in Get DUI Data functions
  * nvme-cli: Fix more endianness issues
  * nvme-print: add JSON for NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * fabrics: Return errno mapped for fabrics error status
  * fabrics: return error when discovery retry exhausted
  * nvme: Return errno mapped for nvme error status
  * nvme-status: Introduce nvme status module to map errno
  * nvme: Return negative error value for internal errors
  * fabrics: Do not return in the middle of the subcommand
  * nvme: Do not return in the middle of the subcommand
  * nvme-cli: Report the NVMe 1.4 NPWG, NPWA, NPDG, NPDA and NOWS fields
  * Introduce NVMe 1.4 Identify Namespace fields in struct nvme_id_ns
  * nvme-cli: Skip properties that are not supported
  * Fix various bugs related to endianness bugs
  * NVMe-Cli Shannon Plugin-add support for shannon systems.
  * nvme-print: fix json object memory leak
  * fabrics: Fix memory leak of subsys list
  * nvme: update description for "nvme list" command
  * nvme: update list-ns nsid option
  * nvme-print: add pretty print for estimated sanitize time
  * add namespace to json output of nvme list
  * add free call for json object for commands show-regs
  * add newline for command show-regs
  * nvme-cli: remove unnecessary initialize of local var
  * nvme-cli: don't try to disconnect for ctrl with pcie transport
  * Fix sprintf truncate
- Reorder install steps: Install systemd services first, since they
  are required for the udev rules, avoiding a theoretical race
  condition.</changelog>
  <changelog author="hare@suse.com" date="1574078400">- Update to version 1.9+git122.c5097d5:
  * [NVMe-CLI] Get DUI for SN-340 failing with Data Area 4 - Buffer Misalignment
  * Minor intel-nvme print refactor
  * Use simpler nvme ioctl api for admin
  * Relocate functions and constants to the files that use them
  * Move all spec defined structs to single file
  * Update build rules for .c with no .h
  * Update my email address
  * Makefile: fix cleaning subdirectories
  * remove unused "paths" controller field
  * reign in line lengths
  * Add print for directive receive
  * Unify print routines
  * regenerate documentation
  * fix fw-download reference to committing fw
  * argconfig: Remove unused paramters
  * fix huawei filter to search all namespaces
  * nvme-cli: Support for hugetlbfs
  * Remove all 'struct nvme_command' usage
  * nvme-cli: Update PMR Capability and PMR Status 	1. Adding Controller Memory Space Supported(CMSS) in PMRCAP 	2. Adding Persistent Memory Region Status(CBAI) in PMRSTS
  * nvme-cli: Update Controller Capabilities Register 	1. Add Controller Memory Buffer Supported (CMBS)
  * nvme-cli: Update NVMe Registers 	1. Add Controller Memory Buffer Memory Space Control (CMBMSC) 	2. Add Controller Memory Buffer Status (CMBSTS) 	3. Add Persistent Memory Region Memory Space Control (PMRMSC)
  * fixup attach-ns documentation
  * Add files via upload
  * [NVMe-CLI] Updates and fixes to WDC plugin command vs-internal-log for the SN340 drive.
  * Regen docs, add host-nqn man page
  * [NVMe-ClI] Add Documentation files for clear-fw-activate-history command
  * [NVMe-CLI] Add clear-fw-activate-history WDC plugin command
  * fix namespace checks for legacy list
  * Reset wdc_do_cap_dui default parameters to the proper values
  * README.md: Mention the OpenEmbedded/Yocto recipe
  * Intel plugin: Adding fields to id-ctrl VU region Per https://github.com/linux-nvme/nvme-cli/pull/584/commits/f33510efbf5192116e5757d13a02463d446a1dc5#r332178975 removing pack pragma on vu_id_ctrl_field struct.
  * udev: convert the discovery event handler to the kernel support
  * Use a systemd app-specific machine ID for hostnqn
  * nvme-cli: Add 'transport type' error to the error log
  * nvme-cli: Update nvme_endurance_group_log structure
  * Adding fields to id-ctrl VU reigon for Intel DC drives
  * Check return value of scandir
  * nvme-cli: Add namespace-id option to self-test-log
  * Report invalid output format for 'list' command
  * Provide no-binary output format help text
  * regen documentation
  * Documentation: nvme-wdc-vs-fw-activate-history(1,html) generated
  * nvme-cli/fabrics: Add tos param to connect cmd
  * nvme.spec.in: fix rpm build error
  * Correct self-test-log output
  * nvme: Add 'Endurance Group Critical Warning Summary' to the Smart/Health information Log
  * [NVMe-CLI] Documentation file for WDC vs-fw-activate-history command.
  * [NVMe-CLI] Add new WDC plugin command vs-fw-activate-history.
  * make: install-hostparams depends on install-etc
  * MAINT: compile warning error on 32 bit system
  * nvme-print: fix to print ctrltype when human-readable
  * nvme: add Persistent Memory Region(PMR) Write Elasticity Status Registers
  * [NVMe-CLI] Fix Potential Memory Leak with vs-internal-log command.
  * regen docs
  * fix admin-passthru documentation typo
  * [NVMe-CLI] Fix empty file issue with vs-internal-log wdc plugin command
  * nvme-cli: Fix namespace list output
  * Fix builds for missing uuid
  * Revert "remove LIBUUID things from nvme.h"
  * Revert "nvme-cli: Fix compile on non-libuuid machines"
  * Revert "fix uuid include typo"
  * [NVMe-CLI] Fix offset parameter size for vs-internal-log wdc plugin command.
  * remove LIBUUID things from nvme.h
  * fix build error due to asprintf()
  * id-ctrl: show Flush command behavior in VWC
  * fix uuid include typo
  * nvme-cli: Fix compile on non-libuuid machines
  * [NVMe-CLI] Add updated documentation for additional parameters to specify file size   in vs-internal-log command.
  * Regen docs
  * nvme-cli: Code cleanup
  * nvme-cli: Macro'ify argument defines
  * nvme-cli: Code reorg
  * [NVMe-CLI] Add support to specify file size in get DUI data for SN340.
  * Regenerate documentation
  * nvme-cli: Make 'list' more useful
  * id-ctrl: show Persistent Event Log support in LPA
  * id-ctrl: show Persistent Event Log Size(PELS)
  * id-ctrl: show Endurance Group Maximum ID(ENDGIDMAX)
  * id-ctrl: show FRU Globally Unique Identifier(FGUID)
  * id-ctrl: show Controller Type(CNTRLTYPE)
  * id-ctrl: update id-ctrl header for 1.4
  * systemd: fix echo call with absolute path
  * nvmf-autoconnect: fix absolute path for systemctl
  * make: install udev rules in sysconfdir
  * Add an example for attach-ns
  * make: fix discovery.conf override
  * fabrics: fix loop connect-all
  * nvme: fix compilation error
  * nvme-cli: Enhance format FNA detection
  * nvme-cli: Warn and delay before formatting
  * nvme-cli: prefill metadata buffers
  * Fixed bash-nvme-completion.sh typo
  * Tag release: v1.9
  * Regen docs
  * nvme: UUIDs for Vendor-Specific Information
  * nvme: add Persistent Memory Region (PMR) registers
  * get-lba-status: add Get LBA Status command
  * Added openSUSE Leap to README.md
  * id-ctrl: add 1.4 features to OAES
  * Update packaging state in Arch Linux
  * Fix code block style in the first section
  * nvme-cli: nvmf auto-connect scripts
  * nvme-cli: add --quiet option
  * nvme-cli: Expand --device argument processing
  * nvme-cli: Add routine to search for controller with specific attributes
  * nvme-cli: Add routine to compare ctrl_list_item to connect args
  * nvme-cli: extend ctrl_list_item for connect attributes
  * nvme-cli: Refactor to create a get_nvme_ctrl_info routine
  * nvme-cli: allow discover to address discovery controller by persistent name
  * nvme-cli: support persistent connections to a discovery controller
  * nvme-cli: ignore arguments that pass in "none"
  * nvme-print: show new CMBLOC bit fields added in NVMe 1.4
  * nvme: add support for Namespace Granularity
  * nvme: sanitize enhancements
  * nvme-cli: Update manpages to reflect discovery particulars
  * nvme-cli: mask out invalid options during discovery
  * nvme-cli: do not use 'queue_size' and 'nr_io_queues' for discovery controller
  * nvme: Enhanced Command Retry
  * id-ctrl: add an indicator for get lba status capability
  * nvme: change format default namespace id
  * lnvm: introduce alias geometry for id-ns for lnvm
  * lnvm: introduce chunk-log command for chunk info
  * lnvm: make data_len to sizeof() instead of magic number
- Add patches from SLE15:
  * 0101-nvme-add-iopolicy-rules-for-netapp.patch
  * 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Drop patches merged with upstream:
  * 0001-nvme_fc-auto-connect-scripts.patch
  * 0002-71-nvme-iopolicy-netapp.rules-add-default-rules-for-.patch
  * 0003-Add-nvmefc-connect.target.patch
  * 0004-Change-service-to-type-simple.patch
  * 0005-nvme-cli-Check-for-sysfs-interface-before-NVMe-disco.patch
  * 0006-nvme-cli-add-default-IO-policy-rule-for-NetApp-E-Ser.patch
  * 0007-nvme-cli-Rename-udev-rule-for-ONTAP-controller.patch
  * 0008-nvme-cli-Add-script-to-determine-host-NQN.patch</changelog>
  <changelog author="hare@suse.de" date="1574164800">- Add libhugetlbfs to the list of build requirements</changelog>
  <changelog author="hare@suse.com" date="1579176000">- Update to version 1.10.1+git2.797ec65:
  * Makefile: generate Dracut config according to UDEVDIR
  * Add additional smart log critical warn decoding
  * New tag for missing docs
  * Add new wdc documentation
  * Release v1.10
  * Regen documentation
  * Use asprintf for long names
  * [NVME-CLI] Add documentation file for vs-error-reason-identifier WDC            plugin command. [NVME-CLI] Minor updates/corrections to the clear-fw-activate-history            and vs-fw-activate-history command help text.
  * [NVME-CLI] Add support for WDC plugin command - vs-error-reason-identifier [NVME-CLI] Reverse enable/disable bit on the vs-telemetry-controller-option            WDC plugin command
  * Fix systemd service script use of CONNECT_ARGS env var
  * Shannon Plugin update.
  * Doc/Makefile: Introduce 'quiet' build option
  * Makefile: use 'quiet' compile
  * Makefile: Use special variables
  * micron: don't ignore 'system()' return value
  * Fix libhugetlbfs flags
  * Regenerate documentation
  * Micron plugin updates
  * README.md: Mention the buildroot package
  * nvmf-autoconnect: add udev rules to set iopolicy for certain NetApp devices
  * Fix intel json latency statistics output format
  * intel: Add function lat-stats to cli Adds the lat-stats function to intel plugin. If lat-stats-tracking is enabled, lat-stats will print out latency statistics according to the user's desired format.
  * [NVMe-CLI] Update documentation for telemetry data retrieval to vs-internal-log wdc plugin command.
  * [NVMe-CLI] Add support to retrieve telemetry data in vs-internal-log
  * [nvme-cli] Add documentation file for new  wdc plugin command - vs-telemetry-controller-option
  * [nvme-cli] Add support for wdc plugin command - vs-telemetry-controller-option
  * Fix typo (bulit -&gt; built)
  * Warn on admin-passthru opcode not matching read/write flag
  * MAINT: Fix format compile warning error on 32 bit system
  * nvme-cli: Check for sysfs interface before NVMe discovery
  * Revert "Add Dera plugin extension."
  * Revert "Add Dera plugin extension."
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * Improve self test log command
  * nvme-cli: Update err to 0 in get_telemetry_log
  * fixup up self-test log when no test is in progress
  * nvme-cli: Update err value to 0 in get_ns_id func.
  * Add Dera plugin extension. Add stat sub-command to retrieve Dera device status and additional SMART log.
  * nvme.c: create-ns arguments are added
- Remove patch merged with upstream
  * Delete 0101-nvme-add-iopolicy-rules-for-netapp.patch</changelog>
  <changelog author="hare@suse.com" date="1580126400">- Update to version 1.10.1+git9.872e6b0:
  * fabrics: fix connection args parsing
  * nvmf-autoconnect.service
  * Fix status displayed by vs-telemetry-controller-option wdc plugin command.
  * Provide documentation for log page directory WDC plugin command
  * Provide WDC plugin command to dump log page directory
  * Tests: Hande string encoding and handling failures
  * Makefile: use UDEVRULESDIR instead of UDEVDIR
- Rename 'nvme-det-hostnqn' script to 'nvme-gen-hostnqn'</changelog>
  <changelog author="dmueller@suse.com" date="1597579200">- update to 1.12
  * Corrected text output in FW activation history
  * nvme: allow addr family to recognize loop
  * Add log page CA parsing
  * nvme status code updates based nvme spec v1.4
  * Provide documentation for log page directory WDC plugin command
  * Fix status displayed by vs-telemetry-controller-option wdc plugin
  * fabrics: ignore hostnqn file if its empty</changelog>
  <changelog author="daniel.wagner@suse.com" date="1603454400">- update to 1.13
  * support for zoned command set
  * Identify I/O Command Set data structure command added
  * Added new namespace list command on list-ns, 4056 modification added
  * Added temperature information getting and text formatting
  * Implemented additional statistics to display
  * nvme: add support for non shared namespaces</changelog>
  <changelog author="daniel.wagner@suse.com" date="1621339200">- Add KATO fixes for NVMEoF (bsc#1182591)
  * add 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
  * add 0002-print-device-name-when-creating-a-persistent-device.patch
- Lookup existing persistent controllers (bsc#1179825)
  * add 0003-nvme-discover-lookup-existing-persistent-controllers.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1624276800">- Do not print error message when opening controller (bsc#1186719)
  * add 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1628683200">- Fix failures during 'nvme list' (bsc#1186719)
  * add 0005-nvme-ioctl-return-1-on-failure-from-nvme_get_nsid.patch
  * add 0006-nvme-topology-scan-all-controllers-in-scan_subsystem.patch
- Permit integer as KATO argument (bsc#1182591)
  * add 0007-fabrics-permit-kato-int-argument-for-discovery-contr.patch
- Skip connect if transport type doesn't match (bsc#1187287 bsc#1187860)
  * add 0008-fabrics-skip-connect-if-transport-type-doesn-t-match.patch
- Ignore non live controllers when scanning subsystems (bsc#1186719 bsc#1187287)
  * add 0009-nvme-topology-fix-controller-check-in-scan_subsystem.patch
- Remove UUID validation heuristic (bsc#1187890)
  * add 0010-gen-hostnqn-Remove-UUID-validation-heuristic.patch
  * update 0102-nvme-cli-Add-script-to-determine-host-NQN.patch
- Do not segfault when controller is not available (bsc#1189046)
  * add 0011-nvme-print-fix-nvme-list-segfault-if-controller-is-u.patch
- Use correct default port for discovery (bsc#1189195 bsc#1187858)
  * add 0012-fabrics-add-default-port-number-for-NVMe-TCP-I-O-con.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1637236800">- Allow -1 as ctrl_loss_tmo value (bsc#1192348)
  * add 0013-nvme-cli-ctrl-loss-tmo-should-accept-1-as-value.patch
- Fix segfauls while discovering (bsc#1191935)
  * add 0014-Input-expects-device-name-without-dev.patch
  * add 0015-fabrics-fix-nvme-discover-segfault-if-sysfs-path-is-.patch
  * add 0016-fabrics-Only-free-initialized-valued-on-exit.patch
  * add 0017-nvme-print-add-discovery-async-event-config-field.patch
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
- Context udpate
  * refresh 0004-nvme-topology-no-error-message-when-openeing-of-cont.patch
- Adding missing hunk (bsc#1182591)
  * update 0001-fabrics-ensure-zero-kato-for-non-persistent-controllers.patch
- Use pkg-config for libuuid dependency setup
  * add 0103-build-use-pkg-config-for-libuuid-detection.patch</changelog>
  <changelog author="dwagner@suse.de" date="1643198400">- fabrics: fix 'nvme connect' segfault if transport type is omitted (bsc#1193540)
  * add 0018-fabrics-fix-nvme-connect-segfault-if-transport-type-.patch
  * add 0019-fabrics-update-discovery.conf-error-message.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649332800">- Don't print error on failed to open in nvme-topology.c (bsc#1198158)
  * add 0020-Don-t-print-error-on-failed-to-open-in-nvme-topology.patch</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- Allow selecting the network interface for connections (bsc#1199670)
  * add 0021-Add-host-iface-option.patch
- Support unique discovery subsystem NQN (bsc#1199865 bsc#1192761)
  * add 0022-fabrics-decode-current-discovery-subsystem.patch
  * add 0023-fabrics-support-unique-discovery-subsystem-NQN.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fix infinite loop on invalid parameters (bsc#1200644)
  * add 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)</changelog>
  <changelog author="dwagner@suse.de" date="1668427200">- Drop support for unique discovery subsystem NQN (bsc#1199865 bsc#1192761 bsc#1204827)
  * remove 0022-fabrics-decode-current-discovery-subsystem.patch
  * remove 0023-fabrics-support-unique-discovery-subsystem-NQN.patch
  * rename 0024-fabrics-fix-infinite-loop-on-invalid-parameters.patch to
    0022-fabrics-fix-infinite-loop-on-invalid-parameters.patch</changelog>
</package>
<package pkgid="b6a87b015bfa626216ed86de1420d64f20ea9ab46bb5ca04d0839abc92915e56" name="oniguruma" arch="src">
  <version epoch="0" ver="6.7.0" rel="150000.3.3.1"/>
  <changelog author="mrueckert@suse.de" date="1135684800">- Initial package of version 2.5.1</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="mrueckert@suse.de" date="1159531200">- update to version 2.5.7:
  many fixes.</changelog>
  <changelog author="gber@opensuse.org" date="1281787200">- update to version 5.9.2:
  + many fixes
- cleanup:
  + split into liborig2 and oniguruma-devel subpackages
  + corrected license information
  + changed summary to conform with policy</changelog>
  <changelog author="i@marguerite.su" date="1410004800">- update version 5.9.5
  * [impl] escape warnings for -Wall.
  * [impl] remove unused variable.
- changes in 5.9.4
  * [dist] add oniguruma.pc.in file
- changes in 5.9.3
  * fix print_tree ENCLOSE_OPTION bug</changelog>
  <changelog author="i@marguerite.su" date="1445428800">- update version 5.9.6
  * [impl] add onigenc_end_unicode().
  * [impl] add onig_add_end_call().</changelog>
  <changelog author="mrueckert@suse.de" date="1456833600">- remove ruby build requires. seems unused.</changelog>
  <changelog author="mrueckert@suse.de" date="1502107200">- Version 6.5.0
  - [new] support Absent clear (Absent functions)
  - abolish configure option: --enable-combination-explosion-check
  - [new] support Absent functions (?~...)
  - fix #65: SIZEOF_SIZE_T doesn't exist on certain architecutres
  - [new] support \O (true anychar)
  - [new] support \K (keep)
  - add new node type: NODE_GIMMICK
  - [new] support \N (no newline)
  - [new] support \R (general newline)
  - [new] support if-then-else syntax
  - [new] support backref validity checker
- Version 6.4.0
  - fix memory leaks
  - change encoding of doc/XXXX.ja from EUC-JP to UTF-8
  - update doc/RE, and doc/RE.ja
  - fix fatal bug of endless repeat check on Windows
  - PR #62 : add check for return values
  - [new] support call zero (\g{0})
  - [new] support relative call by positive number
  - [new] support relative back-reference by positive number
  - fix #60 : check value type
  - change output format for ONIG_DEBUG_COMPILE and
    ONIG_DEBUG_MATCH
- Version 6.3.0
  - fix #60 : invalid state(CCS_VALUE) in parse_char_class()
  - fix #59 : access to invalid address by reg-&gt;dmax value
  - fix invalid increment of start position in onig_scan()
  - fix #58 : access to invalid address by reg-&gt;dmin value
  - fix #57 : DATA_ENSURE() check must be before data access
  - fix #56 : return invalid result for codepoint 0xFFFFFFFF
  - [new] add \o{17777777777} syntax.
  - fix #55 : Byte value expressed in octal must be smaller than
    256
- Version 6.2.0
  - fix: size in xmemcpy in stack_double (PR #51)
  - Initialize return value
  - NEW API: add onig_set_capture_num_limit()
  - change MemNumType from short int to int
  - fix: [0-9-a] was not allowed as [0-9\-a]
  - fix: illegal capture after recursive call
  - fix: problem with optimization of \z
  - fix: .* optimization
  - Set a limit of parser recursion
  - fix; that warnings are not shown properly
  - fix: /[a-c#]+\W/ =~ "def#" fails when encoding is UTF-16/32
  - fix: /[\x{0}-X]/i doesn't match properly when UTF-16/32 is
    used.
- Version 6.1.3
  - fix: Syntax error: redirection unexpected (expecting word) #35
- Version 6.1.2
  - allow word bound, word begin and word end in look-behind.
  - add ONIG_OPTION_CHECK_VALIDITY_OF_STRING option.
  - fix use after free node.
  - fix memory leaks after parsing regexp error.
  - implement many of is_valid_mbc_string().
- Version 6.1.1
  - fix segfault /W.?{888}{888}{888}\x00/ (found by libfuzzer)
  - fix error unmatched close parenthesis for %{(.*?)} #23
- Version 6.1.0
  - add contributed/libfuzzer-onig.cpp  (thanks hannob)
  - update LTVERSION 4:0:0
  - NEW API: onigenc_is_valid_mbc_string().
  - add is_valid_mbc_string() member into OnigEncodingType.
  - fix out of bounds read.
  - disable USE_INVALID_CODE_SCHEME.
  - doc/RE improved.
  - add onig_scan() into doc/API.
  - fix bug: Out of bounds read in onig_strcpy() #17
  - fix bug: infinite loop of backreference and group.
  - fix out of bounds read in mbc_to_code() #16
  - doc/RE refinements.
  - add onig_scan() (NEW API)
  - reimplement match stack allocation for case too many repeat
  - and too many captures in regexp.
  - number of captures &lt;= 32767 for bytecode representation.
  - don't use int_map_backward for thread-safe.
  - fix case of enclosed option in look-behind.
  - fix ignore case in look-behind.
  - fix memory leak in onig_unicode_define_user_property()
  - declare variables at the top of scope.  (thanks nmaya)
- Version 6.0.0
  - add NEW API: onig_unicode_define_user_property()
  - update Unicode data to 8.0.0
  - change OnigCodePoint type to unsigned int.
  - add doc/UNICODE_PROPERTIES.
  - add error code ONIGERR_FAIL_TO_INITIALIZE.
  - add make_win64/32.bat.
  - fix bug of uninitialized regex_t value on error.
  - reimplement Unicode case folding.
  - update LTVERSION = 3.0.0
  - remove all THREAD_ macro.
  - add init member into OnigEncoding. (add onig_initialize())
  - remove state member of regex.
  - move source files into src/
  - rename configre.in to configure.ac.
  - fix memory leak. (thanks pigzang)
  - change mail address.</changelog>
  <changelog author="avindra@opensuse.org" date="1514030400">- Version 6.7.0
  - add ONIG_SYNTAX_ONIGURUMA (default syntax)
  - restructure StackType
  - implement subexp calls (?R), (?&amp;name), (?-n), (?+n) for Perl
    syntax
  - use string pool of gperf for Unicode Property lookup function
  - fix an empty greedy regex and a word boundary (.*\b) fails
  - remove a stack type STK_POS
  - add a declaration of onig_end()
  - fix compilation failure in out-of-source build
  - [new] hexadecimal codepoint \uHHHH
- Version 6.6.1
  - fix definition of \X to (?&gt;\O(?:\Y\O)*)
- Version 6.6.0
  - rename Absent clear to Range clear
  - [new] Extended Grapheme Cluster \X and boundary \y, \Y
  - fix: invalid index(ctype) value assigned to Unicode Block
    properties
  - --enable-crnl-as-line-terminator to be deprecated
  - [new] ASCII only mode options (?WDSP)
  - [new] ONIG_OPTION_XXXX_IS_ASCII  options
  - disable OP_CCLASS_NODE
  - [spec] Absent clear restore previous range value at backtrack
  - optimize for simple one char repetition in Absent expression
  - fix: invalid impl. for reluctant repetition in Absent expression
  - remove compile switch USE_NAMED_GROUP
  - Visual Studio 2005 compilation fixed
- cleanup with spec-cleaner</changelog>
  <changelog author="mrueckert@suse.de" date="1661515200">- Added d3e402928b6eb3327f8f7d59a9edfa622fec557b.patch: (boo#1157805 CVE-2019-19246)
  oniguruma: Heap-based buffer over-read in str_lower_case_match in regexec.c
- Added 6eb4aca6a7f2f60f473580576d86686ed6a6ebec.patch: (boo#1164569 CVE-2019-19204)
  oniguruma: heap-based buffer over-read in function fetch_interval_quantifier in regparse.c
- Added aa0188eaedc056dca8374ac03d0177429b495515.patch: (boo#1164550 CVE-2019-19203)
  oniguruma: heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c
- Added 4097828d7cc87589864fecf452f2cd46c5f37180.patch: (boo#1150130 CVE-2019-16163)
  oniguruma: stack Exhaustion in regcomp.c because of recursion in regparse.c.
- Added cbe9f8bd9cfc6c3c87a60fbae58fa1a85db59df0.patch: (boo#1177179 CVE-2020-26159)
  oniguruma: Buffer overflow in concat_opt_exact_str could result in DoS
- Added 0f7f61ed1b7b697e283e37bd2d731d0bd57adb55.patch: (boo#1142847 CVE-2019-13224)
  oniguruma: use-after-free in onig_new_deluxe() in regext.c</changelog>
</package>
<package pkgid="aed4c762c04b261ee4d5f2ab877d4a3226c9a000ec77a87f8c7358848e541ea6" name="open-iscsi" arch="aarch64">
  <version epoch="0" ver="2.1.7" rel="150300.32.21.1"/>
  <changelog author="lduncan@suse.com" date="1611662400">- Update to latest upstream (no new tag yet). To fix
  bsc#1181313. Changes since last update added to
  open-iscsi-SUSE-latest.diff.bz2:
  * Fix iscsiadm segfault when exiting
  * iscsid: Add NO_SYSTEMD to CFLAGS
  * Change mkdir permissions to 0770, adjust usmask
  * Fix typo in util.py
  * iscsid: Do not allow conflicting pid-file options
  * iscsiadm: Fix memory leak in iscsiadm
  * libopeniscsiusr: Fix memory leak in iscsi_sessions_get()
  * libopeniscsiusr: Fix memory leak in iscsi_nodes_get()
  * idbm: Fix memory leak and NULL pointer dereference in idbm_rec_update_param()
  * Add etc/systemd/iscsi-init.service to SYSTEMDFILES Makefile variable</changelog>
  <changelog author="lduncan@suse.com" date="1615464000">- Updated to latest upstream 2.1.4 as 2.1.4-suse, which contains
  these changes not already present:
  * Enable iscsi.service asynchronous logins, cleanup services
    (bsc#1183421)
  * libopeniscsiusr: dont error loudly if a session isn't found when
    working through iscsi_sessions_get()
  * libopeniscsiusr: skip over removed sessions
  * libopeniscsiusr: fix error messages
  * Avoid hardcoding pkg-config to fix cross build
  * Fix iscsistart login issue when target is delayed.</changelog>
  <changelog author="lduncan@suse.com" date="1619611200">- Merged with latest from upstream, which contains these fixes:
  * Add "no wait" option to iscsiadm firmware login
  * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart
  * Log proper error message when AUTH failure occurs</changelog>
  <changelog author="lduncan@suse.com" date="1619611201">- Local (SUSE) change: update iscsi.service so that it tries to
  logon to any "onboot" and firmware targets, in case a target
  was offline when booted but back up when the service is started.
  (bsc#1153806)</changelog>
  <changelog author="lduncan@suse.com" date="1620820800">- Merge latest upstream, which added fix (bsc#1185930):
  * Set default 'startup' to 'onboot' for FW nodes</changelog>
  <changelog author="lduncan@suse.com" date="1626868800">- Merge latest upstream, which includeds:
  * Support the "qede" CMA-card driver. (bsc#1188579)
  * iscsistart: fix null pointer deref before exit</changelog>
  <changelog author="lduncan@suse.com" date="1629460800">- Merged latest upstream, which includes:
  * iscsid: set PR_SET_IO_FLUSHER (bsc#1188869)</changelog>
  <changelog author="lduncan@suse.com" date="1631102400">- Updated to latest upstream 2.1.5 as 2.1.5-suse, which contains
  these changes not already present:
  * Handle IPv6 interfaces correctly. (bsc#1187958)
  * Handle qedi correctly in NPAR mode (bsc#1187958)
  * Update iscsiadm man page (bsc#1187958)
  * Update iface.example for ipv6
  * Change iscsi IP type from defines to enum.
  * Handle recv() returning 0 in iscsid_response()</changelog>
  <changelog author="lduncan@suse.com" date="1633003200">- Update to latest from upstream, fixing:
  * Moving the executables from /sbin to /usr/sbin (bsc#1191054)
  * Remove default dependencies from iscsi-init.service
  (bsc#1187190)</changelog>
  <changelog author="lduncan@suse.com" date="1633435200">- Fix possible systemd cycle by adding an "obsoletes" for
  the old libopeniscsiusr for older versions.</changelog>
  <changelog author="lduncan@suse.com" date="1635163200">- Fix the usr-merge changes (bsc#1192013). This includes catching
  all the places that /sbin was still used directly, as well as
  making the SPEC file build using /usr/sbin for openSUSE but
  still use /sbin for SLE, for now.</changelog>
  <changelog author="lduncan@suse.com" date="1636632000">- Merged latest upstream. Mostly cleanup, but includes a fix for
  iscsi-init.service when trying to write to the root volume too
  early (bsc#1192568), as well as an upstream fix for possible
  deadlock when dealing with sysfs.</changelog>
  <changelog author="lduncan@suse.com" date="1644840000">- Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains
  bug fixes and cleanups. See the Changelog for more details.</changelog>
  <changelog author="lduncan@suse.com" date="1646481600">- Update to latest upstream, including test cleanup, minor
  bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656).</changelog>
  <changelog author="lduncan@suse.com" date="1649246400">- Updated to latest upstream, including bug fixes and cleanups.
  Changes included:
  * add handling name/value pairs for firmware login (bsc#1196113),
    including man page update for same
  * Fix bug where some package parts were installed using
    DESTDIR twice
  * general build cleanup (in prep for removing DB files from
    /etc/iscsi some day soon)
  Also, now delivering a "package config" file for libopeniscsiusr.</changelog>
  <changelog author="lduncan@suse.com" date="1651838400">- Updated to latest upstream version, tagged 2.1.7. Changes
  included:
  * updated/fixed test script
  * updated build system
  * several bug fixes, including one for bsc#1199264</changelog>
  <changelog author="lduncan@suse.com" date="1652097600">- Update to latest upstream, including:
  * Added 'distclean' to Makefile targets
  * Ensure Makefile '.PHONY' targets set up correctly
  * fix an iscsid logout bug generating a false error
    and cleanup logout error messages</changelog>
  <changelog author="lduncan@suse.com" date="1652443200">- Set initiatorname in %post (at end of install), for cases
  where root is read-only at startup time (bsc#1198457)</changelog>
  <changelog author="lduncan@suse.com" date="1655467200">- For Tumbleweed, moved logrotate files from user-specific
  directory /etc/logrotate.d to vendor-specific
  /usr/etc/logrotate.d
  (for Stefan Schubert &lt;schubi@suse.com&gt;)</changelog>
  <changelog author="lduncan@suse.com" date="1657108800">- Modify SPEC file so systemd unit files are mode 644 (not 755)
  (bsc#1200570)</changelog>
</package>
<package pkgid="bcb8b3c653a7faba4e120b2e59b1cbabea4abd1692a4a71b2377c5bb79b2e342" name="open-iscsi" arch="src">
  <version epoch="0" ver="2.1.7" rel="150300.32.21.1"/>
  <changelog author="lduncan@suse.com" date="1611662400">- Update to latest upstream (no new tag yet). To fix
  bsc#1181313. Changes since last update added to
  open-iscsi-SUSE-latest.diff.bz2:
  * Fix iscsiadm segfault when exiting
  * iscsid: Add NO_SYSTEMD to CFLAGS
  * Change mkdir permissions to 0770, adjust usmask
  * Fix typo in util.py
  * iscsid: Do not allow conflicting pid-file options
  * iscsiadm: Fix memory leak in iscsiadm
  * libopeniscsiusr: Fix memory leak in iscsi_sessions_get()
  * libopeniscsiusr: Fix memory leak in iscsi_nodes_get()
  * idbm: Fix memory leak and NULL pointer dereference in idbm_rec_update_param()
  * Add etc/systemd/iscsi-init.service to SYSTEMDFILES Makefile variable</changelog>
  <changelog author="lduncan@suse.com" date="1615464000">- Updated to latest upstream 2.1.4 as 2.1.4-suse, which contains
  these changes not already present:
  * Enable iscsi.service asynchronous logins, cleanup services
    (bsc#1183421)
  * libopeniscsiusr: dont error loudly if a session isn't found when
    working through iscsi_sessions_get()
  * libopeniscsiusr: skip over removed sessions
  * libopeniscsiusr: fix error messages
  * Avoid hardcoding pkg-config to fix cross build
  * Fix iscsistart login issue when target is delayed.</changelog>
  <changelog author="lduncan@suse.com" date="1619611200">- Merged with latest from upstream, which contains these fixes:
  * Add "no wait" option to iscsiadm firmware login
  * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart
  * Log proper error message when AUTH failure occurs</changelog>
  <changelog author="lduncan@suse.com" date="1619611201">- Local (SUSE) change: update iscsi.service so that it tries to
  logon to any "onboot" and firmware targets, in case a target
  was offline when booted but back up when the service is started.
  (bsc#1153806)</changelog>
  <changelog author="lduncan@suse.com" date="1620820800">- Merge latest upstream, which added fix (bsc#1185930):
  * Set default 'startup' to 'onboot' for FW nodes</changelog>
  <changelog author="lduncan@suse.com" date="1626868800">- Merge latest upstream, which includeds:
  * Support the "qede" CMA-card driver. (bsc#1188579)
  * iscsistart: fix null pointer deref before exit</changelog>
  <changelog author="lduncan@suse.com" date="1629460800">- Merged latest upstream, which includes:
  * iscsid: set PR_SET_IO_FLUSHER (bsc#1188869)</changelog>
  <changelog author="lduncan@suse.com" date="1631102400">- Updated to latest upstream 2.1.5 as 2.1.5-suse, which contains
  these changes not already present:
  * Handle IPv6 interfaces correctly. (bsc#1187958)
  * Handle qedi correctly in NPAR mode (bsc#1187958)
  * Update iscsiadm man page (bsc#1187958)
  * Update iface.example for ipv6
  * Change iscsi IP type from defines to enum.
  * Handle recv() returning 0 in iscsid_response()</changelog>
  <changelog author="lduncan@suse.com" date="1633003200">- Update to latest from upstream, fixing:
  * Moving the executables from /sbin to /usr/sbin (bsc#1191054)
  * Remove default dependencies from iscsi-init.service
  (bsc#1187190)</changelog>
  <changelog author="lduncan@suse.com" date="1633435200">- Fix possible systemd cycle by adding an "obsoletes" for
  the old libopeniscsiusr for older versions.</changelog>
  <changelog author="lduncan@suse.com" date="1635163200">- Fix the usr-merge changes (bsc#1192013). This includes catching
  all the places that /sbin was still used directly, as well as
  making the SPEC file build using /usr/sbin for openSUSE but
  still use /sbin for SLE, for now.</changelog>
  <changelog author="lduncan@suse.com" date="1636632000">- Merged latest upstream. Mostly cleanup, but includes a fix for
  iscsi-init.service when trying to write to the root volume too
  early (bsc#1192568), as well as an upstream fix for possible
  deadlock when dealing with sysfs.</changelog>
  <changelog author="lduncan@suse.com" date="1644840000">- Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains
  bug fixes and cleanups. See the Changelog for more details.</changelog>
  <changelog author="lduncan@suse.com" date="1646481600">- Update to latest upstream, including test cleanup, minor
  bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656).</changelog>
  <changelog author="lduncan@suse.com" date="1649246400">- Updated to latest upstream, including bug fixes and cleanups.
  Changes included:
  * add handling name/value pairs for firmware login (bsc#1196113),
    including man page update for same
  * Fix bug where some package parts were installed using
    DESTDIR twice
  * general build cleanup (in prep for removing DB files from
    /etc/iscsi some day soon)
  Also, now delivering a "package config" file for libopeniscsiusr.</changelog>
  <changelog author="lduncan@suse.com" date="1651838400">- Updated to latest upstream version, tagged 2.1.7. Changes
  included:
  * updated/fixed test script
  * updated build system
  * several bug fixes, including one for bsc#1199264</changelog>
  <changelog author="lduncan@suse.com" date="1652097600">- Update to latest upstream, including:
  * Added 'distclean' to Makefile targets
  * Ensure Makefile '.PHONY' targets set up correctly
  * fix an iscsid logout bug generating a false error
    and cleanup logout error messages</changelog>
  <changelog author="lduncan@suse.com" date="1652443200">- Set initiatorname in %post (at end of install), for cases
  where root is read-only at startup time (bsc#1198457)</changelog>
  <changelog author="lduncan@suse.com" date="1655467200">- For Tumbleweed, moved logrotate files from user-specific
  directory /etc/logrotate.d to vendor-specific
  /usr/etc/logrotate.d
  (for Stefan Schubert &lt;schubi@suse.com&gt;)</changelog>
  <changelog author="lduncan@suse.com" date="1657108800">- Modify SPEC file so systemd unit files are mode 644 (not 755)
  (bsc#1200570)</changelog>
</package>
<package pkgid="80e850ed48842e62c9f32181c4413c45bd28f35f1e3393e702817f85a4a0447f" name="open-iscsi" arch="x86_64">
  <version epoch="0" ver="2.1.7" rel="150300.32.21.1"/>
  <changelog author="lduncan@suse.com" date="1611662400">- Update to latest upstream (no new tag yet). To fix
  bsc#1181313. Changes since last update added to
  open-iscsi-SUSE-latest.diff.bz2:
  * Fix iscsiadm segfault when exiting
  * iscsid: Add NO_SYSTEMD to CFLAGS
  * Change mkdir permissions to 0770, adjust usmask
  * Fix typo in util.py
  * iscsid: Do not allow conflicting pid-file options
  * iscsiadm: Fix memory leak in iscsiadm
  * libopeniscsiusr: Fix memory leak in iscsi_sessions_get()
  * libopeniscsiusr: Fix memory leak in iscsi_nodes_get()
  * idbm: Fix memory leak and NULL pointer dereference in idbm_rec_update_param()
  * Add etc/systemd/iscsi-init.service to SYSTEMDFILES Makefile variable</changelog>
  <changelog author="lduncan@suse.com" date="1615464000">- Updated to latest upstream 2.1.4 as 2.1.4-suse, which contains
  these changes not already present:
  * Enable iscsi.service asynchronous logins, cleanup services
    (bsc#1183421)
  * libopeniscsiusr: dont error loudly if a session isn't found when
    working through iscsi_sessions_get()
  * libopeniscsiusr: skip over removed sessions
  * libopeniscsiusr: fix error messages
  * Avoid hardcoding pkg-config to fix cross build
  * Fix iscsistart login issue when target is delayed.</changelog>
  <changelog author="lduncan@suse.com" date="1619611200">- Merged with latest from upstream, which contains these fixes:
  * Add "no wait" option to iscsiadm firmware login
  * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart
  * Log proper error message when AUTH failure occurs</changelog>
  <changelog author="lduncan@suse.com" date="1619611201">- Local (SUSE) change: update iscsi.service so that it tries to
  logon to any "onboot" and firmware targets, in case a target
  was offline when booted but back up when the service is started.
  (bsc#1153806)</changelog>
  <changelog author="lduncan@suse.com" date="1620820800">- Merge latest upstream, which added fix (bsc#1185930):
  * Set default 'startup' to 'onboot' for FW nodes</changelog>
  <changelog author="lduncan@suse.com" date="1626868800">- Merge latest upstream, which includeds:
  * Support the "qede" CMA-card driver. (bsc#1188579)
  * iscsistart: fix null pointer deref before exit</changelog>
  <changelog author="lduncan@suse.com" date="1629460800">- Merged latest upstream, which includes:
  * iscsid: set PR_SET_IO_FLUSHER (bsc#1188869)</changelog>
  <changelog author="lduncan@suse.com" date="1631102400">- Updated to latest upstream 2.1.5 as 2.1.5-suse, which contains
  these changes not already present:
  * Handle IPv6 interfaces correctly. (bsc#1187958)
  * Handle qedi correctly in NPAR mode (bsc#1187958)
  * Update iscsiadm man page (bsc#1187958)
  * Update iface.example for ipv6
  * Change iscsi IP type from defines to enum.
  * Handle recv() returning 0 in iscsid_response()</changelog>
  <changelog author="lduncan@suse.com" date="1633003200">- Update to latest from upstream, fixing:
  * Moving the executables from /sbin to /usr/sbin (bsc#1191054)
  * Remove default dependencies from iscsi-init.service
  (bsc#1187190)</changelog>
  <changelog author="lduncan@suse.com" date="1633435200">- Fix possible systemd cycle by adding an "obsoletes" for
  the old libopeniscsiusr for older versions.</changelog>
  <changelog author="lduncan@suse.com" date="1635163200">- Fix the usr-merge changes (bsc#1192013). This includes catching
  all the places that /sbin was still used directly, as well as
  making the SPEC file build using /usr/sbin for openSUSE but
  still use /sbin for SLE, for now.</changelog>
  <changelog author="lduncan@suse.com" date="1636632000">- Merged latest upstream. Mostly cleanup, but includes a fix for
  iscsi-init.service when trying to write to the root volume too
  early (bsc#1192568), as well as an upstream fix for possible
  deadlock when dealing with sysfs.</changelog>
  <changelog author="lduncan@suse.com" date="1644840000">- Updated to latest upstream 2.1.6 as 2.1.6-suse, which contains
  bug fixes and cleanups. See the Changelog for more details.</changelog>
  <changelog author="lduncan@suse.com" date="1646481600">- Update to latest upstream, including test cleanup, minor
  bug fixes (cosmetic), and fixing iscsi-init (bsc#1195656).</changelog>
  <changelog author="lduncan@suse.com" date="1649246400">- Updated to latest upstream, including bug fixes and cleanups.
  Changes included:
  * add handling name/value pairs for firmware login (bsc#1196113),
    including man page update for same
  * Fix bug where some package parts were installed using
    DESTDIR twice
  * general build cleanup (in prep for removing DB files from
    /etc/iscsi some day soon)
  Also, now delivering a "package config" file for libopeniscsiusr.</changelog>
  <changelog author="lduncan@suse.com" date="1651838400">- Updated to latest upstream version, tagged 2.1.7. Changes
  included:
  * updated/fixed test script
  * updated build system
  * several bug fixes, including one for bsc#1199264</changelog>
  <changelog author="lduncan@suse.com" date="1652097600">- Update to latest upstream, including:
  * Added 'distclean' to Makefile targets
  * Ensure Makefile '.PHONY' targets set up correctly
  * fix an iscsid logout bug generating a false error
    and cleanup logout error messages</changelog>
  <changelog author="lduncan@suse.com" date="1652443200">- Set initiatorname in %post (at end of install), for cases
  where root is read-only at startup time (bsc#1198457)</changelog>
  <changelog author="lduncan@suse.com" date="1655467200">- For Tumbleweed, moved logrotate files from user-specific
  directory /etc/logrotate.d to vendor-specific
  /usr/etc/logrotate.d
  (for Stefan Schubert &lt;schubi@suse.com&gt;)</changelog>
  <changelog author="lduncan@suse.com" date="1657108800">- Modify SPEC file so systemd unit files are mode 644 (not 755)
  (bsc#1200570)</changelog>
</package>
<package pkgid="b5e95d8466c0c1227d56bb0c4fd634686b9f43a9e096fe1abe84804b0a208143" name="open-vm-tools" arch="src">
  <version epoch="0" ver="12.1.0" rel="150300.19.1"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="50ac704e7331d93bc16e746203a0816ed3f387a602b735c3486399aefd28d941" name="open-vm-tools" arch="x86_64">
  <version epoch="0" ver="12.1.0" rel="150300.19.1"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="110763db3888ece58335ebd0c41983f945902c53292c2cce7165b9f13c2c0152" name="open-vm-tools" arch="src">
  <version epoch="0" ver="12.1.0" rel="150300.21.2"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="94d3e556439ba9803cc79feb2a96d1c263ca46871f457f099eef3f2cf9f48470" name="open-vm-tools" arch="x86_64">
  <version epoch="0" ver="12.1.0" rel="150300.21.2"/>
  <changelog author="kallan@suse.com" date="1583496000">- Update to 11.0.5 (build 15389592) (boo#1165955)
  + DNS server is reported incorrectly as '127.0.0.53' when using
    systemd-resolved. DNS server is reported incorrectly in GuestInfo as
    '127.0.0.53' , when the OS uses systemd-resolved. This issue is fixed
    in this release.
- Conditionalized the use of systemd_ordering.  Use systemd_ordering
  for factory, openSUSE &gt;= 15, and SLE &gt;= 15.  Use systemd_requires
  for older openSUSE and SLE releases.
- Conditionalize out the use of %license COPYING for SLE 12 SP2 and older.
- Added patches
  + gcc10-warning.patch (boo#1160408)
  + diskinfo-debug-logging-1162435.patch (boo#1162435 and bsc#1162119)
  - Changed g_warning to g_debug
  + app_info_plugin.patch (boo#1165955)
- Drop unnecessary patch:
  - fix-leaks-Aliases-MappedAliases.patch</changelog>
  <changelog author="kallan@suse.com" date="1583755200">- Simplified the conditional around systemd_ordering to just use
  suse_version &gt;= 1500.</changelog>
  <changelog author="kallan@suse.com" date="1589544000">- Update to 11.1.0 (build 16036546) (boo#1171764, boo#1171765)
  + open-vm-tools 11.1.0 includes a new 'Service Discovery' plugin, which
    connects with the vRealize Operations Manager product.  For more
    information and details on configuring this plugin, refer to Configuring
    Service Discovery.
  + In this release, a new tools.conf switch is added to enable and disable
    the guest customization in the guest virtual machine. By default, the
    guest customization is enabled. For more details, refer KB 78903.
- Spec file changes to remove the is_opensuse macros where possible.
- Remoed the mv vm-support line from the spec file.  vm-support is now
  automatically placed in the /usr/bin directory.
- Added version number to Requires: libxmlsec1-openssl1 to help with vgauth
  version checking.
- Added patches
  + pam-vmtoolsd.patch (boo#1171003)
- Drop unnecessary patch:
  - app_info_plugin.patch
  - diskinfo-debug-logging-1162435.patch
  - gcc9-static-inline.patch</changelog>
  <changelog author="kallan@suse.com" date="1590667200">- While updating to 11.1.0 (build 16036546) (boo#1171764) hold off on
  producing the open-vm-tools-sdmp (boo#1171765 Service Discover plugin)
  until it has gone through the ECO process.  Once approved, will resubmit
  to include the plugin.</changelog>
  <changelog author="kallan@suse.com" date="1591185600">- VMware has now asked that in updating to 11.1.0 (build 16036546) (boo#1171764)
  to hold off on producing the open-vm-tools-sdmp service discovery plugin
  (boo#1171765) for all SUSE versions due to the plugin's dependency on
  netstat.  Once they have removed the netstat dependency we will need to go
  through the ECO process to get the plugin added.</changelog>
  <changelog author="kallan@suse.com" date="1592395200">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
- Fixed bug (bsc#1172693) by removing the 'pam_securetty.so' line from
  pam-vmtoolsd.patch as instructed by vmware (boo#1171003).
  This should fix both (boo#1171003) and (bsc#1172693).</changelog>
  <changelog author="kallan@suse.com" date="1592481600">- jsc#ECO-2164 for update 11.1.0 (build 16036546) (boo#1171764)
  with new 'Service Discovery' plugin (boo#1171765).
- Reenabled building sdmp in the spec file.
- Added patches (boo#1171765)
  + sdmp-get-version.patch
  + sdmp-netstat-to-ss.patch
  + sdmp-warnings.patch</changelog>
  <changelog author="kallan@suse.com" date="1598616000">- Update to 11.1.5 (build 16724464) (boo#1175573)
  + This source release rolls up the SDMP fixes release post 11.1.0.
  + Fix serveral Coverity reported issues.
  + Address github issues:
    https://github.com/vmware/open-vm-tools/issues/451
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/issues/428
- Drop unnecessary patch:
  - gcc10-warning.patch
  - sdmp-get-version.patch
  - sdmp-netstat-to-ss.patch
  - sdmp-warnings.patch</changelog>
  <changelog author="schwab@suse.de" date="1599480000">- Use libtirpc also in SLE-15-SP3</changelog>
  <changelog author="kallan@suse.com" date="1603281600">- Update to 11.2.0 (build 16938113) (boo#1177987)
  + Fixed memory leak occurs in disk device mapping information for IDE,
    SATA or SAS (LSI Logic SAS) disks configured in the guest.
  + The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/429
    https://github.com/vmware/open-vm-tools/pull/431
    https://github.com/vmware/open-vm-tools/pull/432
    https://github.com/vmware/open-vm-tools/issues/452
  + A number of Coverity reported errors and false positives have been
    addressed.
  + A complete list of the granular changes that are in the open-vm-tools
    11.2.0 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.0/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch (boo#1177987): removed the pam_securetty.so line
  from the new suse file.  Modified the Makefile.am to copy the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="dimstar@opensuse.org" date="1604923200">- Add explicit pkgconfig(gdk-pixbuf-xlib-2.0) BuildRequires: used
  to be pulled in (as part of gdk-pixbuf) by GTK3 in the past. But
  as configure explicitly looks for it, it is our own duty to
  ensure its presence.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1606910400">- Enable build on aarch64</changelog>
  <changelog author="kallan@suse.com" date="1611230400">- Update to 11.2.5 (build 17337674) (boo#1180997)
  + Resolved issues:
  - The SUSE specific vmtoolsd PAM configuration file incorrectly referenced
    pam_securetty.so.
  - The following issues and pull requests reported on
    https://github.com/vmware/open-vm-tools have been addressed:
    https://github.com/vmware/open-vm-tools/issues/467
    https://github.com/vmware/open-vm-tools/issues/468
    https://github.com/vmware/open-vm-tools/pull/469
  - A number of Coverity reported errors and false positives have been
    addressed.
  - A complete list of the granular changes that are in the
    open-vm-tools 11.2.5 release is available at:
    https://github.com/vmware/open-vm-tools/blob/stable-11.2.5/open-vm-tools/ChangeLog
- Update pam-vmtoolsd.patch: With the pam_securetty.so entry fixed, only need
  the modified Makefile.am portion of the patch which copies the suse file to
  the /etc/pam.d/vmtoolsd file rather than the default generic file.</changelog>
  <changelog author="lnussel@suse.de" date="1615809600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
</package>
<package pkgid="739a9b30583a5dc12baca7e2a01cdd23ee5a5f87f7366ca02ec91900fc682108" name="openldap2" arch="src">
  <version epoch="0" ver="2.4.46" rel="150200.14.11.2"/>
  <changelog author="william.brown@suse.com" date="1579867200">- bsc#1158921 libldap-data should be requires, not recommends to help
  prevent user confusion around configuration ownership.</changelog>
  <changelog author="william.brown@suse.com" date="1588248000">- bsc#1170771 (CVE-2020-12243) - recursive filters may crash server
  * patch: 0205-bsc-1170771-limit-depth-of-nested-filters.patch</changelog>
  <changelog author="william.brown@suse.com" date="1591876800">- bsc#1172704 - Change DB_CONFIG to root:ldap permissions.
- bsc#1172698 (CVE-2020-8023) - local priv esc via start script
  chown -R on olcdbdirectory path. Remove chown -R on start to
  resolve.</changelog>
  <changelog author="william.brown@suse.com" date="1598011200">- bsc#1174154 - CVE-2020-15719 - This resolves an issue with x509
  SAN's falling back to CN validation in violation of rfc6125.
  * 0206-openldap-tlso-use-openssl-api-to-verify-host.patch</changelog>
  <changelog author="william.brown@suse.com" date="1598443200">- bsc#1175568 CVE-2020-8027
  openldap_update_modules_path.sh has a number of issues in it's
  design that lead to security issues. This file has been removed,
  from the package, and the %post execution of the install. The
  function is replaced by /usr/sbin/slapd-ldif-update-crc and
  /usr/lib/openldap/fixup-modulepath, through the addition of the
  source files:
  * fixup-modulepath.sh
  * slapd-ldif-update-crc.sh
  * update-crc.sh</changelog>
  <changelog author="william.brown@suse.com" date="1604923200">- bsc#1178387 (CVE-2020-25692) - unauthenticated remote denial of
  service due to incorrect validation of modrdn equality rules.
  * patch: 0207-ITS-9370-check-for-equality-rule-on-old_rdn.patch</changelog>
  <changelog author="william.brown@suse.com" date="1609761600">- bsc#1179503 - fix proxy retry binds to a remote server
  * patch: 0208-ITS-9400-back-ldap-fix-retry-binds.patch</changelog>
  <changelog author="william.brown@suse.com" date="1610452800">- bsc#1178909 CVE-2020-25709 CVE-2020-25710 - Resolves two issues
    where openldap would crash due to malformed inputs.
  * patch: 0209-ITS-9383-remove-assert-in-certificateListValidate.patch
  * patch: 0210-ITS-9384-remove-assert-in-obsolete-csnNormalize23.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613476800">- bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur
    in the issuerAndThisUpdateCheck function via a crafted packet,
    resulting in a denial of service (daemon exit) via a short timestamp.
    This is related to schema_init.c and checkTime.
  * patch: 0211-ITS-9454-fix-issuerAndThisUpdateCheck.patch</changelog>
  <changelog author="william.brown@suse.com" date="1613736000">- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the
  X.509 DN parsing in decode.c ber_next_element, resulting in denial
  of service.
  * 0220-ITS-9423-ldap_X509dn2bv-check-for-invalid-BER-after-.patch
- bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN
  parsing in ad_keystring, resulting in denial of service.
  * 0222-ITS-9425-add-more-checks-to-ldap_X509dn2bv.patch
- bsc#1182412 CVE-2020-36228 - integer underflow leading to crash
  in the Certificate List Exact Assertion processing, resulting in
  denial of service.
  * 0223-ITS-9427-fix-issuerAndThisUpdateCheck.patch
- bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the
  cancel_extop Cancel operation, resulting in denial of service.
  * 0224-ITS-9428-fix-cancel-exop.patch
- bsc#1182416 CVE-2020-36225 - double free and slapd crash in the
  saslAuthzTo processing, resulting in denial of service.
  * 0218-ITS-9412-fix-AVA_Sort-on-invalid-RDN.patch
- bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash
  in the saslAuthzTo processing, resulting in denial of service.
  * 0217-ITS-9409-saslauthz-use-slap_sl_free-in-prev-commit.patch
  * 0216-ITS-9409-saslauthz-use-ch_free-on-normalized-DN.patch
- bsc#1182415 CVE-2020-36226 - memch-&gt;bv_len miscalculation and slapd
  crash in the saslAuthzTo processing, resulting in denial of service.
  * 0219-ITS-9413-fix-slap_parse_user.patch
- bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the
  saslAuthzTo validation, resulting in denial of service.
  * 0213-ITS-9406-9407-remove-saslauthz-asserts.patch
  * 0214-ITS-9406-fix-debug-msg.patch
- bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact
  Assertion processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).
  * 0212-ITS-9404-fix-serialNumberAndIssuerCheck.patch
  * 0221-ITS-9424-fix-serialNumberAndIssuerSerialCheck.patch
- bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter
  control handling, resulting in denial of service (double free and
  out-of-bounds read).
  * 0215-ITS-9408-fix-vrfilter-double-free.patch</changelog>
  <changelog author="william.brown@suse.com" date="1615550400">- bsc#1182791 - improve proxy connection timout options to correctly
  prune connections.
  * 0225-ITS-8625-Separate-Avlnode-and-TAvlnode-types.patch
  * 0226-ITS-9197-back-ldap-added-task-that-prunes-expired-co.patch
  * 0227-ITS-9197-Increase-timeouts-in-test-case-due-to-spora.patch
  * 0228-ITS-9197-fix-typo-in-prev-commit.patch
  * 0229-ITS-9197-Fix-test-script.patch
  * 0230-ITS-9197-fix-info-msg-for-slapd-check.patch</changelog>
  <changelog author="william.brown@suse.com" date="1623844800">- bsc#1187210 - Resolve bug in the idle / connection TTL timeout
  implementation in OpenLDAP.
  * 0231-ITS-9468-Added-test-case-for-proxy-re-binding-anonym.patch
  * 0232-ITS-9468-back-ldap-Return-disconect-if-rebind-cannot.patch
  * 0233-ITS-9468-removed-accidental-unicode-characters.patch
  * 0234-ITS-9468-documented-that-re-connecting-does-not-happ.patch
  * 0235-ITS-9468-summarize-discussion-about-rebind-as-user.patch
  * 0236-ITS-9468-fixed-typos.patch
  * 0237-ITS-9468-always-init-lc_time-and-lc_create_time.patch
  * 0238-ITS-9468-do-not-arm-expire-timer-for-connections-tha.patch</changelog>
  <changelog author="william.brown@suse.com" date="1644321600">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1647259200">- Revert jsc#PM-3288 - CLDAP ( -DLDAP_CONNECTIONLESS ) due to regression
  reporting is bsc#1197004 causing SSSD to have faults.</changelog>
  <changelog author="william.brown@suse.com" date="1647604800">- jsc#PM-3288 - restore CLDAP functionality in CLI tools</changelog>
  <changelog author="william.brown@suse.com" date="1648036800">- bsc#1197004 - libldap was able to be out of step with openldap in
  some cases which could cause incorrect installations and symbol
  resolution failures. openldap2 and libldap now are locked to their
  related release versions.</changelog>
  <changelog author="william.brown@suse.com" date="1648036801">- bsc#1191157 - allow specification of max/min TLS version with TLS1.3
  * 0239-ITS-9422-Update-for-TLS-v1.3.patch
  * 0240-ITS-9518-add-LDAP_OPT_X_TLS_PROTOCOL_MAX-option.patch
  * 0241-TLS-set-protocol-version.patch</changelog>
  <changelog author="william.brown@suse.com" date="1649937600">- bsc#1191157 - Correct version specification in ppolicy to allow
  submission to SP3 for TLS1.3</changelog>
  <changelog author="william.brown@suse.com" date="1651838400">- bsc#1199240 - CVE-2022-29155 - Resolve sql injection in back-sql
  * 0242-ITS-9815-slapd-sql-escape-filter-values.patch</changelog>
  <changelog author="william.brown@suse.com" date="1655208000">- bsc#1198341 - Prevent memory reuse which may lead to instability
  * 0243-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch</changelog>
</package>
<package pkgid="05e6266b131cd2c65fdade71ee27a8f16cc7804c17e697e9236798728f3e9f06" name="opensc" arch="aarch64">
  <version epoch="0" ver="0.19.0" rel="150100.3.19.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="mcalabkova@suse.com" date="1539086400">- fixed multiple security problems (out of bound writes/reads):
    bsc#1104812
    CVE-2018-16391 (bsc#1106998)
    CVE-2018-16392 (bsc#1106999)
    CVE-2018-16393 (bsc#1108318)
    CVE-2018-16418 (bsc#1107039)
    CVE-2018-16419 (bsc#1107107)
    CVE-2018-16420 (bsc#1107097)
    CVE-2018-16421 (bsc#1107049)
    CVE-2018-16422 (bsc#1107038)
    CVE-2018-16423 (bsc#1107037)
    CVE-2018-16424 (bsc#1107036)
    CVE-2018-16425 (bsc#1107035)
    CVE-2018-16426 (bsc#1107034)
    CVE-2018-16427 (bsc#1107033)
- added patches:
    opensc-fixed-out-of-bounds-reads.patch
    opensc-fixed-out-of-bounds-writes.patch
    opensc-iasecc-fixed-unbound-recursion.patch
    opensc-added-bounds-checking.patch (fixes security issue caused
    by opensc-fixed-out-of-bounds-writes.patch)
    (see upstream commits for more informations)</changelog>
  <changelog author="kbabioch@suse.com" date="1551182400">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Drop patches:
    opensc-fixed-out-of-bounds-reads.patch
    opensc-fixed-out-of-bounds-writes.patch
    opensc-iasecc-fixed-unbound-recursion.patch
    opensc-added-bounds-checking.patch
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1615809600">- Fix buffer overflow in sc_oberthur_read_file
  * bsc#1177364
  * CVE-2020-26570
  * Added opensc-0_19_0-CVE-2020-26570.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616328000">- bsc#1177380 - VUL-0: CVE-2020-26571
  * gemsafe GPK smart card software driver stack-based buffer overflow
  * opensc-0_19_0-CVE-2020-26571.patch
- bsc#1158307 - VUL-1: CVE-2019-19480
  * improper free operation in sc_pkcs15_decode_prkdf_entry
  * opensc-0_19_0-CVE-2019-19480.patch
- bsc#1149747 ? VUL-1: CVE-2019-15946
  * out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry
  * opensc-0_19_0-CVE-2019-15946.patch
- bsc#1149746 ? VUL-1: CVE-2019-15945
  * out-of-bounds access of an ASN.1 Bitstring in decode_bit_string
  * opensc-0_19_0-CVE-2019-15945.patch
- bsc#1158256 ? VUL-1: CVE-2019-19479
  * incorrect read operation during parsing of a SETCOS file attribute
  * opensc-0_19_0-CVE-2019-19479.patch
- bsc#1170809 ? VUL-1: CVE-2019-20792
  * double free in coolkey_free_private_data
  * opensc-0_19_0-CVE-2019-20792.patch
- bsc#1177378 - VUL-0: CVE-2020-26572
  * Prevent out of bounds write
  * opensc-0_19_0-CVE-2020-26572.patch</changelog>
  <changelog author="jsikes@suse.com" date="1626696000">- bsc#1114649 - Opensc software package command error
  * opensc-bsc1114649_fix_pkcs11-tool_segfault.patch
  * Fixes segmentation fault in pkcs11-tool.c
  * Sourced from OpenSC git:
    git diff 728d099a536ab1923a217ae00408f72aa0b8ecee..31831c300be3d1fc6387ce221c069301ecb3c087</changelog>
  <changelog author="jsikes@suse.com" date="1634990400">- bsc#1191957 - Stack buffer overflow issues in various places
  * VUL-0: CVE-2021-42782
  * opensc-0_19_0-CVE-2021-42782.patch
  * Sourced from:
  [1] https://github.com/OpenSC/OpenSC/commit/78cdab94
  [2] https://github.com/OpenSC/OpenSC/commit/7114fb71
  [3] https://github.com/OpenSC/OpenSC/commit/1252aca9
  [4] https://github.com/OpenSC/OpenSC/commit/ae1cf0be
  [5] https://github.com/OpenSC/OpenSC/commit/456ac566</changelog>
  <changelog author="sbrabec@suse.com" date="1635249600">- tcos: Fix use after return (bsc#1192005, CVE-2021-42780,
  opensc-tcos-bound-check.patch).
- oberthur: Fix use after free (bsc#1191992, CVE-2021-42779,
  opensc-oberthur-return-values.patch).
- oberthur: Fix multiple heap buffer overflows (bsc#1192000,
  CVE-2021-42781, opensc-oberthur-overflow1.patch,
  opensc-oberthur-memory-init.patch,
  opensc-oberthur-overflow2.patch, opensc-oberthur-overflow3.patch,
  opensc-oberthur-invalid-length.patch).</changelog>
  <changelog author="jsikes@suse.com" date="1648209600">- bsc#1114649 - Opensc software package command error
  * replaced opensc-bsc1114649_fix_pkcs11-tool_segfault.patch
    because previous change didn't work.</changelog>
  <changelog author="jsikes@suse.com" date="1663761600">- Added patch opensc-CVE-2019-6502.patch
  * fixes memory leak in sc_context_create in ctx.c
  * bsc#1122756
  * CVE-2019-6502</changelog>
</package>
<package pkgid="1162a45ef23c8868b729d38f275390fd888a2059dc403875d59a083ea74a23d8" name="opensc" arch="src">
  <version epoch="0" ver="0.19.0" rel="150100.3.19.1"/>
  <changelog author="sbrabec@suse.cz" date="1294401600">- Updated to version 0.12.0:
  * Security fix (bnc#660109, CVE-2010-4523).
  * Only one backend is supported. openSUSE will use pcsc-lite.
  * libopensc made private, library should not be used by other
    applications. Please use generic PKCS#11 interface instead.
  * Signer plugin discontinued. Please use openssl engine_pkcs11.
  * No more depends on libassuan.
  * New card drivers.
  * Support for CardOS enhanced.
  * More changes and enhancements.
- libopensc merged back to the main package, as it is private now.</changelog>
  <changelog author="lmedinas@opensuse.org" date="1317297600">- Updated to version 0.12.2:
  * Builds are now silent by default when OpenSC is built from
    source on Unix.
  * Using --wait with command line tools works with 64bit Linux
    again.
  * Greatly improved OpenPGP card support, including OpenPGP
    2.0 cards like the one found in German Privacy Foundation
    CryptoStick.
  * Fixed support for FINeID cards issued after 01.03.2011 with
    2048bit keys.
  * #256: Fixed support for TCOS cards (broken since 0.12.0).
  * Added support for IDKey-cards to TCOS3 driver.
  * #361: Improved PC/SC driver to fetch the maximum PIN sizes
    from the open source CCID driver. This fixes the issue for
    Linux/OSX with recent driver.
  * Fix FINeID cards for organizations.
  * Several smaller bugs and compiler warnings fixed
- Updated to version 0.12.1:
  * IAS-ECC 1.0.1
  * Support for cards with multiple PKCS#15 applications
  * New card driver: IAS/ECC 1.0.1
  * rutoken-tool has been deprecated and removed.
  * eidenv and piv-tool utilities now have manual pages.
  * pkcs11-tool now requires the use of --module parameter.
  * All tools can now use an ATR as an argument to --reader,
    to skip to the card with given ATR.
  * opensc-tool -l with -v now shows information about the
    inserted cards.
  * Creating files have an enforced upper size limit, 64K
  * Support for multiple PKCS#15 applications with different
    AID-s. PKCS#15 applications can be listed with pkcs15-tool
  - -list-applications. Binding to a specific AID with PKCS#15
    tools can be done with --aid.
  * Hex strings (like card ATR or APDU-s) can now be separated
    by space, in addition to colons.
  * Pinpad readers known to be bogus are now ignored by OpenSC.
    At the moment only "HP USB Smart Card Keyboard" is disabled.
  * Numerous compiler warnings, unused code and internal bugs
    have been eliminated.</changelog>
  <changelog author="mgorse@suse.com" date="1339502400">- make needed directories before running make install</changelog>
  <changelog author="luizluca@tre-sc.gov.br" date="1386072000">- update to version 0.13.0</changelog>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="mcalabkova@suse.com" date="1539086400">- fixed multiple security problems (out of bound writes/reads):
    bsc#1104812
    CVE-2018-16391 (bsc#1106998)
    CVE-2018-16392 (bsc#1106999)
    CVE-2018-16393 (bsc#1108318)
    CVE-2018-16418 (bsc#1107039)
    CVE-2018-16419 (bsc#1107107)
    CVE-2018-16420 (bsc#1107097)
    CVE-2018-16421 (bsc#1107049)
    CVE-2018-16422 (bsc#1107038)
    CVE-2018-16423 (bsc#1107037)
    CVE-2018-16424 (bsc#1107036)
    CVE-2018-16425 (bsc#1107035)
    CVE-2018-16426 (bsc#1107034)
    CVE-2018-16427 (bsc#1107033)
- added patches:
    opensc-fixed-out-of-bounds-reads.patch
    opensc-fixed-out-of-bounds-writes.patch
    opensc-iasecc-fixed-unbound-recursion.patch
    opensc-added-bounds-checking.patch (fixes security issue caused
    by opensc-fixed-out-of-bounds-writes.patch)
    (see upstream commits for more informations)</changelog>
  <changelog author="kbabioch@suse.com" date="1551182400">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Drop patches:
    opensc-fixed-out-of-bounds-reads.patch
    opensc-fixed-out-of-bounds-writes.patch
    opensc-iasecc-fixed-unbound-recursion.patch
    opensc-added-bounds-checking.patch
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1615809600">- Fix buffer overflow in sc_oberthur_read_file
  * bsc#1177364
  * CVE-2020-26570
  * Added opensc-0_19_0-CVE-2020-26570.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616328000">- bsc#1177380 - VUL-0: CVE-2020-26571
  * gemsafe GPK smart card software driver stack-based buffer overflow
  * opensc-0_19_0-CVE-2020-26571.patch
- bsc#1158307 - VUL-1: CVE-2019-19480
  * improper free operation in sc_pkcs15_decode_prkdf_entry
  * opensc-0_19_0-CVE-2019-19480.patch
- bsc#1149747 ? VUL-1: CVE-2019-15946
  * out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry
  * opensc-0_19_0-CVE-2019-15946.patch
- bsc#1149746 ? VUL-1: CVE-2019-15945
  * out-of-bounds access of an ASN.1 Bitstring in decode_bit_string
  * opensc-0_19_0-CVE-2019-15945.patch
- bsc#1158256 ? VUL-1: CVE-2019-19479
  * incorrect read operation during parsing of a SETCOS file attribute
  * opensc-0_19_0-CVE-2019-19479.patch
- bsc#1170809 ? VUL-1: CVE-2019-20792
  * double free in coolkey_free_private_data
  * opensc-0_19_0-CVE-2019-20792.patch
- bsc#1177378 - VUL-0: CVE-2020-26572
  * Prevent out of bounds write
  * opensc-0_19_0-CVE-2020-26572.patch</changelog>
  <changelog author="jsikes@suse.com" date="1626696000">- bsc#1114649 - Opensc software package command error
  * opensc-bsc1114649_fix_pkcs11-tool_segfault.patch
  * Fixes segmentation fault in pkcs11-tool.c
  * Sourced from OpenSC git:
    git diff 728d099a536ab1923a217ae00408f72aa0b8ecee..31831c300be3d1fc6387ce221c069301ecb3c087</changelog>
  <changelog author="jsikes@suse.com" date="1634990400">- bsc#1191957 - Stack buffer overflow issues in various places
  * VUL-0: CVE-2021-42782
  * opensc-0_19_0-CVE-2021-42782.patch
  * Sourced from:
  [1] https://github.com/OpenSC/OpenSC/commit/78cdab94
  [2] https://github.com/OpenSC/OpenSC/commit/7114fb71
  [3] https://github.com/OpenSC/OpenSC/commit/1252aca9
  [4] https://github.com/OpenSC/OpenSC/commit/ae1cf0be
  [5] https://github.com/OpenSC/OpenSC/commit/456ac566</changelog>
  <changelog author="sbrabec@suse.com" date="1635249600">- tcos: Fix use after return (bsc#1192005, CVE-2021-42780,
  opensc-tcos-bound-check.patch).
- oberthur: Fix use after free (bsc#1191992, CVE-2021-42779,
  opensc-oberthur-return-values.patch).
- oberthur: Fix multiple heap buffer overflows (bsc#1192000,
  CVE-2021-42781, opensc-oberthur-overflow1.patch,
  opensc-oberthur-memory-init.patch,
  opensc-oberthur-overflow2.patch, opensc-oberthur-overflow3.patch,
  opensc-oberthur-invalid-length.patch).</changelog>
  <changelog author="jsikes@suse.com" date="1648209600">- bsc#1114649 - Opensc software package command error
  * replaced opensc-bsc1114649_fix_pkcs11-tool_segfault.patch
    because previous change didn't work.</changelog>
  <changelog author="jsikes@suse.com" date="1663761600">- Added patch opensc-CVE-2019-6502.patch
  * fixes memory leak in sc_context_create in ctx.c
  * bsc#1122756
  * CVE-2019-6502</changelog>
</package>
<package pkgid="f38618d0ad953ca357e67bb1807709fc53110185070953596489343212fc9f1f" name="opensc" arch="x86_64">
  <version epoch="0" ver="0.19.0" rel="150100.3.19.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="mcalabkova@suse.com" date="1539086400">- fixed multiple security problems (out of bound writes/reads):
    bsc#1104812
    CVE-2018-16391 (bsc#1106998)
    CVE-2018-16392 (bsc#1106999)
    CVE-2018-16393 (bsc#1108318)
    CVE-2018-16418 (bsc#1107039)
    CVE-2018-16419 (bsc#1107107)
    CVE-2018-16420 (bsc#1107097)
    CVE-2018-16421 (bsc#1107049)
    CVE-2018-16422 (bsc#1107038)
    CVE-2018-16423 (bsc#1107037)
    CVE-2018-16424 (bsc#1107036)
    CVE-2018-16425 (bsc#1107035)
    CVE-2018-16426 (bsc#1107034)
    CVE-2018-16427 (bsc#1107033)
- added patches:
    opensc-fixed-out-of-bounds-reads.patch
    opensc-fixed-out-of-bounds-writes.patch
    opensc-iasecc-fixed-unbound-recursion.patch
    opensc-added-bounds-checking.patch (fixes security issue caused
    by opensc-fixed-out-of-bounds-writes.patch)
    (see upstream commits for more informations)</changelog>
  <changelog author="kbabioch@suse.com" date="1551182400">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Drop patches:
    opensc-fixed-out-of-bounds-reads.patch
    opensc-fixed-out-of-bounds-writes.patch
    opensc-iasecc-fixed-unbound-recursion.patch
    opensc-added-bounds-checking.patch
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1615809600">- Fix buffer overflow in sc_oberthur_read_file
  * bsc#1177364
  * CVE-2020-26570
  * Added opensc-0_19_0-CVE-2020-26570.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616328000">- bsc#1177380 - VUL-0: CVE-2020-26571
  * gemsafe GPK smart card software driver stack-based buffer overflow
  * opensc-0_19_0-CVE-2020-26571.patch
- bsc#1158307 - VUL-1: CVE-2019-19480
  * improper free operation in sc_pkcs15_decode_prkdf_entry
  * opensc-0_19_0-CVE-2019-19480.patch
- bsc#1149747 ? VUL-1: CVE-2019-15946
  * out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry
  * opensc-0_19_0-CVE-2019-15946.patch
- bsc#1149746 ? VUL-1: CVE-2019-15945
  * out-of-bounds access of an ASN.1 Bitstring in decode_bit_string
  * opensc-0_19_0-CVE-2019-15945.patch
- bsc#1158256 ? VUL-1: CVE-2019-19479
  * incorrect read operation during parsing of a SETCOS file attribute
  * opensc-0_19_0-CVE-2019-19479.patch
- bsc#1170809 ? VUL-1: CVE-2019-20792
  * double free in coolkey_free_private_data
  * opensc-0_19_0-CVE-2019-20792.patch
- bsc#1177378 - VUL-0: CVE-2020-26572
  * Prevent out of bounds write
  * opensc-0_19_0-CVE-2020-26572.patch</changelog>
  <changelog author="jsikes@suse.com" date="1626696000">- bsc#1114649 - Opensc software package command error
  * opensc-bsc1114649_fix_pkcs11-tool_segfault.patch
  * Fixes segmentation fault in pkcs11-tool.c
  * Sourced from OpenSC git:
    git diff 728d099a536ab1923a217ae00408f72aa0b8ecee..31831c300be3d1fc6387ce221c069301ecb3c087</changelog>
  <changelog author="jsikes@suse.com" date="1634990400">- bsc#1191957 - Stack buffer overflow issues in various places
  * VUL-0: CVE-2021-42782
  * opensc-0_19_0-CVE-2021-42782.patch
  * Sourced from:
  [1] https://github.com/OpenSC/OpenSC/commit/78cdab94
  [2] https://github.com/OpenSC/OpenSC/commit/7114fb71
  [3] https://github.com/OpenSC/OpenSC/commit/1252aca9
  [4] https://github.com/OpenSC/OpenSC/commit/ae1cf0be
  [5] https://github.com/OpenSC/OpenSC/commit/456ac566</changelog>
  <changelog author="sbrabec@suse.com" date="1635249600">- tcos: Fix use after return (bsc#1192005, CVE-2021-42780,
  opensc-tcos-bound-check.patch).
- oberthur: Fix use after free (bsc#1191992, CVE-2021-42779,
  opensc-oberthur-return-values.patch).
- oberthur: Fix multiple heap buffer overflows (bsc#1192000,
  CVE-2021-42781, opensc-oberthur-overflow1.patch,
  opensc-oberthur-memory-init.patch,
  opensc-oberthur-overflow2.patch, opensc-oberthur-overflow3.patch,
  opensc-oberthur-invalid-length.patch).</changelog>
  <changelog author="jsikes@suse.com" date="1648209600">- bsc#1114649 - Opensc software package command error
  * replaced opensc-bsc1114649_fix_pkcs11-tool_segfault.patch
    because previous change didn't work.</changelog>
  <changelog author="jsikes@suse.com" date="1663761600">- Added patch opensc-CVE-2019-6502.patch
  * fixes memory leak in sc_context_create in ctx.c
  * bsc#1122756
  * CVE-2019-6502</changelog>
</package>
<package pkgid="814b601af471b134e3db5580a2521651fa070f6b2123e5d830596f5bbd30fd46" name="openssh" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="4c2faad7021c20cf72abcb60c0d958fd526a7f3b1db84d6d4347683ab64e57c7" name="openssh" arch="src">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="030554408a998dfec377cc9c645d1745bf3149acbbb8720e58391fd8504e5150" name="openssh" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="e652dc54df91d4de7c501934b0b7e983a157ff8c3f95d13ce27e565c356c507e" name="openssh" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="dff8fd3a65cda217d36711c727f3dc9a34a85c76ff1dfba10a2b95c5fad6af59" name="openssh" arch="src">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="42478d10f44f7d8776c476d3edcc540411082ac12921c5ffbba481593673302a" name="openssh" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="c2a2b8bdbcfa734122f6d52602963f9dc6ca0b46ba13d755d5dd1c4526f46c39" name="openssh-clients" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="8edba677a7a0f130dc0e5b04e63d1d125db72f72b363157da717b68bd0a92020" name="openssh-clients" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="ac8f396e6b978d5f69f8536c8d518853b5aeb65c0e87827de192e2605429adaa" name="openssh-clients" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="f575d45bc89451e65147c5559f46da334c2faf8135c5ab9c5aec1b7a111212b1" name="openssh-clients" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="cdf4a9e2e31da14b650151606b88a6b4bfdab63c735d08a169876b8a6a4b3ee5" name="openssh-common" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="3d30e4f3ec5789a77a0712df3e8f06e51f1bc8414001f578111e30351cd0baed" name="openssh-common" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="641f11bea3552ea7ba71a37f1086c85bc17d9255dc68dcc9cdfa642c0004e2e4" name="openssh-common" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="867321a6f70affee94a99e4450748f3acb53f780216c17ce25697ba8f00432ea" name="openssh-common" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="29eb8e6277343a77c1d3e8bd5e9a773c1a02e5621a7f618606269c2b41c49a8a" name="openssh-fips" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="417ca3c05a50a01ff7c2ba95ddf442a58b47c757b81f65995b40a6b12438bbab" name="openssh-fips" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="4499d476cea1ec3040d6c2170ab432e3f0ca0bcbbfbe4364810f737ccf4b33b4" name="openssh-fips" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="a3b69a1f72b38cba682d26e75c9d0876df33cf8943d644d026da6761e1798496" name="openssh-fips" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="eefe2d8cb112f57eb03ccea086413eb68c9b7b901583099fbcb10fb7de6236e5" name="openssh-server" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="c18b7a355dfa2cf32c567a2c53e05eaa665ef986d1d030fe7f5f506eb7016313" name="openssh-server" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.12.2"/>
  <changelog author="hpj@suse.com" date="1599739200">- Split openssh package into openssh, openssh-common,
  openssh-server and openssh-clients. This allows for the ssh
  clients to be installed without the server component
  (bsc#1176434).</changelog>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
</package>
<package pkgid="32746bca9e6e8359924bafcae2ff9fdd4f0773674ae7ad3174ac8c4f140f7c94" name="openssh-server" arch="aarch64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="140cc919055b9f9aae8e349d2651ca0b24a8032fd53fd5e3724712b227df46ce" name="openssh-server" arch="x86_64">
  <version epoch="0" ver="8.4p1" rel="150300.3.15.4"/>
  <changelog author="jengelh@inai.de" date="1600344000">- Move some Requires to the right subpackage.
- Avoid "&gt;&amp;" bashism in %post.
- Upgrade some old specfile constructs/macros and drop unnecessary
  %{?systemd_*}.
- Trim descriptions and straighten out the grammar.</changelog>
  <changelog author="fbui@suse.com" date="1601035200">- Use of DISABLE_RESTART_ON_UPDATE is deprecated.
  Replace it with %service_del_postun_without_restart</changelog>
  <changelog author="dimstar@opensuse.org" date="1601035201">- Fix fillup-template usage:
  + %post server needs to reference ssh (not sshd), which matches
    the sysconfig.ssh file name the package ships.
  + %post client does not need any fillup_ calls, as there is no
    client-relevant sysconfig file present. The naming of the
    sysconfig file (ssh instead of sshd) is unfortunate.</changelog>
  <changelog author="hpj@suse.com" date="1602158400">- Work around %service_add_post disabling sshd on upgrade with
  package name change (bsc#1177039).</changelog>
  <changelog author="hpj@suse.com" date="1605096000">- Add openssh-8.1p1-ed25519-use-openssl-rng.patch (bsc#1173799).
  This uses OpenSSL's RAND_bytes() directly instead of the internal
  ChaCha20-based implementation to obtain random bytes for Ed25519
  curve computations. This is required for FIPS compliance.</changelog>
  <changelog author="hpj@suse.com" date="1605096001">- Add openssh-fips-ensure-approved-moduli.patch (bsc#1177939).
  This ensures only approved DH parameters are used in FIPS mode.</changelog>
  <changelog author="hpj@suse.com" date="1605096002">- Fix build breakage caused by missing security key objects:
  + Modify openssh-7.7p1-cavstest-ctr.patch.
  + Modify openssh-7.7p1-cavstest-kdf.patch.
  + Add openssh-link-with-sk.patch.</changelog>
  <changelog author="kukuk@suse.com" date="1606478400">- Support /usr/etc/pam.d</changelog>
  <changelog author="hpj@suse.com" date="1610107200">- Update openssh-8.1p1-audit.patch (bsc#1180501). This fixes
  occasional crashes on connection termination caused by accessing
  freed memory.</changelog>
  <changelog author="dmueller@suse.com" date="1610971200">- update to 8.4p1:
  Security
  ========
  * ssh-agent(1): restrict ssh-agent from signing web challenges for
  FIDO/U2F keys.
  * ssh-keygen(1): Enable FIDO 2.1 credProtect extension when generating
  a FIDO resident key.
  * ssh(1), ssh-keygen(1): support for FIDO keys that require a PIN for
  each use. These keys may be generated using ssh-keygen using a new
  "verify-required" option. When a PIN-required key is used, the user
  will be prompted for a PIN to complete the signature operation.
  New Features
  - -----------
  * sshd(8): authorized_keys now supports a new "verify-required"
  option to require FIDO signatures assert that the token verified
  that the user was present before making the signature. The FIDO
  protocol supports multiple methods for user-verification, but
  currently OpenSSH only supports PIN verification.
  * sshd(8), ssh-keygen(1): add support for verifying FIDO webauthn
  signatures. Webauthn is a standard for using FIDO keys in web
  browsers. These signatures are a slightly different format to plain
  FIDO signatures and thus require explicit support.
  * ssh(1): allow some keywords to expand shell-style ${ENV}
  environment variables. The supported keywords are CertificateFile,
  ControlPath, IdentityAgent and IdentityFile, plus LocalForward and
  RemoteForward when used for Unix domain socket paths. bz#3140
  * ssh(1), ssh-agent(1): allow some additional control over the use of
  ssh-askpass via a new $SSH_ASKPASS_REQUIRE environment variable,
  including forcibly enabling and disabling its use. bz#69
  * ssh(1): allow ssh_config(5)'s AddKeysToAgent keyword accept a time
  limit for keys in addition to its current flag options. Time-
  limited keys will automatically be removed from ssh-agent after
  their expiry time has passed.
  * scp(1), sftp(1): allow the -A flag to explicitly enable agent
  forwarding in scp and sftp. The default remains to not forward an
  agent, even when ssh_config enables it.
  * ssh(1): add a '%k' TOKEN that expands to the effective HostKey of
  the destination. This allows, e.g., keeping host keys in individual
  files using "UserKnownHostsFile ~/.ssh/known_hosts.d/%k". bz#1654
  * ssh(1): add %-TOKEN, environment variable and tilde expansion to
  the UserKnownHostsFile directive, allowing the path to be
  completed by the configuration (e.g. bz#1654)
  * ssh-keygen(1): allow "ssh-add -d -" to read keys to be deleted
  from stdin. bz#3180
  * sshd(8): improve logging for MaxStartups connection throttling.
  sshd will now log when it starts and stops throttling and periodically
  while in this state. bz#3055
  Bugfixes
  - -------
  * ssh(1), ssh-keygen(1): better support for multiple attached FIDO
  tokens. In cases where OpenSSH cannot unambiguously determine which
  token to direct a request to, the user is now required to select a
  token by touching it. In cases of operations that require a PIN to
  be verified, this avoids sending the wrong PIN to the wrong token
  and incrementing the token's PIN failure counter (tokens
  effectively erase their keys after too many PIN failures).
  * sshd(8): fix Include before Match in sshd_config; bz#3122
  * ssh(1): close stdin/out/error when forking after authentication
  completes ("ssh -f ...") bz#3137
  * ssh(1), sshd(8): limit the amount of channel input data buffered,
  avoiding peers that advertise large windows but are slow to read
  from causing high memory consumption.
  * ssh-agent(1): handle multiple requests sent in a single write() to
  the agent.
  * sshd(8): allow sshd_config longer than 256k
  * sshd(8): avoid spurious "Unable to load host key" message when sshd
  load a private key but no public counterpart
  * ssh(1): prefer the default hostkey algorithm list whenever we have
  a hostkey that matches its best-preference algorithm.
  * sshd(1): when ordering the hostkey algorithms to request from a
  server, prefer certificate types if the known_hosts files contain a key
  marked as a @cert-authority; bz#3157
  * ssh(1): perform host key fingerprint comparisons for the "Are you
  sure you want to continue connecting (yes/no/[fingerprint])?"
  prompt with case sensitivity.
  * sshd(8): ensure that address/masklen mismatches in sshd_config
  yield fatal errors at daemon start time rather than later when
  they are evaluated.
  * ssh-keygen(1): ensure that certificate extensions are lexically
  sorted. Previously if the user specified a custom extension then
  the everything would be in order except the custom ones. bz#3198
  * ssh(1): also compare username when checking for JumpHost loops.
  bz#3057
  * ssh-keygen(1): preserve group/world read permission on known_hosts
  files across runs of "ssh-keygen -Rf /path". The old behaviour was
  to remove all rights for group/other. bz#3146
  * ssh-keygen(1): Mention the [-a rounds] flag in the ssh-keygen
  manual page and usage().
  * sshd(8): explicitly construct path to ~/.ssh/rc rather than
  relying on it being relative to the current directory, so that it
  can still be found if the shell startup changes its directory.
  bz#3185
  * sshd(8): when redirecting sshd's log output to a file, undo this
  redirection after the session child process is forked(). Fixes
  missing log messages when using this feature under some
  circumstances.
  * sshd(8): start ClientAliveInterval bookkeeping before first pass
  through select() loop; fixed theoretical case where busy sshd may
  ignore timeouts from client.
  * ssh(1): only reset the ServerAliveInterval check when we receive
  traffic from the server and ignore traffic from a port forwarding
  client, preventing a client from keeping a connection alive when
  it should be terminated. bz#2265
  * ssh-keygen(1): avoid spurious error message when ssh-keygen
  creates files outside ~/.ssh
  * sftp-client(1): fix off-by-one error that caused sftp downloads to
  make one more concurrent request that desired. This prevented using
  sftp(1) in unpipelined request/response mode, which is useful when
  debugging. bz#3054
  * ssh(1), sshd(8): handle EINTR in waitfd() and timeout_connect()
  helpers. bz#3071
  * ssh(1), ssh-keygen(1): defer creation of ~/.ssh until we attempt to
  write to it so we don't leave an empty .ssh directory when it's not
  needed. bz#3156
  * ssh(1), sshd(8): fix multiplier when parsing time specifications
  when handling seconds after other units. bz#3171</changelog>
  <changelog author="kukuk@suse.com" date="1610971201">- sysusers-sshd.conf: use sysusers.d configuration file to create
  sshd user (avoid hard dependency on shadow).</changelog>
  <changelog author="hpj@suse.com" date="1611316800">- Make sure sshd is enabled correctly when upgrading from a
  pre-systemd distribution (bsc#1180083).</changelog>
  <changelog author="hpj@suse.com" date="1611316801">- Add openssh-reenable-dh-group14-sha1-default.patch, which adds
  diffie-hellman-group14-sha1 key exchange back to the default
  list (bsc#1180958). This is needed for backwards compatibility
  with older platforms.</changelog>
  <changelog author="hpj@suse.com" date="1611316802">- Improve robustness of sshd init detection when upgrading from
  a pre-systemd distribution.</changelog>
  <changelog author="hpj@suse.com" date="1611403200">- Add openssh-fix-ssh-copy-id.patch, which fixes breakage
  introduced in 8.4p1 (bsc#1181311).</changelog>
  <changelog author="hpj@suse.com" date="1621425600">- Add openssh-7.6p1-audit_race_condition.patch, fixing sshd
  termination of multichannel sessions with non-root users
  (error on 'mm_request_receive_expect') (bsc#1115550,
  bsc#1174162).</changelog>
  <changelog author="hpj@suse.com" date="1637928000">- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.</changelog>
  <changelog author="hpj@suse.com" date="1639137600">- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.</changelog>
  <changelog author="vliaskovitis@suse.com" date="1650628800">- Add openssh-do-not-send-empty-message.patch: Prevent empty
  messages from being sent. This avoids a superfluous new line
  (bsc#1192439).</changelog>
  <changelog author="vliaskovitis@suse.com" date="1655899200">- Add openssh-dbus.sh, openssh-dbus.csh, openssh-dbus.fish: Make ssh
  connections update their dbus environment (bsc#1179465).</changelog>
</package>
<package pkgid="29eca6ae263f8e5060be86cf398d0ffc814f620b3b6ede7d63b15badf67756d3" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="e89a1da40fc819436132b80b1fcfbc5663c97318cf7e3b55fbbaaff15aa060d3" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="b87d7dd07eec18650acadff4310091058fd3a7f2399d446b1a0db17f4242d250" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.48.1"/>
  <changelog author="pmonreal@suse.com" date="1598529600">- Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
  * openssl-DH.patch
  * openssl-kdf-selftest.patch
  * openssl-kdf-tls-selftest.patch
  * openssl-kdf-ssh-selftest.patch</changelog>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
</package>
<package pkgid="c4c4ec3028d1d4d7a8668cfe7fe2702f826b6207d2313518f8ae77ebc528e684" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="1b2509089fb3c38f8fb67ffd1fd6aff52c4f94c75b97828b33ce585281c53bd5" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="cf7450bf869f993d3e217aa23d235e7879798a6f16121ef7c5c85eba38193681" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.51.1"/>
  <changelog author="vcizek@suse.com" date="1599566400">- Add shared secret KAT to FIPS DH selftest [bsc#1175844]
  * add openssl-fips-DH_selftest_shared_secret_KAT.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1602158400">- Restore private key check in EC_KEY_check_key [bsc#1177479]
  * Update openssl-DH.patch</changelog>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
</package>
<package pkgid="426576c361994a2c75a85cea58b89d742740a7dc9ff15c7668d4a2192b7c5574" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="c9f1db3312e705899dc5bc1b1b987b35276bd6d672124da44067332a2124ba23" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="60eb2527be1d285a870fbdf0c13c029f120d16b32fbdabe83451a65aa636c30a" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.54.1"/>
  <changelog author="vcizek@suse.com" date="1607428800">- Fix EDIPARTYNAME NULL pointer dereference
  (CVE-2020-1971, bsc#1179491)
  * add openssl-CVE-2020-1971.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614686400">- Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
</package>
<package pkgid="97501acc8ed09dcadecd291fe4b2dd79166ee06c57e392d9502cbd8fbdb962ae" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="a56026911407732e552a4ed5484f2693cca5ac1832a8d2f2a49634f1454c6d3c" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="244bb96c0995bd6cde4b097ce356294fb65b1ed2237b80387f5ff813835a2e6f" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1d" rel="150200.11.57.1"/>
  <changelog author="pmonreal@suse.com" date="1614772800">- Security fixes:
  * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
    protection [bsc#1182333, CVE-2021-23840]
  * Null pointer deref in X509_issuer_and_serial_hash()
    [bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch</changelog>
  <changelog author="jsikes@suse.com" date="1616500800">- Fix NULL pointer deref in signature_algorithms
  * CVE-2021-3449
  * bsc#1183852
  * Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch</changelog>
  <changelog author="jsikes@suse.com" date="1617796800">- Don't list disapproved cipher algorithms while in FIPS mode
  * openssl-1.1.1-fips_list_ciphers.patch
  * bsc#1161276</changelog>
  <changelog author="jsikes@suse.com" date="1620734400">- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch</changelog>
  <changelog author="jsikes@suse.com" date="1629288000">- A bug in the implementation of the SM2 decryption code means that the
  calculation of the buffer size required to hold the plaintext returned by the
  first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
  the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
  called by the application a second time with a buffer that is too small.
  * CVE-2021-3711
  * bsc#1189520
  * Add:
    CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
    CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
    CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
  when printing certificate details. A malicious actor could construct a
  certificate to deliberately hit this bug, which may result in a crash of the
  application (causing a Denial of Service attack).
  * CVE-2021-3712
  * bsc#1189521
  * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch</changelog>
  <changelog author="jsikes@suse.com" date="1630238400">- Other OpenSSL functions that print ASN.1 data have been found to assume that
  the ASN1_STRING byte array will be NUL terminated, even though this is not
  guaranteed for strings that have been directly constructed. Where an application
  requests an ASN.1 structure to be printed, and where that ASN.1 structure
  contains ASN1_STRINGs that have been directly constructed by the application
  without NUL terminating the "data" field, then a read buffer overrun can occur.
  * CVE-2021-3712 continued
  * bsc#1189521
  * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
  * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
    2021-08-24 00:47 PDT by Marcus Meissner</changelog>
  <changelog author="danilo.spinella@suse.com" date="1640952000">- Add RSA_get0_pss_params() accessor that is used by nodejs16
  and provide openssl-has-RSA_get0_pss_params, fixes bsc#1192489.
  * Add patch rsa-pss.patch, provided by Adam Majer, amajer@suse.com</changelog>
  <changelog author="pmonreal@suse.com" date="1643889600">- Enable zlib compression support [bsc#1195149]
  * Add openssl-fix-BIO_f_zlib.patch to fix BIO_f_zlib: Properly
    handle BIO_CTRL_PENDING and BIO_CTRL_WPENDING calls.</changelog>
  <changelog author="pmonreal@suse.com" date="1643976000">- FIPS: Fix function and reason error codes [bsc#1182959]
  * Add openssl-1_1-FIPS-fix-error-reason-codes.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1644580800">- Pull libopenssl-1_1 when updating openssl-1_1 with the same
  version. [bsc#1195792]</changelog>
  <changelog author="pmonreal@suse.com" date="1644926400">- Fix PAC pointer authentication in ARM [bsc#1195856]
  * PAC pointer authentication signs the return address against the
    value of the stack pointer, to prevent stack overrun exploits
    from corrupting the control flow. The Poly1305 armv8 code got
    this wrong, resulting in crashes on PAC capable hardware.
  * Add openssl-1_1-ARM-PAC.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1646827200">- Security Fix: [bsc#1196877, CVE-2022-0778]
  * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  * Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch</changelog>
  <changelog author="jsikes@suse.com" date="1653912000">- Security fix: [bsc#1199166, CVE-2022-1292]
  * Added: openssl-CVE-2022-1292.patch
  * properly sanitise shell metacharacters in c_rehash script.</changelog>
  <changelog author="jsikes@suse.com" date="1654171200">- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits</changelog>
  <changelog author="jsikes@suse.com" date="1655467200">- Added	openssl-1_1-Fix-file-operations-in-c_rehash.patch
  * bsc#1200550
  * CVE-2022-2068
  * Fixed more shell code injection issues in c_rehash</changelog>
  <changelog author="jsikes@suse.com" date="1656849600">- Encrypt the sixteen bytes that were unencrypted in some circumstances
  on 32-bit x86 platforms.
  * [bsc#1201099, CVE-2022-2097]
  * added openssl-CVE-2022-2097.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1662465600">- Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
  * Add patch openssl-1.1.1-fips-fix-memory-leaks.patch</changelog>
  <changelog author="jsikes@suse.com" date="1664020800">- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.</changelog>
  <changelog author="otto.hollmann@suse.com" date="1664539200">- FIPS: list only FIPS approved public key algorithms
  [bsc#1121365, bsc#1198472]
  * Add openssl-1_1-fips-list-only-approved-pubkey-algorithms.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675166400">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch
- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch
- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch
- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
</package>
<package pkgid="0dd8b14391a18abcc049bc16de04e0e83e7b685209c282c32ba7d94b3930cc39" name="osinfo-db" arch="noarch">
  <version epoch="0" ver="20220727" rel="150300.3.8.1"/>
  <changelog author="carnold@suse.com" date="1614686400">- Update to database version 20210215
  osinfo-db-20210215.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1617969600">- Update to database version 20210312
  osinfo-db-20210312.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1618228800">- Add support for SUSE Linux Enterprise Micro. See also patch
  in virt-manager to enable media detection.
  add-slem-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1623412800">- Update to database version 20210531
  osinfo-db-20210531.tar.xz
- Drop add-leap15.3-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1624276800">- Update to database version 20210621
  osinfo-db-20210621.tar.xz
- Drop patches contained in new tarball
  SLE-add-info-about-UEFI-support.patch
  add-sle15sp3-support.patch
  add-slem50-support.patch
  fix-sle15sp1-volume-id-string.patch</changelog>
  <changelog author="carnold@suse.com" date="1626696000">- bsc#1188336 - openSUSE Tumbleweed unattended installation in
  libvirt fails due to invalid autoyast.xml
  Drop fix-autoyast-validation.patch</changelog>
  <changelog author="carnold@suse.com" date="1627300800">- Add support for openSUSE Leap 15.4, SLE15-SP4, and SLEM 5.1
  (bsc#1188692)
  add-opensuse-leap-15.4-support.patch
  add-sle15sp4-support.patch
  add-slem5.1-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1627387200">- bsc#1182144 - osinfo-db: autoinst.xml does not work with
  Tumbleweed. Fixes nested language problem.
  opensuse-autoyast-desktop.patch</changelog>
  <changelog author="carnold@suse.com" date="1630497600">- Update to database version 20210809
  osinfo-db-20210809.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1630670400">- Update to database version 20210903
  osinfo-db-20210903.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1634731200">- Update to database version 20211013
  osinfo-db-20211013.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1637668800">- jsc#SLE-17764 - Dev: Support Oracle Linux as a guest VM. See also
  bsc#1192238 [Build58.2][KVM] The latest supported OracleLinux as
  guest versions are not included anywhere
  add-missing-oracle-linux-versions.patch</changelog>
  <changelog author="carnold@suse.com" date="1641384000">- Update to database version 20211216
  osinfo-db-20211216.tar.xz
- Drop add-missing-oracle-linux-versions.patch</changelog>
  <changelog author="carnold@suse.com" date="1646136000">- Update to database version 20220214
  osinfo-db-20220214.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1646913600">- bsc#1196965 - openSUSE Tumbleweed unattended installation with
  libvirt fails
  opensuse-autoyast-desktop.patch</changelog>
  <changelog author="carnold@suse.com" date="1649160000">- bsc#1197958 - request support for SLE15-SP4 in the osinfo database
- Add support for SUSE linux Enterprise Micro 5.2
  add-slem5.2-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1653307200">- Update to database version 20220516
  osinfo-db-20220516.tar.xz</changelog>
  <changelog author="dmueller@suse.com" date="1659355200">- update to 20220727
- drop: add-opensuse-leap-15.4-support.patch
  add-sle15sp4-support.patch
  add-slem5.1-support.patch
  add-slem5.2-support.patch
  opensuse-autoyast-desktop.patch: all upstream</changelog>
  <changelog author="carnold@suse.com" date="1661428800">- Add support for openSUSE Leap 15.5, SLES 15.5, and SLE Micro 5.3
  add-opensuse-leap-15.5-support.patch
  add-sle15sp5-support.patch
  add-slem5.3-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1662120000">- bsc#1202827 - Fail to deploy sle15sp5 guest via virt-install with
  osinfo
  add-sle15sp5-support.patch</changelog>
</package>
<package pkgid="ca8d95623ec417f1285138781a324eab7c868996a12c8c96aabf21ef4c195664" name="osinfo-db" arch="src">
  <version epoch="0" ver="20220727" rel="150300.3.8.1"/>
  <changelog author="carnold@suse.com" date="1614686400">- Update to database version 20210215
  osinfo-db-20210215.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1617969600">- Update to database version 20210312
  osinfo-db-20210312.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1618228800">- Add support for SUSE Linux Enterprise Micro. See also patch
  in virt-manager to enable media detection.
  add-slem-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1623412800">- Update to database version 20210531
  osinfo-db-20210531.tar.xz
- Drop add-leap15.3-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1624276800">- Update to database version 20210621
  osinfo-db-20210621.tar.xz
- Drop patches contained in new tarball
  SLE-add-info-about-UEFI-support.patch
  add-sle15sp3-support.patch
  add-slem50-support.patch
  fix-sle15sp1-volume-id-string.patch</changelog>
  <changelog author="carnold@suse.com" date="1626696000">- bsc#1188336 - openSUSE Tumbleweed unattended installation in
  libvirt fails due to invalid autoyast.xml
  Drop fix-autoyast-validation.patch</changelog>
  <changelog author="carnold@suse.com" date="1627300800">- Add support for openSUSE Leap 15.4, SLE15-SP4, and SLEM 5.1
  (bsc#1188692)
  add-opensuse-leap-15.4-support.patch
  add-sle15sp4-support.patch
  add-slem5.1-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1627387200">- bsc#1182144 - osinfo-db: autoinst.xml does not work with
  Tumbleweed. Fixes nested language problem.
  opensuse-autoyast-desktop.patch</changelog>
  <changelog author="carnold@suse.com" date="1630497600">- Update to database version 20210809
  osinfo-db-20210809.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1630670400">- Update to database version 20210903
  osinfo-db-20210903.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1634731200">- Update to database version 20211013
  osinfo-db-20211013.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1637668800">- jsc#SLE-17764 - Dev: Support Oracle Linux as a guest VM. See also
  bsc#1192238 [Build58.2][KVM] The latest supported OracleLinux as
  guest versions are not included anywhere
  add-missing-oracle-linux-versions.patch</changelog>
  <changelog author="carnold@suse.com" date="1641384000">- Update to database version 20211216
  osinfo-db-20211216.tar.xz
- Drop add-missing-oracle-linux-versions.patch</changelog>
  <changelog author="carnold@suse.com" date="1646136000">- Update to database version 20220214
  osinfo-db-20220214.tar.xz</changelog>
  <changelog author="carnold@suse.com" date="1646913600">- bsc#1196965 - openSUSE Tumbleweed unattended installation with
  libvirt fails
  opensuse-autoyast-desktop.patch</changelog>
  <changelog author="carnold@suse.com" date="1649160000">- bsc#1197958 - request support for SLE15-SP4 in the osinfo database
- Add support for SUSE linux Enterprise Micro 5.2
  add-slem5.2-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1653307200">- Update to database version 20220516
  osinfo-db-20220516.tar.xz</changelog>
  <changelog author="dmueller@suse.com" date="1659355200">- update to 20220727
- drop: add-opensuse-leap-15.4-support.patch
  add-sle15sp4-support.patch
  add-slem5.1-support.patch
  add-slem5.2-support.patch
  opensuse-autoyast-desktop.patch: all upstream</changelog>
  <changelog author="carnold@suse.com" date="1661428800">- Add support for openSUSE Leap 15.5, SLES 15.5, and SLE Micro 5.3
  add-opensuse-leap-15.5-support.patch
  add-sle15sp5-support.patch
  add-slem5.3-support.patch</changelog>
  <changelog author="carnold@suse.com" date="1662120000">- bsc#1202827 - Fail to deploy sle15sp5 guest via virt-install with
  osinfo
  add-sle15sp5-support.patch</changelog>
</package>
<package pkgid="5c82e740554ce14e1db7421fd43d44aeadb126f428c9f15fa117640de0ce8d80" name="ovmf" arch="src">
  <version epoch="0" ver="202008" rel="150300.10.17.1"/>
  <changelog author="glin@suse.com" date="1580731200">- Build the unified firmware with preloaded keys for backward
  compatibility (bsc#1159793)</changelog>
  <changelog author="glin@suse.com" date="1582027200">- Add ovmf-bsc1163959-PiDxeS3BootScriptLib-fix-numeric-truncation.patch
  to fix the numeric truncation to avoid the potential memory
  corruption (bsc#1163959, CVE-2019-14563)</changelog>
  <changelog author="glin@suse.com" date="1582545600">- Add ovmf-bsc1163969-fix-DxeImageVerificationHandler.patch to fix
  dbx signature check (bsc#1163969, CVE-2019-14575)
  + Also change the order of several patches to distinguish the
    openssl patch
- Add ovmf-bsc1163927-fix-ip4dxe-and-arpdxe.patch to fix memory
  leakage in Ip4Dxe and ArpDxe (bsc#1163927, CVE-2019-14559)</changelog>
  <changelog author="glin@suse.com" date="1586174400">- Add ovmf-bsc1163927-fix-ping-and-ip6dxe.patch to fix crash and
  hang in ShellPkg and Ip6Dxe (bsc#1163927, CVE-2019-14559)</changelog>
  <changelog author="glin@suse.com" date="1595246400">- Add ovmf-bsc1119454-additional-scsi-drivers.patch to support more
  SCSI drivers (PvScsi, MptScsi, and LsiScsi) (bsc#1119454)
  + Enable LsiScsi explicitly since it's disabled by default</changelog>
  <changelog author="glin@suse.com" date="1599134400">- Add ovmf-bsc1175476-fix-DxeImageVerificationLib-overflow.patch
  to fix overflow in DxeImageVerificationHandler
  (bsc#1175476, CVE-2019-14562)</changelog>
  <changelog author="glin@suse.com" date="1599652800">- Update to edk2-stable202008
  + MdeModulePkg/Library: add PEIM and SEC module type to
    TpmMeasurementLibNull
  + SecurityPkg/DxeImageVerificationLib: catch alignment overflow
    (CVE-2019-14562) (bsc#1175476)
  + OvmfPkg/CpuHotplugSmm: fix CPU hotplug race before and after
    SMI broadcast
  + SecurityPkg/Tcg2: handle PRE HASH and LOG ONLY
  + MdePkg/Include: Add missing definition of SMBIOS type 42h in
    SmBios.h
  + MdePkg: UefiFileHandleLib: fix buffer overrun in
    FileHandleReadLine()
  + OvmfPkg: Add SEV-ES support (jsc#SLE-16075)
  + MdeModulePkg/PartitionDxe: Fix the incorrect LBA size in child
    hander
  + MdeModulePkg/PartitionDxe: Revert changes for the special MBR
  + MdeModulePkg/PartitionDxe: Put the UDF check ahead of MBR
  + ShellPkg: smbiosview - Change some type 17 field values format
  + CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g
  + MdeModulePkg: Upon BootOption failure, Destroy RamDisk memory
    before RSC.
  + OvmfPkg/LsiScsiDxe: Add support for LSI 53C895A
  + MdeModulePkg/DisplayEngine: Add Debug message to show mismatch
    menu info
  + Add New Memory Attributes
  + MdeModulePkg/PartitionDxe: Add already start check for child
    hanldes
  + MdeModulePkg/PartitionDxe: Skip the MBR that add for CD-ROM
  + MdeModulePkg/PartitionDxe: Correct the MBR last block value
  + MdeModulePkg/Variable/RuntimeDxe: Fix return status from
    Reclaim()
  + SecurityPkg/Tcg2Pei: Add missing PCRIndex in FvBlob event.
  + SecurityPkg/Tcg2Dxe: Add PcdTcgPfpMeasurementRevision in
    SpecId event.
  + CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated
    SHA1 and MD5
  + ArmVirtPkg/NorFlashQemuLib: disable NOR flash DT nodes upon
    discovery
  + UefiCpuPkg/SecCore: Add pre-memory AP vector
  + OvmfPkg: End timer interrupt later to avoid stack overflow
    under load
  + ArmPkg/PlatformBootManagerLib: regenerate boot options on
    boot failure
  + MdeModulePkg/StatusCodeHandler: do not output \n\r for string
    data
  + Revert "OvmfPkg: use generic QEMU image loader for secure boot
    enabled ..."
  + ArmVirtPkg/PrePi: use standard PeCoff routines for
    self-relocation
  + ArmVirtPkg: add FDF rule for self-relocating PrePi
  + ArmPkg/ArmExceptionLib: use static buffer for sp_el0
  + MdeModulePkg/SetupBrowserDxe: Do not reconnect driver with
    form-update
  + OvmfPkg/X86QemuLoadImageLib: handle EFI_ACCESS_DENIED from
    LoadImage()
  + OvmfPkg/Tcg2ConfigPei: generalize TPM2-only file-top comments
  + ArmPkg: only attempt buildin MmCommunicationDxe for AArch64
  + ArmPkg/PlatformBootManagerLib: don't connect all devices on
    each boot
  + ArmPkg/PlatformBootManagerLib: hide UEFI Shell as a regular
    boot option
  + MdeModulePkg/BootManagerUiLib: show inactive boot options
  + ArmPkg/PlatformBootManagerLib: fall back to the UiApp on
    boot failure
  + ArmPkg/PlatformBootManagerLib: register 's' as UEFI Shell
    hotkey
  + ArmPkg/PlatformBootManagerLib: connect non-discoverable USB
    hosts
  + ArmPkg/ArmSvcLib: prevent speculative execution beyond svc
  + ArmPkg/PlatformBootManagerLib: reject 'default' parity and
    stop bit count
  + ArmPkg/PlatformBootManagerLib: use static assertion for
    console type
  + RegularExpressionDxe: Use submodule way to access third party
    Oniguruma
  + BrotliCustomDecompressLib: Use submodule way to access third
    party brotli
  + BaseTools: Use submodule way to access third party brotli
  + RISC-V architecture on EDK2
  + Disabling safe string constraint assertions
  + ArmVirtPkg Implement support for TPM2 measured boot
  + OVMF Implement support for Linux v5.7+ initrd and mixed mode
    loading
  + OVMF Use loadimage/startimage for loading the kernel passed
    via the QEMU command line
  + OVMF Support booting from Fusion-MPT SCSI controllers
  + OVMF Support booting from VMware PVSCSI controllers
  + OVMF RFE: VCPU hotplug with SMM
  + OVMF PEI phase variable driver / MemoryTypeInfo tracking
  + ArmVirtPkg, OvmfPkg: Pass parameter from QEMU to control PXE
    IPv4/v6 boot
  + Remove deprecate APIs in BaseCryptLib
  + Add UEFI 2.8/2.8a definition in MdePkg
  + Add PI1.7/PI1.7a definition into MdePkg
  + BaseCryptoLib MD4, ARC4, TDES, AES ECB MODE, HMAC MD5, HMAC
    SHA1 API have been deprecated.
  + SecurityPkg Tcg2PhysicalPresenceLib library class removes two
    macros TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and
    TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT.
- Update openssl to 1.1.1g
- Add 2 reduced source tarballs from the submodules of edk2:
  + brotli-v1.0.7-17-g666c328-c.tar.xz
  - We only need the "c" directory, not the whole tarball.
  + oniguruma-v6.9.4_mark1-src.tar.xz
  - We only need the "src" directory, not the whole tarball.
- Build all non-native firmware files on x86_64 and aarch64 with
  cross-compilers (bsc#1159134)
  + Exclude i586 and armv7hl due to the availability of
    cross-compilers
  + Move some bash functions to ovmf-build-funcs.sh
- Clean up PKG_TO_REMOVE
  + Only EmulatorPkg still exists.
- Add ovmf-build-funcs.sh for building the variable templates
- Drop upstreamed patches
  + ovmf-bsc1163927-fix-ip4dxe-and-arpdxe.patch
  + ovmf-bsc1175476-fix-DxeImageVerificationLib-overflow.patch
  + ovmf-bsc1119454-additional-scsi-drivers.patch
  + ovmf-bsc1163927-fix-ping-and-ip6dxe.patch
  + ovmf-bsc1163969-fix-DxeImageVerificationHandler.patch
  + ovmf-bsc1163959-PiDxeS3BootScriptLib-fix-numeric-truncation.patch
  + openssl-fix-syntax-error.patch
- Refresh patches
  + ovmf-disable-ia32-firmware-piepic.patch
  + ovmf-gdb-symbols.patch
  + ovmf-pie.patch</changelog>
  <changelog author="glin@suse.com" date="1604059200">- Add _constraints to request at least 6GB disk (bsc#1178244)
- Remove the build files after finishing the build to reduce the
  disk usage (bsc#1178244)</changelog>
  <changelog author="glin@suse.com" date="1604577600">- Update the json descriptors to address all x86_64 firmware files
  (jsc#SLE-15915)
- Remove the executable bit from brotli source code files</changelog>
  <changelog author="glin@suse.com" date="1605614400">- Add ovmf-jscSLE-16075-SEV-ES-fixes.patch to merge upstream SEV-ES
  fixes (jsc#SLE-16075)</changelog>
  <changelog author="glin@suse.com" date="1606910400">- Add ovmf-bsc1177789-cryptopkg-fix-null-dereference.patch to fix
  the potential NULL dereference in AuthenticodeVerify()
  (bsc#1177789, CVE-2019-14584)</changelog>
  <changelog author="glin@suse.com" date="1610452800">- Add ovmf-bsc1180079-amd-sev-es-mitigation.patch to mitigate the
  potential AMD SEV-ES security issues (bsc#1180079)
- Add the json descriptor for xen-hvm (bsc#1180050)</changelog>
  <changelog author="glin@suse.com" date="1611921600">- Add ovmf-jscSLE-16075-SEV-ES-use-physical-address.patch as the
  follow-up patch for SEV-ES to fix the flash writing
  (jsc#SLE-16075)
- Update 50-xen-hvm-x86_64.json to add "nvram-template" and change
  the firmware file to ovmf-x86_64-ms-4m.bin
  (bsc#1180050, bsc#1181264)
- Refresh ovmf-bsc1180079-amd-sev-es-mitigation.patch
  + Use "git format-patch --no-renames" to generate the patch to
    avoid confusing quilt with the renamed files</changelog>
  <changelog author="glin@suse.com" date="1616068800">- Add ovmf-bsc1183578-lzma-catch-4GB.patch to fix the possible
  heap corruption (bsc#1183578, CVE-2021-28211)
- Add ovmf-bsc1183579-fix-fv-recursion.patch to fix unlimited FV
  recursion (bsc#1183579, CVE-2021-28210)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Build ovmf-x86_64-smm against Ia32X64 to enable S3 support
  (bsc#1184938)
- Update ovmf-add-exclude-shell-flag.patch to include Ia32X64</changelog>
  <changelog author="glin@suse.com" date="1620129600">- Update the descriptors to add "acpi-s4" tag to allow libvirt
  enable hibernation (bsc#1182886#c31)</changelog>
  <changelog author="glin@suse.com" date="1623067200">- Add ovmf-bsc1186151-fix-iscsi-overflows.patch to fix the possible
  overflows in IScsiDxe (bsc#1186151)</changelog>
  <changelog author="jlee@suse.com" date="1640088000">- Add ovmf-bsc1192126-OvmfPkg-PlatformPei-Always-reserve-the-SEV-ES-work-a.patch
  to fix unlimited reset. (bsc#1192126)</changelog>
  <changelog author="fvogt@suse.com" date="1649851200">- Set TPM2_ENABLE and TPM2_CONFIG_ENABLE as well, needed for Arm
  (boo#1197458)</changelog>
  <changelog author="jlee@suse.com" date="1671796800">- Add ovmf-bsc1188371-UefiCpuPkg-Move-MigrateGdt-from-DiscoverMemory-to-Te.patch
  to fix insufficient input validation in MdeModulePkg.
  (bsc#1188371, CVE-2019-11098)</changelog>
</package>
<package pkgid="ee954d1f07ddea4e6ea469f6b1a7b140e66de0463e4e5f91aaafa2d009eb2c26" name="p11-kit" arch="aarch64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="28823a7518082e5c83349bfd9345fc0b99a238804d25cf0c9dac4250f032ffa5" name="p11-kit" arch="src">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1372075200">- add p11-kit-nss-trust subpackage that serves as drop-in
  replacement for mozilla-nss-certs</changelog>
  <changelog author="lnussel@suse.de" date="1372420800">- provide libnssckbi.so to replace mozilla-nss-certs</changelog>
  <changelog author="lnussel@suse.de" date="1373025600">- fix 32bit provides of libnssckbi.so
- repace p11-kit-extract-trust with update-ca-certificates</changelog>
  <changelog author="lnussel@suse.de" date="1374753600">- new version 0.19.3
  * Fix up problems with automake testing
  * Fix a bunch of memory leaks in newly refactored code
  * Don't use _GNU_SOURCE and the unportability it brings
  * Add basic 'trust anchor' command to store a new anchor
  * Support for writing out trust token objects
  * Port to use CKA_PUBLIC_KEY_INFO and updated trust store spec
  * Add option to use freebl for hashing
  * Implement reloading of token data
  * Fix warnings and possible minor bugs higlighted by code scanners
  * Don't load configs in home directories when running setuid or setgid
  * Support treating ~/.config as $XDG_CONFIG_HOME
  * Use $XDG_DATA_HOME/pkcs11 as default user config directory
  * Use $TMPDIR instead of $TEMP while testing
  * Open files and fds with O_CLOEXEC
  * Abort initialization if a critical module fails to load
  * Don't use thread-unsafe functions: strerror, getpwuid
  * Fix p11_kit_space_strlen() result when empty string
  * Refactoring of where various components live</changelog>
  <changelog author="lnussel@suse.de" date="1377864000">- new version 0.19.4
  * 'trust anchor' now adds/removes certificate anchors
  * 'trust list' lists trust policy stuff
  * 'p11-kit extract' is now 'trust extract'
  * 'p11-kit extract-trust' is now 'trust extract-compat'
  * Workarounds for working on broken zfsonlinux.org [#68525]
  * Add --with-module-config parameter to the configure script [#68122]
  * Add support for removing stored PKCS#11 objects in trust module</changelog>
  <changelog author="lnussel@suse.de" date="1378814400">- upgrade to 0.20.1 which is 0.19 declared stable
  * Extract compat trust data after we've changes
  * Skip compat extraction if running as non-root
  * Better failure messages when removing anchors</changelog>
  <changelog author="lnussel@suse.de" date="1386331200">- trust: allow to also add openssl style hashes to pem-directory
  0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff</changelog>
  <changelog author="meissner@suse.com" date="1392120000">- added .sig file. trying to locate source of the keyring.</changelog>
  <changelog author="lnussel@suse.de" date="1400500800">- New version 0.20.2
  * Fix bug where blacklist didn't affect extracted ca-anchors if the anchor
    and blacklist were not in the same trust path (regression) [fdo#73558]
  * Check for race in BasicConstraints stapled extension [fdo#69314]
  * Build fixes and cleanup</changelog>
  <changelog author="lnussel@suse.de" date="1409313600">- new version 0.20.3
  * Fix problems reinitializing managed modules after fork
  * Fix bad bookeeping when fail initializing one of the modules
  * Fix case where module would be unloaded while in use [#74919]
  * Remove assertions when module used before initialized [#74919]
  * Fix handling of mmap failure and mapping empty files [#74773]
  * Stable p11_kit_be_quiet() and p11_kit_be_loud() functions
  * Require automake 1.12 or later
  * Build fixes for Windows [#76594 #74149]
- apply patches to avoid errors from certificates with invalid public key
  (fdo#82328, bnc#890908,
  trust-Dont-use-invalid-public-keys-for-looking-up-.patch,
  trust-Print-label-of-certificate-when-complaining-.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="e62d5dbb1c7490438ccc9942543ea4e5940594dcf858c650b3877b7b417a695d" name="p11-kit" arch="x86_64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="6175ce11481ead85ef4dbd5a092cb40b6fe522f54eee2d880008acc33e9c01f5" name="p11-kit-tools" arch="aarch64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="2b034162b11f74152460c39653fba29e318ba0a62d62d9915fb5646602525d77" name="p11-kit-tools" arch="x86_64">
  <version epoch="0" ver="0.23.2" rel="150000.4.16.1"/>
  <changelog author="lnussel@suse.de" date="1413201600">- remove patches:
  * trust-Print-label-of-certificate-when-complaining-.patch
  * trust-Dont-use-invalid-public-keys-for-looking-up-.patch
- new version 0.20.7 (stable)
  * New public pkcs11x.h header containing extensions [fdo#83495]
  * Export necessary defines to lookup attached extensions [fdo#83495]
  * Build fixes
- new version 0.20.6 (stable)
  * Make the p11-kit-proxy.so module respect critical = no [fdo#83651]
  * Build fix for FreeBSD [fdo#75674]
- new version 0.20.5 (stable)
  * Don't use invalid keys for looking up stapled extensions [fdo#82328]
  * Better error messages when invalid certificate extensions
  * Fix parsing of some odd OpenSSL TRUSTED CERTIFICATE files
  * Fix some leaks, and memory issues
  * Silence some clang scanner warnings
- new version 0.20.4 (stable)
  * Don't complain about C_Finalize after a fork
  * Fix typo</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 0.23.1 (stable)
  * Use new PKCS#11 URI draft fields for URIs [fdo#86474 fdo#87582]
  * Add pem-directory-hash extract format
  * Build fixes
- Remove 0001-trust-allow-to-also-add-openssl-style-hashes-to-pem-d.diff;
  fixed on upstream release
- Remove autoconf, automake and libtool require; unneeded dependencies
- Add gtk-doc require; needed to build html documentation
- Remove redundant %clean section</changelog>
  <changelog author="mpluskal@suse.com" date="1454932800">- Update to 0.23.2
  * Fix forking issues with libffi
  * Fix various crashes in corner cases
  * Updated translations
  * Build fixes
- Make building more verbose
- Enable tests
- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- 32-bit compatibility fixes:
  * Add PKCS11 module to p11-kit-32bit (bsc#996047#c39)
  * Add p11-kit-nss-trust-32bit NSS module
  * Fix potential bi-arch issue with private binaries
    (fdo#98817, p11-kit-biarch.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="lnussel@suse.de" date="1573819200">- support loading NSS attribute CKA_NSS_MOZILLA_CA_POLICY so Firefox
  detects built in certificates (boo#1154871,
  0001-Fix-a-typo-in-x-cetrificate-value-see-also-https-bug.patch,
  0001-Support-loading-new-NSS-attribute-CKA_NSS_MOZILLA_CA.patch)</changelog>
  <changelog author="lnussel@suse.de" date="1577102400">- Also build documentation (boo#1013125)</changelog>
  <changelog author="lnussel@suse.de" date="1626782400">- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily</changelog>
  <changelog author="meissner@suse.com" date="1638878400">- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)</changelog>
  <changelog author="meissner@suse.com" date="1657800000">- CVE-2020-29362: Fixed a 4 byte overread (bsc#1180065)
  Added p11-kit-CVE-2020-29362.patch:</changelog>
</package>
<package pkgid="f6b2c10e16197fe54e8a46d0e78de2fe17de35933ca52bb24baf1423f5715f92" name="pam" arch="aarch64">
  <version epoch="0" ver="1.3.0" rel="150000.6.61.1"/>
  <changelog author="meissner@suse.com" date="1584100800">- disable libdb usage and pam_userdb again, as this causes some license
  conflicts. (bsc#1166510)</changelog>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Moved pam_userdb to a separate package pam-extra.
  [bsc#1166510, pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1602763200">- /usr/bin/xauth chokes on the old user's $HOME being on an NFS
  file system. Run /usr/bin/xauth using the old user's uid/gid
  Patch courtesy of Dr. Werner Fink.
  [bsc#1174593, pam-xauth_ownership.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605268800">- Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft"
  to avoid spurious (and misleading)
    Warning: your password will expire in ... days.
  fixed upstream with commit db6b293046a
  [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605700800">- pam_xauth.c: do not free() a string which has been (successfully)
  passed to putenv().
  [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605787200">- pam_cracklib: added code to check whether the password contains
  a substring of of the user's name of at least &lt;N&gt; characters length
  in some form.
  This is enabled by the new parameter "usersubstr=&lt;N&gt;"
  See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4
  [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1610712000">- Create macros.pam with definition of %_pamdir so packages which
  are commonly shared between Factory and SLE can use this macro
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1612785600">- Add a definition for pamdir to pam.spec
  So that a proper contents of macros.pam can be constructed.
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1615377600">- pam_limits: "unlimited" is not a legitimate value for "nofile"
  (see setrlimit(2)). So, when "nofile" is set to one of the
  "unlimited" values, it is set to the contents of
  "/proc/sys/fs/nr_open" instead.
  Also changed the manpage of pam_limits to express this.
  [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1617710400">- If "LOCAL" is configured in access.conf, and a login attempt from
  a remote host is made, pam_access tries to resolve "LOCAL" as
  a hostname and logs a failure.
  Checking explicitly for "LOCAL" and rejecting access in this case
  resolves this issue.
  [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1620734400">- In the 32-bit compatibility package for 64-bit architectures,
  require "systemd-32bit" to be also installed as it contains
  pam_systemd.so for 32 bit applications.
  [bsc#1185562, baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1629892800">- Added pam_faillock to the set of modules.
  [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1630497600">- Added new file macros.pam on request of systemd.
  [bsc#1190052, macros.pam]</changelog>
  <changelog author="josef.moellers@suse.com" date="1633521600">- Corrected macros.pam entry for %_pam_moduledir
  Cleanup in pam.spec:
  * Replaced all references to ${_lib}/security in pam.spec by
  %{_pam_moduledir}
  * Removed definition of (unused) "amdir".</changelog>
  <changelog author="josef.moellers@suse.com" date="1634212800">- Added tmpfiles for pam to set up directory for pam_faillock.
  [pam.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1634817600">- Corrected a bad directive file which resulted in
  the "securetty" file to be installed as "macros.pam".
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1645704000">- Define _pam_vendordir as "/%{_sysconfdir}/pam.d"
  The variable is needed by systemd and others.
  [bsc#1196093, macros.pam]</changelog>
  <changelog author="josef.moellers@suse.com" date="1647432000">- Between allocating the variable "ai" and free'ing them, there are
  two "return NO" were we don't free this variable. This patch
  inserts freaddrinfo() calls before the "return NO;"s.
  [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1648814400">- Do not include obsolete libselinux header files flask.h and
  av_permissions.h.
  [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1662552000">- Update pam_motd to the most current version. This fixes various issues
  and adds support for mot.d directories [jsc#PED-1712].
  * Added: pam-ped1712-pam_motd-directory-feature.patch</changelog>
</package>
<package pkgid="ddd5d5121ec01663622abccc00050fe95087bae476b610f916b55eb611a9b7f3" name="pam" arch="src">
  <version epoch="0" ver="1.3.0" rel="150000.6.61.1"/>
  <changelog author="meissner@suse.com" date="1584100800">- disable libdb usage and pam_userdb again, as this causes some license
  conflicts. (bsc#1166510)</changelog>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Moved pam_userdb to a separate package pam-extra.
  [bsc#1166510, pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1602763200">- /usr/bin/xauth chokes on the old user's $HOME being on an NFS
  file system. Run /usr/bin/xauth using the old user's uid/gid
  Patch courtesy of Dr. Werner Fink.
  [bsc#1174593, pam-xauth_ownership.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605268800">- Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft"
  to avoid spurious (and misleading)
    Warning: your password will expire in ... days.
  fixed upstream with commit db6b293046a
  [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605700800">- pam_xauth.c: do not free() a string which has been (successfully)
  passed to putenv().
  [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605787200">- pam_cracklib: added code to check whether the password contains
  a substring of of the user's name of at least &lt;N&gt; characters length
  in some form.
  This is enabled by the new parameter "usersubstr=&lt;N&gt;"
  See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4
  [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1610712000">- Create macros.pam with definition of %_pamdir so packages which
  are commonly shared between Factory and SLE can use this macro
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1612785600">- Add a definition for pamdir to pam.spec
  So that a proper contents of macros.pam can be constructed.
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1615377600">- pam_limits: "unlimited" is not a legitimate value for "nofile"
  (see setrlimit(2)). So, when "nofile" is set to one of the
  "unlimited" values, it is set to the contents of
  "/proc/sys/fs/nr_open" instead.
  Also changed the manpage of pam_limits to express this.
  [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1617710400">- If "LOCAL" is configured in access.conf, and a login attempt from
  a remote host is made, pam_access tries to resolve "LOCAL" as
  a hostname and logs a failure.
  Checking explicitly for "LOCAL" and rejecting access in this case
  resolves this issue.
  [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1620734400">- In the 32-bit compatibility package for 64-bit architectures,
  require "systemd-32bit" to be also installed as it contains
  pam_systemd.so for 32 bit applications.
  [bsc#1185562, baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1629892800">- Added pam_faillock to the set of modules.
  [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1630497600">- Added new file macros.pam on request of systemd.
  [bsc#1190052, macros.pam]</changelog>
  <changelog author="josef.moellers@suse.com" date="1633521600">- Corrected macros.pam entry for %_pam_moduledir
  Cleanup in pam.spec:
  * Replaced all references to ${_lib}/security in pam.spec by
  %{_pam_moduledir}
  * Removed definition of (unused) "amdir".</changelog>
  <changelog author="josef.moellers@suse.com" date="1634212800">- Added tmpfiles for pam to set up directory for pam_faillock.
  [pam.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1634817600">- Corrected a bad directive file which resulted in
  the "securetty" file to be installed as "macros.pam".
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1645704000">- Define _pam_vendordir as "/%{_sysconfdir}/pam.d"
  The variable is needed by systemd and others.
  [bsc#1196093, macros.pam]</changelog>
  <changelog author="josef.moellers@suse.com" date="1647432000">- Between allocating the variable "ai" and free'ing them, there are
  two "return NO" were we don't free this variable. This patch
  inserts freaddrinfo() calls before the "return NO;"s.
  [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1648814400">- Do not include obsolete libselinux header files flask.h and
  av_permissions.h.
  [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1662552000">- Update pam_motd to the most current version. This fixes various issues
  and adds support for mot.d directories [jsc#PED-1712].
  * Added: pam-ped1712-pam_motd-directory-feature.patch</changelog>
</package>
<package pkgid="65ef2fd0c63cbc5fc906197ae2ee4f537b100cd39e084c569163cbeadaff16c1" name="pam" arch="x86_64">
  <version epoch="0" ver="1.3.0" rel="150000.6.61.1"/>
  <changelog author="meissner@suse.com" date="1584100800">- disable libdb usage and pam_userdb again, as this causes some license
  conflicts. (bsc#1166510)</changelog>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Moved pam_userdb to a separate package pam-extra.
  [bsc#1166510, pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1602763200">- /usr/bin/xauth chokes on the old user's $HOME being on an NFS
  file system. Run /usr/bin/xauth using the old user's uid/gid
  Patch courtesy of Dr. Werner Fink.
  [bsc#1174593, pam-xauth_ownership.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605268800">- Initialize pam_unix pam_sm_acct_mgmt() local variable "daysleft"
  to avoid spurious (and misleading)
    Warning: your password will expire in ... days.
  fixed upstream with commit db6b293046a
  [bsc#1178727, pam-bsc1178727-initialize-daysleft.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605700800">- pam_xauth.c: do not free() a string which has been (successfully)
  passed to putenv().
  [bsc#1177858, pam-bsc1177858-dont-free-environment-string.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605787200">- pam_cracklib: added code to check whether the password contains
  a substring of of the user's name of at least &lt;N&gt; characters length
  in some form.
  This is enabled by the new parameter "usersubstr=&lt;N&gt;"
  See https://github.com/libpwquality/libpwquality/commit/bfef79dbe6aa525e9557bf4b0a61e6dde12749c4
  [jsc#SLE-16719, jsc#SLE-16720, pam-pam_cracklib-add-usersubstr.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1610712000">- Create macros.pam with definition of %_pamdir so packages which
  are commonly shared between Factory and SLE can use this macro
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1612785600">- Add a definition for pamdir to pam.spec
  So that a proper contents of macros.pam can be constructed.
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1615377600">- pam_limits: "unlimited" is not a legitimate value for "nofile"
  (see setrlimit(2)). So, when "nofile" is set to one of the
  "unlimited" values, it is set to the contents of
  "/proc/sys/fs/nr_open" instead.
  Also changed the manpage of pam_limits to express this.
  [bsc#1181443, pam-bsc1181443-make-nofile-unlimited-mean-nr_open.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1617710400">- If "LOCAL" is configured in access.conf, and a login attempt from
  a remote host is made, pam_access tries to resolve "LOCAL" as
  a hostname and logs a failure.
  Checking explicitly for "LOCAL" and rejecting access in this case
  resolves this issue.
  [bsc#1184358, bsc1184358-prevent-LOCAL-from-being-resolved.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1620734400">- In the 32-bit compatibility package for 64-bit architectures,
  require "systemd-32bit" to be also installed as it contains
  pam_systemd.so for 32 bit applications.
  [bsc#1185562, baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1629892800">- Added pam_faillock to the set of modules.
  [jsc#sle-20638, pam-sle20638-add-pam_faillock.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1630497600">- Added new file macros.pam on request of systemd.
  [bsc#1190052, macros.pam]</changelog>
  <changelog author="josef.moellers@suse.com" date="1633521600">- Corrected macros.pam entry for %_pam_moduledir
  Cleanup in pam.spec:
  * Replaced all references to ${_lib}/security in pam.spec by
  %{_pam_moduledir}
  * Removed definition of (unused) "amdir".</changelog>
  <changelog author="josef.moellers@suse.com" date="1634212800">- Added tmpfiles for pam to set up directory for pam_faillock.
  [pam.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1634817600">- Corrected a bad directive file which resulted in
  the "securetty" file to be installed as "macros.pam".
  [pam.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1645704000">- Define _pam_vendordir as "/%{_sysconfdir}/pam.d"
  The variable is needed by systemd and others.
  [bsc#1196093, macros.pam]</changelog>
  <changelog author="josef.moellers@suse.com" date="1647432000">- Between allocating the variable "ai" and free'ing them, there are
  two "return NO" were we don't free this variable. This patch
  inserts freaddrinfo() calls before the "return NO;"s.
  [bsc#1197024, pam-bsc1197024-free-addrinfo-before-return.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1648814400">- Do not include obsolete libselinux header files flask.h and
  av_permissions.h.
  [bsc#1197794, pam-bsc1197794-do-not-include-obsolete-header-files.patch]</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1662552000">- Update pam_motd to the most current version. This fixes various issues
  and adds support for mot.d directories [jsc#PED-1712].
  * Added: pam-ped1712-pam_motd-directory-feature.patch</changelog>
</package>
<package pkgid="8311ba4ced18a192adef06819518f7df4578621991c567c9bc983cdfbd6adc71" name="pam_apparmor" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="5f2d52d1450ea8e000ebb321a6cbfedce6d71caf459f99e08f5f907692326a94" name="pam_apparmor" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="150300.3.15.1"/>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
  <changelog author="meissner@suse.com" date="1638273600">- fixed requires of python3 module (bsc#1191690).</changelog>
  <changelog author="nopower@suse.com" date="1641384000">- add add-samba-bgqd.diff: add profile for samba-bgqd;
  (bsc#1191532).</changelog>
  <changelog author="nopower@suse.com" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
  (bsc#1192684).</changelog>
  <changelog author="nopower@suse.com" date="1648555200">- update add-samba-bgqd.diff:  to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
</package>
<package pkgid="028a4eb3ebb83dcf6a9b9effe9a7c27ed35fd4a2ba1ee4b53dbde33932c00c73" name="pcre" arch="src">
  <version epoch="0" ver="8.45" rel="150000.20.13.1"/>
  <changelog author="tchvatal@suse.com" date="1395576000">- Add automake and autoconf as explicit deps as we run autoreconf</changelog>
  <changelog author="coolo@suse.com" date="1399118400">- update to 0.35:
  There have been performance improvements for classes containing non-ASCII
  characters and the "auto-possessification" feature has been extended. Other
  minor improvements have been implemented and bugs fixed. There is a new callout
  feature to enable applications to do detailed stack checks at compile time, to
  avoid running out of stack for deeply nested parentheses. The JIT compiler has
  been extended with experimental support for ARM-64, MIPS-64, and PPC-LE.
- add pcre-commit1472.patch from SVN to work with gcc49, see
  http://bugs.exim.org/show_bug.cgi?id=1463</changelog>
  <changelog author="dvaleev@suse.com" date="1402920000">- Enable JIT on ppc64le as well</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1409227200">- Harden build with full RELRO as this libraries end linked
  to at least one setuid root executable.</changelog>
  <changelog author="jengelh@inai.de" date="1409659200">- Improve on RPM group classification
- Remove defunct %gpg_verify (replaced by source validators),
  defunct freecode link</changelog>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1448539200">- pcre 8.38:
  * CVE-2015-3217: Call Stack Overflow Vulnerability in match()
    bsc#933878
  * Other fixes to assertions, crashes, buffer overflows and
    performance issues found by fuzzer, affecting applications
    accepting regular expression from untrusted sources</changelog>
  <changelog author="mpluskal@suse.com" date="1465992000">- Update to version 8.39:
  * Some appropriate PCRE2 JIT improvements have been retro-fitted
    to PCRE1.
  * CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)
  * CVE-2016-1283: Heap buffer overflow DoS (boo#960837)
  * Apart from that, this is another bug-fix release.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- record minor vulnerabilities fixed in 8.39</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1486641600">- pcre 8.40:
  * Using -o with -M in pcregrep could cause unnecessary repeated
    output when the match extended over a line boundary.
  * Fix register overwite in JIT when SSE2 acceleration is enabled.
  * Ignore "show all captures" (/=) for DFA matching.
  * Fix JIT unaligned accesses on x86
  * In any wide-character mode (8-bit UTF or any 16-bit or 32-bit
    mode), without PCRE_UCP set, a negative character type such as
    \D in a positive class should cause all characters greater than
    255 to match, whatever else is in the class. There was a bug
    that caused this not to happen if a Unicode property item was
    added to such a class, for example [\D\P{Nd}] or [\W\pL].
  * When pcretest was outputing information from a callout, the
    caret indicator for the current position in the subject line
    was incorrect if it was after an escape sequence for a
    character whose code point was greater than \x{ff}.
  * A pattern such as (?&lt;RA&gt;abc)(?(R)xyz) was incorrectly compiled
    such that the conditional was interpreted as a reference to
    capturing group 1 instead of a test for recursion. Any group
    whose name began with R was misinterpreted in this way. (The
    reference interpretation should only happen if the group's name
    is precisely "R".)
  * A number of bugs have been mended relating to match start-up
    optimizations when the first thing in a pattern is a positive
    lookahead. These all applied only when PCRE_NO_START_OPTIMIZE
    was *not* set:
    + A pattern such as (?=.*X)X$ was incorrectly optimized as if
    it needed both an initial 'X' and a following 'X'.
    + Some patterns starting with an assertion that started with
    .* were incorrectly optimized as having to match at the start
    of the subject or after a newline. There are cases where this
    is not true, for example, (?=.*[A-Z])(?=.{8,16})(?!.*[\s])
    matches after the start in lines that start with spaces.
    Starting .* in an assertion is no longer taken as an
    indication of matching at the start (or after a newline).</changelog>
  <changelog author="mpluskal@suse.com" date="1496404800">- Enable jit on aarch64
- Enable profiled building</changelog>
  <changelog author="astieger@suse.com" date="1500984000">- pcre 8.41:
  * If pcregrep in multiline mode with --only-matching matched
    several lines, it restarted scanning at the next line instead
    of moving on to the end of the matched string, which can be
    several lines after the start.
  * Fix a missing else in the JIT compiler reported by 'idaifish'.
    CVE-2017-6004 bsc#1025709
  * A (?# style comment is now ignored between a basic quantifier
    and a following '+' or '?' (example: /X+(?#comment)?Y/.
  * Avoid use of a potentially overflowing buffer in pcregrep
  * Fix issues reported by fuzzers in pcretest:
  - Check for values &lt; 256 when calling isprint() in pcretest.
  - Give an error for too big a number after \O.
  * In the 32-bit library in non-UTF mode, an attempt to find a
    Unicode property for a character with a code point greater than
    0x10ffff (the Unicode maximum) caused a crash.
    CVE-2017-7186 bsc#1030066, CVE-2017-7244 bsc#1030807
  * The alternative matching function, pcre_dfa_exec() misbehaved
    if it encountered a character class with a possessive repeat,
    for example [a-f]{3}+.
  * When pcretest called pcre_copy_substring() in 32-bit mode, it
    set the buffer length incorrectly, which could result in buffer
    overflow. CVE-2017-7245 bsc#1030805, CVE-2017-7246 bsc#1030803</changelog>
  <changelog author="matz@suse.com" date="1505217600">- RunTest needs much stack, on s390x more than the default
  8 MB.  [bnc#1046102]</changelog>
  <changelog author="kstreitova@suse.com" date="1509537600">- add pcre-8.41-stack_frame_size_detection.patch to fix pcre stack
  frame size detection because modern compilers broke it by cloning
  and inlining pcre match() function [bsc#1058722]</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="bwiedemann@suse.com" date="1620734400">- Do not run profiling 'check' in parallel
  to make package build reproducible (boo#1040589)</changelog>
  <changelog author="coolo@suse.com" date="1634644800">- pcre 8.45 (the final release)
  * Fixed a small (*MARK) bug in the interpreter (Bugzilla #2771).
- pcre 8.44
  * Small patch to pcreposix.c to set the erroroffset field to -1 immediately
  after a successful compile, instead of at the start of matching to avoid a
  sanitizer complaint (regexec is supposed to be thread safe).
  * Check the size of the number after (?C as it is read, in order to avoid
  integer overflow. (bsc#1172974, CVE-2020-14155)
  * Tidy up left shifts to avoid sanitize warnings; also fix one NULL deference
  in pcretest.
- pcre 8.43
  * In a pattern such as /[^\x{100}-\x{ffff}]*[\x80-\xff]/ which has a repeated
  negative class with no characters less than 0x100 followed by a positive class
  with only characters less than 0x100, the first class was incorrectly being
  auto-possessified, causing incorrect match failures.
  * If the only branch in a conditional subpattern was anchored, the whole
  subpattern was treated as anchored, when it should not have been, since the
  assumed empty second branch cannot be anchored. Demonstrated by test patterns
  such as /(?(1)^())b/ or /(?(?=^))b/.
  * Fix subject buffer overread in JIT when UTF is disabled and \X or \R has
  a greater than 1 fixed quantifier. This issue was found by Yunho Kim.
  (bsc#1172973 CVE-2019-20838)
  * If a pattern started with a subroutine call that had a quantifier with a
  minimum of zero, an incorrect "match must start with this character" could be
  recorded. Example: /(?&amp;xxx)*ABC(?&lt;xxx&gt;XYZ)/ would (incorrectly) expect 'A' to
  be the first character of a match.
- pcre 8.42
  * If a backreference with a minimum repeat count of zero was first in a
  pattern, apart from assertions, an incorrect first matching character could be
  recorded. For example, for the pattern /(?=(a))\1?b/, "b" was incorrectly set
  as the first character of a match.
  * Fix out-of-bounds read for partial matching of /./ against an empty string
  when the newline type is CRLF.
  * When matching using the the REG_STARTEND feature of the POSIX API with a
  non-zero starting offset, unset capturing groups with lower numbers than a
  group that did capture something were not being correctly returned as "unset"
  (that is, with offset values of -1).
  * Matching the pattern /(*UTF)\C[^\v]+\x80/ against an 8-bit string
  containing multi-code-unit characters caused bad behaviour and possibly a
  crash. This issue was fixed for other kinds of repeat in release 8.37 by change
  38, but repeating character classes were overlooked.</changelog>
  <changelog author="jsikes@suse.com" date="1652270400">- Added pcre-8.45-bsc1199232-unicode-property-matching.patch
  * bsc#1199232
  * CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
</package>
<package pkgid="52ead39e86ae86597276f98ee6ae54a7b8701f058f3c9ef452beb0d0691ca7cf" name="pcre2" arch="src">
  <version epoch="0" ver="10.31" rel="150000.3.12.1"/>
  <changelog author="coolo@suse.com" date="1399118400">- update to 0.35:
  There have been performance improvements for classes containing non-ASCII
  characters and the "auto-possessification" feature has been extended. Other
  minor improvements have been implemented and bugs fixed. There is a new callout
  feature to enable applications to do detailed stack checks at compile time, to
  avoid running out of stack for deeply nested parentheses. The JIT compiler has
  been extended with experimental support for ARM-64, MIPS-64, and PPC-LE.
- add pcre-commit1472.patch from SVN to work with gcc49, see
  http://bugs.exim.org/show_bug.cgi?id=1463</changelog>
  <changelog author="dvaleev@suse.com" date="1402920000">- Enable JIT on ppc64le as well</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1409227200">- Harden build with full RELRO as this libraries end linked
  to at least one setuid root executable.</changelog>
  <changelog author="jengelh@inai.de" date="1409659200">- Improve on RPM group classification
- Remove defunct %gpg_verify (replaced by source validators),
  defunct freecode link</changelog>
  <changelog author="p.drouand@gmail.com" date="1425902400">- Update to version 3.16
  * This is primarily a bug-fix release.
  * The Unicode data tables have been updated to Unicode 7.0.0.
- Remove pcre-commit1472.patch; fixed on upstream release
- Remove obsolete "Obsoletes" tag</changelog>
  <changelog author="astieger@suse.com" date="1430395200">- pcre 8.37:
  * CVE-2015-2325: Patterns with certain groups specifying a zero
    minimum quantifier caused incorrect code to be compiled,
    leading to an incorrect memory read. [boo#924960]
  * CVE-2015-2326: Specific patterns containing a forward reference
    with subroutine calls caused incorrect code to be compiled
    [boo#924961]
  * CVE-2014-8964: If an assertion condition was quantified with a
    minimum of zero, SIGSEGV or other misbehaviour could occur.
    [boo#906574]
  * further bug fixes as listed in ChangeLog</changelog>
  <changelog author="astieger@suse.com" date="1434628800">- PCRE2, a re-working of the original PCRE library to provide an
  entirely new API, version 10.10. Not source compatible.
- copy of the pcre package, with the following adjustments:
  * required name changes
  * adjust pcre-8.21-multilib.patch to pcre2-10.10-multilib.patch
  * drop upstreamed pcre-8.32-visibility.patch
  * --enable-{utf8,unicode-properties} became --enable-unicode
  * drop cpp subpackage
  * make test -&gt; check
  * enable 32 bit character support</changelog>
  <changelog author="astieger@suse.com" date="1436875200">- PCRE2 10.20:
  * Callouts with string arguments and the
    pcre2_callout_enumerate() function have been implemented.
  * The PCRE2_NEVER_BACKSLASH_C option, which locks out the use of
    \C, is added.
  * The PCRE2_ALT_CIRCUMFLEX option lets ^ match after a newline at
    the end of a subject in multiline mode.
  * The way named subpatterns are handled has been refactored. The
    previous approach had several bugs.
  * The handling of \c in EBCDIC environments has been changed to
    conform to the perlebcdic document. (Incompatible change)
  * Bugs have been mended, many of them discovered by fuzzers.</changelog>
  <changelog author="jengelh@inai.de" date="1453032000">- Update to new upstream release 10.21
  * Improve JIT matching speed of patterns starting with + or *.
  * Use memchr() to find the first character in an unanchored match
  in 8-bit mode in the interpreter. This gives a significant speed
  improvement.
  * 10.20 broke the handling of [[:&gt;:]] and [[:&lt;:]] in that
  processing them could involve a buffer overflow if the
  following character was an opening parenthesis.
  * 10.20 also introduced a bug in processing this pattern:
  /((?x)(*:0))#(?'/, which was fixed.
  * A callout with a string argument containing an opening square
  bracket, for example /(?C$[$)(?&lt;]/, was incorrectly processed and
  could provoke a buffer overflow.
  * A possessively repeated conditional group that could match an empty
  string, for example, /(?(R))*+/, was incorrectly compiled.
  * The Unicode tables have been updated to Unicode 8.0.0.
  * An empty comment (?#) in a pattern was incorrectly processed and
  could provoke a buffer overflow.
  * Fix infinite recursion in the JIT compiler when certain patterns
  /such as (?:|a|){100}x/ are analysed.
  * Some patterns with character classes involving [: and \\ were
  incorrectly compiled and could cause reading from uninitialized
  memory or an incorrect error diagnosis. Examples are:
  /[[:\\](?&lt;[::]/ and /[[:\\](?'abc')[a:].
  * A missing closing parenthesis for a callout with a string argument
  was not being diagnosed, possibly leading to a buffer overflow.
  * If (?R was followed by - or + incorrect behaviour happened instead
  of a diagnostic.
  * Fixed an issue when \p{Any} inside an xclass did not read the current
  character.
  * About 80 more fixes, which you can read about in the ChangeLog
  shipped with the libpcre2-8-0 package.</changelog>
  <changelog author="astieger@suse.com" date="1470052800">- pcre2 10.22:
  * The POSIX wrapper function regcomp() did not used to
    support back references and subroutine calls if called with the
    REG_NOSUB option. It now does.
  * A new function, pcre2_code_copy(), is added, to make a copy of a
    compiled pattern.
  * Support for string callouts is added to pcre2grep.
  * Added the PCRE2_NO_JIT option to pcre2_match().
  * The pcre2_get_error_message() function now returns with a
    negative error code if the error number it is given is unknown.
  * Several updates have been made to pcre2test and test scripts
  * Fix CVE-2016-3191: workspace overflow for (*ACCEPT) with deeply
    nested parentheses (boo#971741)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486468800">- Explicitly package %{_docdir}/%{name} to fix build with RPM 4.13.</changelog>
  <changelog author="astieger@suse.com" date="1487246400">- pcre2 10.23:
  * major re-factoring of the pcre2_compile.c file
  * Back references are now permitted in lookbehind assertions when
    there are no duplicated group numbers (that is, (?| has not
    been used), and, if the reference is by name, there is only one
    group of that name. The referenced group must, of course be of
    fixed length.
  * \g{+&lt;number&gt;} (e.g. \g{+2} ) is now supported. It is a "forward
    back reference" and can be useful in repetitions
    (compare \g{-&lt;number&gt;} ). Perl does not recognize this syntax.
  * pcre2grep now automatically expands its buffer up to a maximum
    set by --max-buffer-size.
  * The -t option (grand total) has been added to pcre2grep.
  * A new function called pcre2_code_copy_with_tables() exists to
    copy a compiled pattern along with a private copy of the
    character tables that is uses.</changelog>
  <changelog author="astieger@suse.com" date="1493726400">- pcre2grep can now read .gz and .bz2 files directly
- pcre2test is now built to support line editing</changelog>
  <changelog author="astieger@suse.com" date="1501934400">- fix SLE 11 build</changelog>
  <changelog author="jengelh@inai.de" date="1505131200">- Update to new upstream release 10.30
  * The main interpreter, pcre2_match(), has been refactored into
    a new version that does not use recursive function calls for
    remembering backtracking positions. The new implementation
    allows backtracking into recursive group calls in patterns,
    making it more compatible with Perl. For patterns that have a
    lot of backtracking, the heap is now used, and there is
    explicit limit on the amount, settable by
    pcre2_set_heap_limit(). The "recursion limit" is retained,
    but is renamed as "depth limit".
  * The new option PCRE2_ENDANCHORED insists that a pattern match
    must end at the end of the subject.
  * The new option PCRE2_EXTENDED_MORE implements Perl's /xx
    feature, and pcre2test is upgraded to support it. Setting
    within the pattern by (?xx) is Also supported.
  * (?n) can be used to set PCRE2_NO_AUTO_CAPTURE, because Perl
    now has this.
  * Additional pattern compile options in the compile context are
    now available: PCRE2_EXTRA_ALLOW_SURROGATE_ESCAPES and
    PCRE2_EXTRA_BAD_ESCAPE_IS LITERAL.
  * The newline type PCRE2_NEWLINE_NUL is now available.
  * The match limit value now also applies to pcre2_dfa_match()
    as there are patterns that can use up a lot of resources
    without necessarily recursing very deeply.
  * Various minor security fixes found by fuzzers:
    + bsc#1037165: crash for forward reference in lookbehind with
    PCRE2_ANCHORED
    + CVE-2017-8786: heap-based buffer overflow write in pcre2test
    (bsc#1036942)
    + CVE-2017-7186: DoS by triggering an invalid Unicode property
    lookup (bsc#1030066)
- Switch source URLs to use HTTP.</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to new upstream release 10.31
  * New pcre2_config() options: PCRE2_CONFIG_NEVER_BACKSLASH_C and
    PCRE2_CONFIG_COMPILED_WIDTHS.
  * New pcre2_pattern_info() option PCRE2_INFO_EXTRAOPTIONS to
    retrieve the extra compile time options.
  * Public names for all pcre2_compile() error numbers.
  * Added PCRE2_CALLOUT_STARTMATCH and PCRE2_CALLOUT_BACKTRACK
    bits to a new field callout_flags in callout blocks.
- use https for main site
- cleanup with spec-cleaner</changelog>
  <changelog author="jsikes@suse.com" date="1627128000">- Added 0001-Fixed-atomic-group-backtracking-bug.patch
  * bsc#1187937
  * PHP 7.6.4 on s390x returns different results for preg_match
    function as compared to older PHP versions and x86
  * Sourced from upstream subversion commit:
    $ svn log -r965 svn://vcs.pcre.org/pcre2/code/trunk</changelog>
  <changelog author="jsikes@suse.com" date="1651924800">- Added pcre2-10.31-bsc1199232-unicode-property-matching.patch
  * bsc#1199232 / CVE-2022-1586
  * Fixes unicode property matching issue</changelog>
  <changelog author="jsikes@suse.com" date="1658232000">- Added pcre2-Fix_crash_when_X_is_used_without_UTF_in_JIT.patch
  * CVE-2019-20454 / bsc#1164384
  * Fix crash when \X is used in non-UTF mode on certain inputs.
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/342c16ecd31bd12fc350ee31d2dcc041832ebb3f
  - https://github.com/PCRE2Project/pcre2/commit/e118e60a68f03f38dd2ff3d16ca2e2e0d800e1d9</changelog>
  <changelog author="jsikes@suse.com" date="1658318400">- Added pcre2-bsc1199235-CVE-2022-1587.patch
  * CVE-2022-1587 / bsc#1199235
  * Fix out-of-bounds read due to bug in recursions
  * Sourced from:
  - https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0</changelog>
</package>
<package pkgid="68da19b348d6f54a51b745e5c6342db54126390099e3b21d069e93a93a1e9bf3" name="perl" arch="aarch64">
  <version epoch="0" ver="5.26.1" rel="150300.17.11.1"/>
  <changelog author="mls@suse.de" date="1462881600">- Update to perl-5.24.0
  * postfix dereferencing is no longer experimental
  * unicode 8.0 is now supported
  * perl will now croak when closing an in-place output file fails
  * new "\b{lb}" boundary in regular expressions
  * qr/(?[ ])/" now works in UTF-8 locales
  * integer shift ("&lt;&lt;" and "&gt;&gt;") now more explicitly defined
  * printf and sprintf now allow reordered precision arguments
  * more fields provided to "sigaction" callback with "SA_SIGINFO"
  * hashbang redirection to Perl 6
  * set proper umask before calling mkstemp(3)
  * fix loss of taint in canonpath
  * remove duplicate environment variables from "environ"
- rename patch perl-5.22.0.dif to perl-5.24.0.dif</changelog>
  <changelog author="idonmez@suse.com" date="1464868800">- Add perl-avoid-warnings.patch to fix a warning in cop.h, which
  breaks perf build due to -Werror. Already upstream.</changelog>
  <changelog author="schwab@suse.de" date="1466942400">- Move parent.pm to perl-base, used by File::Temp</changelog>
  <changelog author="coolo@suse.com" date="1493812800">- Update to perl-5.24.1
  - Di switch is now required for PerlIO debugging output
    Previously PerlIO debugging output would be sent to the file specified
    by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid
    and the -T or -t switches hadn't been parsed yet.
    If perl performed output at a point where it hadn't yet parsed its
    switches this could result in perl creating or overwriting the file
    named by "PERLIO_DEBUG" even when the -T switch had been supplied.
    Perl now requires the -Di switch to produce PerlIO debugging output. By
    default this is written to "stderr", but can optionally be redirected to
    a file by setting the "PERLIO_DEBUG" environment variable.
    If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG"
    is ignored and the debugging output is sent to "stderr" as for any other
  - D switch.
  Core modules and tools no longer search "." for optional modules
    The tools and many modules supplied in core no longer search the default
    current directory entry in @INC for optional modules. For example,
    Storable will remove the final "." from @INC before trying to load
    Log::Agent.
    This prevents an attacker injecting an optional module into a process
    run by another user where the current directory is writable by the
    attacker, e.g. the /tmp directory.
- Refresh patches</changelog>
  <changelog author="mpluskal@suse.com" date="1494417600">- Fix building with zlib-1.2.10 (RT#119762):
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108800">- Remove patch from previous commit, does not work:
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch
- Add patch taken from upstream release instead:
  * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="mls@suse.de" date="1504094400">- update to perl-5.26.0
  * "." no longer in @INC
  * "do" may now warn
  * regexp: a literal left brace "{" should be escaped
  * lexical subroutines are no longer experimental
  * indented Here-documents
  * new regular expression modifier /xx
  * declaring a reference to a variable
  * unicode 9.0 is now supported
  * new Hash Function For 64-bit Builds
- rename perl-5.24.0.dif to perl-5.26.0.dif
- remove obsolete perl-avoid-warnings.patch
- remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="coolo@suse.com" date="1506168000">- update to perl-5.26.1
  * [CVE-2017-12837] Heap buffer overflow in regular expression compiler
  * [CVE-2017-12883] Buffer over-read in regular expression parser
  * tons of bug fixes
- update list of obsoletes</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="bwiedemann@suse.com" date="1512388800">- Add perl-reproducible.patch to make build reproducible (boo#1047218)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1515585600">- ignore make check transient errors for PowerPC
  that are reported since 20170907
  bypass boo#1063176
  new patch: perl_skip_flaky_tests_powerpc.patch</changelog>
  <changelog author="schwab@suse.de" date="1516622400">- posix-sigaction.patch: make sure Perl_sighandler is always installed
  with SA_SIGINFO (bsc#1064697)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mls@suse.de" date="1530100800">- fix Archive::Tar directory traversal vulnerability [bnc#1096718]
  [CVE-2018-12015]
  new patch: perl-archive-tar-dirtrav.diff</changelog>
  <changelog author="mls@suse.de" date="1542801600">- fix heap-based buffer overflow in regex
  [bnc#1114686] [CVE-2018-18314]
  new patch: perl-extended-charclass-assert.diff
- fix heap-buffer-overflow read if regex contains \0 chars
  [bnc#1114681] [CVE-2018-18313]
  new patch: perl-regcomp-strchr-memchr.diff
- fix reg_node overrun
  [bnc#1114675] [CVE-2018-18312]
  new patch: perl-reg-node-overrun.diff
- fix integer overflow with oversize environment
  [bnc#1114674] [CVE-2018-18311]
  new patch: perl-setenv-integer-wrap.diff</changelog>
  <changelog author="mls@suse.de" date="1580904000">- Backport perl-fix2020.patch to make timelocal calls work in
  the year 2020 [bnc#1102840] [bnc#1160039]
  new patch: perl-fix2020.patch</changelog>
  <changelog author="mls@suse.de" date="1591704000">- Fix various security issues in the study_chunk function
  [bnc#1171863] [CVE-2020-10543]
  [bnc#1171864] [CVE-2020-10878]
  [bnc#1171866] [CVE-2020-12723]
  new patch: perl-study.diff
- Comment out bad warning in features.ph file [bnc#1172348]</changelog>
  <changelog author="mls@suse.de" date="1604059200">- Split DB_File module into a seperate perl-core-DB_File package
  [jsc#SLE-12212]
  * add Recommends: perl-core-DB_File to the perl package
- Fix build with newer glibc versions
  new patch: perl-saltbits.diff</changelog>
  <changelog author="ali.abdallah@suse.com" date="1648728000">- Stabilize Socket::VERSION comparisons [bnc#1193489]
  new patch: perl-Stabilize-Socket-VERSION-comparisons.patch</changelog>
  <changelog author="mls@suse.de" date="1662120000">- fix File::Path rmtree/remove_tree race condition
  [bnc#1047178] [CVE-2017-6512]
  new patch: perl-file_path_rmtree_fchmod.diff</changelog>
</package>
<package pkgid="3ebdfa6e357b8660f7cb53e25d5d69cd9fb3df46eb01b47b9f5c0309cf803d5a" name="perl" arch="src">
  <version epoch="0" ver="5.26.1" rel="150300.17.11.1"/>
  <changelog author="mls@suse.de" date="1462881600">- Update to perl-5.24.0
  * postfix dereferencing is no longer experimental
  * unicode 8.0 is now supported
  * perl will now croak when closing an in-place output file fails
  * new "\b{lb}" boundary in regular expressions
  * qr/(?[ ])/" now works in UTF-8 locales
  * integer shift ("&lt;&lt;" and "&gt;&gt;") now more explicitly defined
  * printf and sprintf now allow reordered precision arguments
  * more fields provided to "sigaction" callback with "SA_SIGINFO"
  * hashbang redirection to Perl 6
  * set proper umask before calling mkstemp(3)
  * fix loss of taint in canonpath
  * remove duplicate environment variables from "environ"
- rename patch perl-5.22.0.dif to perl-5.24.0.dif</changelog>
  <changelog author="idonmez@suse.com" date="1464868800">- Add perl-avoid-warnings.patch to fix a warning in cop.h, which
  breaks perf build due to -Werror. Already upstream.</changelog>
  <changelog author="schwab@suse.de" date="1466942400">- Move parent.pm to perl-base, used by File::Temp</changelog>
  <changelog author="coolo@suse.com" date="1493812800">- Update to perl-5.24.1
  - Di switch is now required for PerlIO debugging output
    Previously PerlIO debugging output would be sent to the file specified
    by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid
    and the -T or -t switches hadn't been parsed yet.
    If perl performed output at a point where it hadn't yet parsed its
    switches this could result in perl creating or overwriting the file
    named by "PERLIO_DEBUG" even when the -T switch had been supplied.
    Perl now requires the -Di switch to produce PerlIO debugging output. By
    default this is written to "stderr", but can optionally be redirected to
    a file by setting the "PERLIO_DEBUG" environment variable.
    If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG"
    is ignored and the debugging output is sent to "stderr" as for any other
  - D switch.
  Core modules and tools no longer search "." for optional modules
    The tools and many modules supplied in core no longer search the default
    current directory entry in @INC for optional modules. For example,
    Storable will remove the final "." from @INC before trying to load
    Log::Agent.
    This prevents an attacker injecting an optional module into a process
    run by another user where the current directory is writable by the
    attacker, e.g. the /tmp directory.
- Refresh patches</changelog>
  <changelog author="mpluskal@suse.com" date="1494417600">- Fix building with zlib-1.2.10 (RT#119762):
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108800">- Remove patch from previous commit, does not work:
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch
- Add patch taken from upstream release instead:
  * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="mls@suse.de" date="1504094400">- update to perl-5.26.0
  * "." no longer in @INC
  * "do" may now warn
  * regexp: a literal left brace "{" should be escaped
  * lexical subroutines are no longer experimental
  * indented Here-documents
  * new regular expression modifier /xx
  * declaring a reference to a variable
  * unicode 9.0 is now supported
  * new Hash Function For 64-bit Builds
- rename perl-5.24.0.dif to perl-5.26.0.dif
- remove obsolete perl-avoid-warnings.patch
- remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="coolo@suse.com" date="1506168000">- update to perl-5.26.1
  * [CVE-2017-12837] Heap buffer overflow in regular expression compiler
  * [CVE-2017-12883] Buffer over-read in regular expression parser
  * tons of bug fixes
- update list of obsoletes</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="bwiedemann@suse.com" date="1512388800">- Add perl-reproducible.patch to make build reproducible (boo#1047218)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1515585600">- ignore make check transient errors for PowerPC
  that are reported since 20170907
  bypass boo#1063176
  new patch: perl_skip_flaky_tests_powerpc.patch</changelog>
  <changelog author="schwab@suse.de" date="1516622400">- posix-sigaction.patch: make sure Perl_sighandler is always installed
  with SA_SIGINFO (bsc#1064697)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mls@suse.de" date="1530100800">- fix Archive::Tar directory traversal vulnerability [bnc#1096718]
  [CVE-2018-12015]
  new patch: perl-archive-tar-dirtrav.diff</changelog>
  <changelog author="mls@suse.de" date="1542801600">- fix heap-based buffer overflow in regex
  [bnc#1114686] [CVE-2018-18314]
  new patch: perl-extended-charclass-assert.diff
- fix heap-buffer-overflow read if regex contains \0 chars
  [bnc#1114681] [CVE-2018-18313]
  new patch: perl-regcomp-strchr-memchr.diff
- fix reg_node overrun
  [bnc#1114675] [CVE-2018-18312]
  new patch: perl-reg-node-overrun.diff
- fix integer overflow with oversize environment
  [bnc#1114674] [CVE-2018-18311]
  new patch: perl-setenv-integer-wrap.diff</changelog>
  <changelog author="mls@suse.de" date="1580904000">- Backport perl-fix2020.patch to make timelocal calls work in
  the year 2020 [bnc#1102840] [bnc#1160039]
  new patch: perl-fix2020.patch</changelog>
  <changelog author="mls@suse.de" date="1591704000">- Fix various security issues in the study_chunk function
  [bnc#1171863] [CVE-2020-10543]
  [bnc#1171864] [CVE-2020-10878]
  [bnc#1171866] [CVE-2020-12723]
  new patch: perl-study.diff
- Comment out bad warning in features.ph file [bnc#1172348]</changelog>
  <changelog author="mls@suse.de" date="1604059200">- Split DB_File module into a seperate perl-core-DB_File package
  [jsc#SLE-12212]
  * add Recommends: perl-core-DB_File to the perl package
- Fix build with newer glibc versions
  new patch: perl-saltbits.diff</changelog>
  <changelog author="ali.abdallah@suse.com" date="1648728000">- Stabilize Socket::VERSION comparisons [bnc#1193489]
  new patch: perl-Stabilize-Socket-VERSION-comparisons.patch</changelog>
  <changelog author="mls@suse.de" date="1662120000">- fix File::Path rmtree/remove_tree race condition
  [bnc#1047178] [CVE-2017-6512]
  new patch: perl-file_path_rmtree_fchmod.diff</changelog>
</package>
<package pkgid="e4f3ac9c1716596d0ee4dba3dd793bbe3c2202c33faf172d91b67ff1fcc83f5b" name="perl" arch="x86_64">
  <version epoch="0" ver="5.26.1" rel="150300.17.11.1"/>
  <changelog author="mls@suse.de" date="1462881600">- Update to perl-5.24.0
  * postfix dereferencing is no longer experimental
  * unicode 8.0 is now supported
  * perl will now croak when closing an in-place output file fails
  * new "\b{lb}" boundary in regular expressions
  * qr/(?[ ])/" now works in UTF-8 locales
  * integer shift ("&lt;&lt;" and "&gt;&gt;") now more explicitly defined
  * printf and sprintf now allow reordered precision arguments
  * more fields provided to "sigaction" callback with "SA_SIGINFO"
  * hashbang redirection to Perl 6
  * set proper umask before calling mkstemp(3)
  * fix loss of taint in canonpath
  * remove duplicate environment variables from "environ"
- rename patch perl-5.22.0.dif to perl-5.24.0.dif</changelog>
  <changelog author="idonmez@suse.com" date="1464868800">- Add perl-avoid-warnings.patch to fix a warning in cop.h, which
  breaks perf build due to -Werror. Already upstream.</changelog>
  <changelog author="schwab@suse.de" date="1466942400">- Move parent.pm to perl-base, used by File::Temp</changelog>
  <changelog author="coolo@suse.com" date="1493812800">- Update to perl-5.24.1
  - Di switch is now required for PerlIO debugging output
    Previously PerlIO debugging output would be sent to the file specified
    by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid
    and the -T or -t switches hadn't been parsed yet.
    If perl performed output at a point where it hadn't yet parsed its
    switches this could result in perl creating or overwriting the file
    named by "PERLIO_DEBUG" even when the -T switch had been supplied.
    Perl now requires the -Di switch to produce PerlIO debugging output. By
    default this is written to "stderr", but can optionally be redirected to
    a file by setting the "PERLIO_DEBUG" environment variable.
    If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG"
    is ignored and the debugging output is sent to "stderr" as for any other
  - D switch.
  Core modules and tools no longer search "." for optional modules
    The tools and many modules supplied in core no longer search the default
    current directory entry in @INC for optional modules. For example,
    Storable will remove the final "." from @INC before trying to load
    Log::Agent.
    This prevents an attacker injecting an optional module into a process
    run by another user where the current directory is writable by the
    attacker, e.g. the /tmp directory.
- Refresh patches</changelog>
  <changelog author="mpluskal@suse.com" date="1494417600">- Fix building with zlib-1.2.10 (RT#119762):
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108800">- Remove patch from previous commit, does not work:
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch
- Add patch taken from upstream release instead:
  * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="mls@suse.de" date="1504094400">- update to perl-5.26.0
  * "." no longer in @INC
  * "do" may now warn
  * regexp: a literal left brace "{" should be escaped
  * lexical subroutines are no longer experimental
  * indented Here-documents
  * new regular expression modifier /xx
  * declaring a reference to a variable
  * unicode 9.0 is now supported
  * new Hash Function For 64-bit Builds
- rename perl-5.24.0.dif to perl-5.26.0.dif
- remove obsolete perl-avoid-warnings.patch
- remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="coolo@suse.com" date="1506168000">- update to perl-5.26.1
  * [CVE-2017-12837] Heap buffer overflow in regular expression compiler
  * [CVE-2017-12883] Buffer over-read in regular expression parser
  * tons of bug fixes
- update list of obsoletes</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="bwiedemann@suse.com" date="1512388800">- Add perl-reproducible.patch to make build reproducible (boo#1047218)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1515585600">- ignore make check transient errors for PowerPC
  that are reported since 20170907
  bypass boo#1063176
  new patch: perl_skip_flaky_tests_powerpc.patch</changelog>
  <changelog author="schwab@suse.de" date="1516622400">- posix-sigaction.patch: make sure Perl_sighandler is always installed
  with SA_SIGINFO (bsc#1064697)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mls@suse.de" date="1530100800">- fix Archive::Tar directory traversal vulnerability [bnc#1096718]
  [CVE-2018-12015]
  new patch: perl-archive-tar-dirtrav.diff</changelog>
  <changelog author="mls@suse.de" date="1542801600">- fix heap-based buffer overflow in regex
  [bnc#1114686] [CVE-2018-18314]
  new patch: perl-extended-charclass-assert.diff
- fix heap-buffer-overflow read if regex contains \0 chars
  [bnc#1114681] [CVE-2018-18313]
  new patch: perl-regcomp-strchr-memchr.diff
- fix reg_node overrun
  [bnc#1114675] [CVE-2018-18312]
  new patch: perl-reg-node-overrun.diff
- fix integer overflow with oversize environment
  [bnc#1114674] [CVE-2018-18311]
  new patch: perl-setenv-integer-wrap.diff</changelog>
  <changelog author="mls@suse.de" date="1580904000">- Backport perl-fix2020.patch to make timelocal calls work in
  the year 2020 [bnc#1102840] [bnc#1160039]
  new patch: perl-fix2020.patch</changelog>
  <changelog author="mls@suse.de" date="1591704000">- Fix various security issues in the study_chunk function
  [bnc#1171863] [CVE-2020-10543]
  [bnc#1171864] [CVE-2020-10878]
  [bnc#1171866] [CVE-2020-12723]
  new patch: perl-study.diff
- Comment out bad warning in features.ph file [bnc#1172348]</changelog>
  <changelog author="mls@suse.de" date="1604059200">- Split DB_File module into a seperate perl-core-DB_File package
  [jsc#SLE-12212]
  * add Recommends: perl-core-DB_File to the perl package
- Fix build with newer glibc versions
  new patch: perl-saltbits.diff</changelog>
  <changelog author="ali.abdallah@suse.com" date="1648728000">- Stabilize Socket::VERSION comparisons [bnc#1193489]
  new patch: perl-Stabilize-Socket-VERSION-comparisons.patch</changelog>
  <changelog author="mls@suse.de" date="1662120000">- fix File::Path rmtree/remove_tree race condition
  [bnc#1047178] [CVE-2017-6512]
  new patch: perl-file_path_rmtree_fchmod.diff</changelog>
</package>
<package pkgid="afdaddf9feeb4fd1c2970dbe5bce9bc0f64b598e41bdc1e1cf135c719113dcc7" name="perl-base" arch="aarch64">
  <version epoch="0" ver="5.26.1" rel="150300.17.11.1"/>
  <changelog author="mls@suse.de" date="1462881600">- Update to perl-5.24.0
  * postfix dereferencing is no longer experimental
  * unicode 8.0 is now supported
  * perl will now croak when closing an in-place output file fails
  * new "\b{lb}" boundary in regular expressions
  * qr/(?[ ])/" now works in UTF-8 locales
  * integer shift ("&lt;&lt;" and "&gt;&gt;") now more explicitly defined
  * printf and sprintf now allow reordered precision arguments
  * more fields provided to "sigaction" callback with "SA_SIGINFO"
  * hashbang redirection to Perl 6
  * set proper umask before calling mkstemp(3)
  * fix loss of taint in canonpath
  * remove duplicate environment variables from "environ"
- rename patch perl-5.22.0.dif to perl-5.24.0.dif</changelog>
  <changelog author="idonmez@suse.com" date="1464868800">- Add perl-avoid-warnings.patch to fix a warning in cop.h, which
  breaks perf build due to -Werror. Already upstream.</changelog>
  <changelog author="schwab@suse.de" date="1466942400">- Move parent.pm to perl-base, used by File::Temp</changelog>
  <changelog author="coolo@suse.com" date="1493812800">- Update to perl-5.24.1
  - Di switch is now required for PerlIO debugging output
    Previously PerlIO debugging output would be sent to the file specified
    by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid
    and the -T or -t switches hadn't been parsed yet.
    If perl performed output at a point where it hadn't yet parsed its
    switches this could result in perl creating or overwriting the file
    named by "PERLIO_DEBUG" even when the -T switch had been supplied.
    Perl now requires the -Di switch to produce PerlIO debugging output. By
    default this is written to "stderr", but can optionally be redirected to
    a file by setting the "PERLIO_DEBUG" environment variable.
    If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG"
    is ignored and the debugging output is sent to "stderr" as for any other
  - D switch.
  Core modules and tools no longer search "." for optional modules
    The tools and many modules supplied in core no longer search the default
    current directory entry in @INC for optional modules. For example,
    Storable will remove the final "." from @INC before trying to load
    Log::Agent.
    This prevents an attacker injecting an optional module into a process
    run by another user where the current directory is writable by the
    attacker, e.g. the /tmp directory.
- Refresh patches</changelog>
  <changelog author="mpluskal@suse.com" date="1494417600">- Fix building with zlib-1.2.10 (RT#119762):
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108800">- Remove patch from previous commit, does not work:
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch
- Add patch taken from upstream release instead:
  * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="mls@suse.de" date="1504094400">- update to perl-5.26.0
  * "." no longer in @INC
  * "do" may now warn
  * regexp: a literal left brace "{" should be escaped
  * lexical subroutines are no longer experimental
  * indented Here-documents
  * new regular expression modifier /xx
  * declaring a reference to a variable
  * unicode 9.0 is now supported
  * new Hash Function For 64-bit Builds
- rename perl-5.24.0.dif to perl-5.26.0.dif
- remove obsolete perl-avoid-warnings.patch
- remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="coolo@suse.com" date="1506168000">- update to perl-5.26.1
  * [CVE-2017-12837] Heap buffer overflow in regular expression compiler
  * [CVE-2017-12883] Buffer over-read in regular expression parser
  * tons of bug fixes
- update list of obsoletes</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="bwiedemann@suse.com" date="1512388800">- Add perl-reproducible.patch to make build reproducible (boo#1047218)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1515585600">- ignore make check transient errors for PowerPC
  that are reported since 20170907
  bypass boo#1063176
  new patch: perl_skip_flaky_tests_powerpc.patch</changelog>
  <changelog author="schwab@suse.de" date="1516622400">- posix-sigaction.patch: make sure Perl_sighandler is always installed
  with SA_SIGINFO (bsc#1064697)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mls@suse.de" date="1530100800">- fix Archive::Tar directory traversal vulnerability [bnc#1096718]
  [CVE-2018-12015]
  new patch: perl-archive-tar-dirtrav.diff</changelog>
  <changelog author="mls@suse.de" date="1542801600">- fix heap-based buffer overflow in regex
  [bnc#1114686] [CVE-2018-18314]
  new patch: perl-extended-charclass-assert.diff
- fix heap-buffer-overflow read if regex contains \0 chars
  [bnc#1114681] [CVE-2018-18313]
  new patch: perl-regcomp-strchr-memchr.diff
- fix reg_node overrun
  [bnc#1114675] [CVE-2018-18312]
  new patch: perl-reg-node-overrun.diff
- fix integer overflow with oversize environment
  [bnc#1114674] [CVE-2018-18311]
  new patch: perl-setenv-integer-wrap.diff</changelog>
  <changelog author="mls@suse.de" date="1580904000">- Backport perl-fix2020.patch to make timelocal calls work in
  the year 2020 [bnc#1102840] [bnc#1160039]
  new patch: perl-fix2020.patch</changelog>
  <changelog author="mls@suse.de" date="1591704000">- Fix various security issues in the study_chunk function
  [bnc#1171863] [CVE-2020-10543]
  [bnc#1171864] [CVE-2020-10878]
  [bnc#1171866] [CVE-2020-12723]
  new patch: perl-study.diff
- Comment out bad warning in features.ph file [bnc#1172348]</changelog>
  <changelog author="mls@suse.de" date="1604059200">- Split DB_File module into a seperate perl-core-DB_File package
  [jsc#SLE-12212]
  * add Recommends: perl-core-DB_File to the perl package
- Fix build with newer glibc versions
  new patch: perl-saltbits.diff</changelog>
  <changelog author="ali.abdallah@suse.com" date="1648728000">- Stabilize Socket::VERSION comparisons [bnc#1193489]
  new patch: perl-Stabilize-Socket-VERSION-comparisons.patch</changelog>
  <changelog author="mls@suse.de" date="1662120000">- fix File::Path rmtree/remove_tree race condition
  [bnc#1047178] [CVE-2017-6512]
  new patch: perl-file_path_rmtree_fchmod.diff</changelog>
</package>
<package pkgid="9035f8fb681ddde40e1524cc2adb6f386c5629bff44f6729fd9453cb8d142e9f" name="perl-base" arch="x86_64">
  <version epoch="0" ver="5.26.1" rel="150300.17.11.1"/>
  <changelog author="mls@suse.de" date="1462881600">- Update to perl-5.24.0
  * postfix dereferencing is no longer experimental
  * unicode 8.0 is now supported
  * perl will now croak when closing an in-place output file fails
  * new "\b{lb}" boundary in regular expressions
  * qr/(?[ ])/" now works in UTF-8 locales
  * integer shift ("&lt;&lt;" and "&gt;&gt;") now more explicitly defined
  * printf and sprintf now allow reordered precision arguments
  * more fields provided to "sigaction" callback with "SA_SIGINFO"
  * hashbang redirection to Perl 6
  * set proper umask before calling mkstemp(3)
  * fix loss of taint in canonpath
  * remove duplicate environment variables from "environ"
- rename patch perl-5.22.0.dif to perl-5.24.0.dif</changelog>
  <changelog author="idonmez@suse.com" date="1464868800">- Add perl-avoid-warnings.patch to fix a warning in cop.h, which
  breaks perf build due to -Werror. Already upstream.</changelog>
  <changelog author="schwab@suse.de" date="1466942400">- Move parent.pm to perl-base, used by File::Temp</changelog>
  <changelog author="coolo@suse.com" date="1493812800">- Update to perl-5.24.1
  - Di switch is now required for PerlIO debugging output
    Previously PerlIO debugging output would be sent to the file specified
    by the "PERLIO_DEBUG" environment variable if perl wasn't running setuid
    and the -T or -t switches hadn't been parsed yet.
    If perl performed output at a point where it hadn't yet parsed its
    switches this could result in perl creating or overwriting the file
    named by "PERLIO_DEBUG" even when the -T switch had been supplied.
    Perl now requires the -Di switch to produce PerlIO debugging output. By
    default this is written to "stderr", but can optionally be redirected to
    a file by setting the "PERLIO_DEBUG" environment variable.
    If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG"
    is ignored and the debugging output is sent to "stderr" as for any other
  - D switch.
  Core modules and tools no longer search "." for optional modules
    The tools and many modules supplied in core no longer search the default
    current directory entry in @INC for optional modules. For example,
    Storable will remove the final "." from @INC before trying to load
    Log::Agent.
    This prevents an attacker injecting an optional module into a process
    run by another user where the current directory is writable by the
    attacker, e.g. the /tmp directory.
- Refresh patches</changelog>
  <changelog author="mpluskal@suse.com" date="1494417600">- Fix building with zlib-1.2.10 (RT#119762):
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1495108800">- Remove patch from previous commit, does not work:
  * Compress-Raw-Zlib-2.071-Adapt-tests-to-zlib-1.2.11.patch
- Add patch taken from upstream release instead:
  * Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="mls@suse.de" date="1504094400">- update to perl-5.26.0
  * "." no longer in @INC
  * "do" may now warn
  * regexp: a literal left brace "{" should be escaped
  * lexical subroutines are no longer experimental
  * indented Here-documents
  * new regular expression modifier /xx
  * declaring a reference to a variable
  * unicode 9.0 is now supported
  * new Hash Function For 64-bit Builds
- rename perl-5.24.0.dif to perl-5.26.0.dif
- remove obsolete perl-avoid-warnings.patch
- remove obsolete Compress-Raw-Zlib-2.071-zlib-1.2.11.patch</changelog>
  <changelog author="coolo@suse.com" date="1506168000">- update to perl-5.26.1
  * [CVE-2017-12837] Heap buffer overflow in regular expression compiler
  * [CVE-2017-12883] Buffer over-read in regular expression parser
  * tons of bug fixes
- update list of obsoletes</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="bwiedemann@suse.com" date="1512388800">- Add perl-reproducible.patch to make build reproducible (boo#1047218)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1515585600">- ignore make check transient errors for PowerPC
  that are reported since 20170907
  bypass boo#1063176
  new patch: perl_skip_flaky_tests_powerpc.patch</changelog>
  <changelog author="schwab@suse.de" date="1516622400">- posix-sigaction.patch: make sure Perl_sighandler is always installed
  with SA_SIGINFO (bsc#1064697)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mls@suse.de" date="1530100800">- fix Archive::Tar directory traversal vulnerability [bnc#1096718]
  [CVE-2018-12015]
  new patch: perl-archive-tar-dirtrav.diff</changelog>
  <changelog author="mls@suse.de" date="1542801600">- fix heap-based buffer overflow in regex
  [bnc#1114686] [CVE-2018-18314]
  new patch: perl-extended-charclass-assert.diff
- fix heap-buffer-overflow read if regex contains \0 chars
  [bnc#1114681] [CVE-2018-18313]
  new patch: perl-regcomp-strchr-memchr.diff
- fix reg_node overrun
  [bnc#1114675] [CVE-2018-18312]
  new patch: perl-reg-node-overrun.diff
- fix integer overflow with oversize environment
  [bnc#1114674] [CVE-2018-18311]
  new patch: perl-setenv-integer-wrap.diff</changelog>
  <changelog author="mls@suse.de" date="1580904000">- Backport perl-fix2020.patch to make timelocal calls work in
  the year 2020 [bnc#1102840] [bnc#1160039]
  new patch: perl-fix2020.patch</changelog>
  <changelog author="mls@suse.de" date="1591704000">- Fix various security issues in the study_chunk function
  [bnc#1171863] [CVE-2020-10543]
  [bnc#1171864] [CVE-2020-10878]
  [bnc#1171866] [CVE-2020-12723]
  new patch: perl-study.diff
- Comment out bad warning in features.ph file [bnc#1172348]</changelog>
  <changelog author="mls@suse.de" date="1604059200">- Split DB_File module into a seperate perl-core-DB_File package
  [jsc#SLE-12212]
  * add Recommends: perl-core-DB_File to the perl package
- Fix build with newer glibc versions
  new patch: perl-saltbits.diff</changelog>
  <changelog author="ali.abdallah@suse.com" date="1648728000">- Stabilize Socket::VERSION comparisons [bnc#1193489]
  new patch: perl-Stabilize-Socket-VERSION-comparisons.patch</changelog>
  <changelog author="mls@suse.de" date="1662120000">- fix File::Path rmtree/remove_tree race condition
  [bnc#1047178] [CVE-2017-6512]
  new patch: perl-file_path_rmtree_fchmod.diff</changelog>
</package>
<package pkgid="67710128890ab85c89c481142b03caed9aedd92c6e203ac671997f65c241b889" name="permissions" arch="aarch64">
  <version epoch="0" ver="20181225" rel="150200.23.15.1"/>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
</package>
<package pkgid="93af9f68d0e48fc284532931ddda9e942bff5d8c0b3eb198d2182087ea86841c" name="permissions" arch="src">
  <version epoch="0" ver="20181225" rel="150200.23.15.1"/>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
</package>
<package pkgid="5d025d4b5f900ac5de9b9cda3baea1e3e8128c084eba299e59eeb81840ff23f3" name="permissions" arch="x86_64">
  <version epoch="0" ver="20181225" rel="150200.23.15.1"/>
  <changelog author="malte.kraus@suse.com" date="1560427200">- Added ./0005-singularity-starter-suid.patch (bsc#1128598)
  New whitelisting for /usr/lib/singularity/bin/starter-suid</changelog>
  <changelog author="jsegitz@suse.com" date="1569499200">- Updated permissons for amanda, added 0006-bsc1110797_amanda.patch
  (bsc#1110797)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
</package>
<package pkgid="dddd6a2a79b2e5c6b3e4905af3c4726f9118ce48d878fc2f17ea81a832a8f88a" name="permissions" arch="aarch64">
  <version epoch="0" ver="20181225" rel="150200.23.20.1"/>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665489600">- Update to version 20181225:
  * fix regression introduced by backport of security fix (bsc#1203911)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665576000">- Update to version 20181225:
  * Revert "drop ping capabilities in favor of ICMP_PROTO sockets". Older
    SLE-15 versions don't properly support this feature yet (bsc#1204137)</changelog>
</package>
<package pkgid="99a3fbe991d78d18ce89078be90b326235992af5165810bbbab15f9aafb99276" name="permissions" arch="src">
  <version epoch="0" ver="20181225" rel="150200.23.20.1"/>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665489600">- Update to version 20181225:
  * fix regression introduced by backport of security fix (bsc#1203911)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665576000">- Update to version 20181225:
  * Revert "drop ping capabilities in favor of ICMP_PROTO sockets". Older
    SLE-15 versions don't properly support this feature yet (bsc#1204137)</changelog>
</package>
<package pkgid="45f2531ebb5796500b005ce33f029560533fd46389f18c79f20f66f9ec97206c" name="permissions" arch="x86_64">
  <version epoch="0" ver="20181225" rel="150200.23.20.1"/>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix privilege escalation through untrusted symlinks (bsc#1150734,
  CVE-2019-3690, 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1572264001">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665489600">- Update to version 20181225:
  * fix regression introduced by backport of security fix (bsc#1203911)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665576000">- Update to version 20181225:
  * Revert "drop ping capabilities in favor of ICMP_PROTO sockets". Older
    SLE-15 versions don't properly support this feature yet (bsc#1204137)</changelog>
</package>
<package pkgid="6c8794b9de534ff26a4c1f62687218e22116f32dd57aed3adce9bc21075c8dbc" name="permissions" arch="aarch64">
  <version epoch="0" ver="20181225" rel="150200.23.23.1"/>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665489600">- Update to version 20181225:
  * fix regression introduced by backport of security fix (bsc#1203911)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665576000">- Update to version 20181225:
  * Revert "drop ping capabilities in favor of ICMP_PROTO sockets". Older
    SLE-15 versions don't properly support this feature yet (bsc#1204137)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1672747200">- Update to version 20181225:
  * Backport postfix to SLE-15-SP2 (bsc#1206738)</changelog>
</package>
<package pkgid="510f7a773e1821c2131f2d067d97df11ad11275f083e5df0e3feb2aaab2be686" name="permissions" arch="src">
  <version epoch="0" ver="20181225" rel="150200.23.23.1"/>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665489600">- Update to version 20181225:
  * fix regression introduced by backport of security fix (bsc#1203911)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665576000">- Update to version 20181225:
  * Revert "drop ping capabilities in favor of ICMP_PROTO sockets". Older
    SLE-15 versions don't properly support this feature yet (bsc#1204137)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1672747200">- Update to version 20181225:
  * Backport postfix to SLE-15-SP2 (bsc#1206738)</changelog>
</package>
<package pkgid="80f37874192abd1a80c34057e44963238c2e7ac63b0a7d05c84c705658244c5b" name="permissions" arch="x86_64">
  <version epoch="0" ver="20181225" rel="150200.23.23.1"/>
  <changelog author="malte.kraus@suse.com" date="1572264000">- fix /usr/sbin/pinger ownership to root:squid (bsc#1093414,
  CVE-2019-3688, 0008-squid-pinger-owner-fix-CVE-2019-3688.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1574164800">- fix invalid free() when permfiles points to argv (bsc#1157198,
  changed 0007-chkstat-fix-privesc-CVE-2019-3690.patch)</changelog>
  <changelog author="malte.kraus@suse.com" date="1580472000">- fix regression where chkstat breaks without /proc available
  (bsc#1160764, bsc#1160594, 0009-chkstat-handle-missing-proc.patch)
- fix capability handling when doing multiple permission changes
  at once (bsc#1161779,
  0010-chkstat-capabilities-implicit-changes.patch)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580904000">Sync upstream SLE-15-SP1 branch with our SLE-15-SP1:Update package. Therefore
  remove all of the following patches which are now included in the tarball:
- 0001-whitelisting-update-virtualbox.patch
- 0002-consistency-between-profiles.patch 0003-var-run-postgresql.patch
- 0004-var-cache-man.patch
- 0005-singularity-starter-suid.patch
- 0006-bsc1110797_amanda.patch
- 0007-chkstat-fix-privesc-CVE-2019-3690.patch
- 0008-squid-pinger-owner-fix-CVE-2019-3688.patch
- 0009-chkstat-handle-missing-proc.patch
- 0010-chkstat-capabilities-implicit-changes.patch
  Because of inconsistencies between the upstream branch and the package state
  the following previously missing changes are introduced by this update:
- Update to version 20181117:
  * removed old entry for rmtab
  * Fixed typo in icinga2 whitelist entry</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1580990400">- Update to version 20181224:
  * mariadb: settings for new auth_pam_tool (bsc#1160285)
  * chkstat: capability handling fixes (bsc#1161779)
  * chkstat: fix regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594)
  * dumpcap: remove 'other' executable bit because of capabilities (boo#1148788, CVE-2019-3687)</changelog>
  <changelog author="malte.kraus@suse.com" date="1582891200">- Update to version 20181224:
  * whitelist WMP (bsc#1161335)
  * Makefile: allow to build test version programmatically
  * chkstat: handle symlinks in final path elements correctly
  * add .gitignore for chkstat binary
  * faxq-helper: correct "secure" permission for trusted group (bsc#1157498)
  * fix syntax of paranoid profile</changelog>
  <changelog author="malte.kraus@suse.com" date="1583150400">- run testsuite during package build
- Update to version 20181224:
  * testsuite: adapt expected behavior to legacy branches
  * adjust testsuite to post CVE-2020-8013 link handling
  * testsuite: add option to not mount /proc
  * do not follow symlinks that are the final path element: CVE-2020-8013, bsc#1163922
  * add a test for symlinked directories
  * fix relative symlink handling
  * regtest: fix the static PATH list which was missing /usr/bin
  * regtest: also unshare the PID namespace to support /proc mounting
  * Makefile: force remove upon clean target to prevent bogus errors
  * regtest: by default automatically (re)build chkstat before testing
  * regtest: add test for symlink targets
  * regtest: make capability setting tests optional
  * regtest: fix capability assertion helper logic
  * regtests: add another test case that catches set*id or caps in world-writable sub-trees
  * regtest: add another test that catches when privilege bits are set for special files
  * regtest: add test case for user owned symlinks
  * regtest: employ subuid and subgid feature in user namespace
  * regtest: add another test case that covers unknown user/group config
  * regtest: add another test that checks rejection of insecure mixed-owner paths
  * regtest: add test that checks for rejection of world-writable paths
  * regtest: add test for detection of unexpected parent directory ownership
  * regtest: add further helper functions, allow access to main instance
  * regtest: introduce some basic coloring support to improve readability
  * regtest: sort imports, another piece of rationale
  * regtest: add capability test case
  * regtest: improve error flagging of test cases and introduce warnings
  * regtest: support caps
  * regtest: add a couple of command line parameter test cases
  * regtest: add another test that checks whether the default profile works
  * regtests: add tests for correct application of local profiles
  * regtest: add further test cases that test correct profile application
  * regtest: simplify test implementation and readability
  * regtest: add helpers for permissions.d per package profiles
  * regtest: support read-only bind mounts, also bind-mount permissions repo
  * tests: introduce a regression test suite for chkstat</changelog>
  <changelog author="jsegitz@suse.com" date="1585051200">- whitelist s390-tools setgid bit on log directory (bsc#1167163)</changelog>
  <changelog author="jsegitz@suse.com" date="1585828800">- correct spelling of icinga group (icingagmd -&gt; icingacmd, bsc#1168364)</changelog>
  <changelog author="jsegitz@suse.com" date="1589198400">- Remove setuid bit for newgidmap and newuidmap in paranoid profile
  (bsc#1171173)</changelog>
  <changelog author="malte.kraus@suse.com" date="1590667200">- whitelist texlive public binary (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1591099200">- Update to version 20181224:
  * profiles: add entries for enlightenment (bsc#1171686)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1611230400">- Update to version 20181224:
  * pcp: remove no longer needed / conflicting entries
    (bsc#1171883, CVE-2020-8025)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619784000">- Update to version 20181225:
  * etc/permissions: remove unnecessary entries (bsc#1182899)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1640174400">- Update to version 20181225:
  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)</changelog>
  <changelog author="jsegitz@suse.com" date="1642161600">- Update to version 20181225:
  * setuid bit for cockpit session binary (bsc#1169614)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1663070400">- Update to version 20181225:
  * chkstat: also consider group controlled paths (bsc#1203018, CVE-2022-31252)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665489600">- Update to version 20181225:
  * fix regression introduced by backport of security fix (bsc#1203911)</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1665576000">- Update to version 20181225:
  * Revert "drop ping capabilities in favor of ICMP_PROTO sockets". Older
    SLE-15 versions don't properly support this feature yet (bsc#1204137)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1672747200">- Update to version 20181225:
  * Backport postfix to SLE-15-SP2 (bsc#1206738)</changelog>
</package>
<package pkgid="08f542e59af1b5367dd4c881e1666f4c496397dc5c3ecd0870e44cd4cc766237" name="pixman" arch="src">
  <version epoch="0" ver="0.34.0" rel="150000.7.5.1"/>
  <changelog author="vuntz@opensuse.org" date="1328788800">- Update to version 0.24.4:
  + Trapezoids that have gaps between the edges and the top/bottom
    lines are no longer considered invalid.
  + Basic support for using the NEON acceleration on iOS.</changelog>
  <changelog author="jengelh@medozas.de" date="1332417600">- Parallel build with %_smp_mflags; remove redundant sections</changelog>
  <changelog author="guillaume@opensuse.org" date="1339243200">- Fix ARM build:
  + Disable iwmmxt since our ARM SoC does not support it.
  + Add new armv7hl to armv7*</changelog>
  <changelog author="dimstar@opensuse.org" date="1340280000">- Update to version 0.26.0:
  + New support for MIPS DSPr2 ASE.
  + Improved performance with the iwMMXt instruction set.
  + New support for the  Loongson SIMD instruction set.
  + Several bugs fixed.
  + Cleanups.
  + Performance improvements.</changelog>
  <changelog author="dimstar@opensuse.org" date="1342872000">- Update to version 0.26.2:
  + Some bug fixes.
  + Custom build rules for ARM/iwMMXt.
  + An important bug fix for MMX/x86.</changelog>
  <changelog author="hrvoje.senjan@gmail.com" date="1352462400">- Update to version 0.28.0:
  + Support for sRGB coded images.
  + New API for fast glyph rendering.
  + Faster bilinear scaling on iwMMX, Loongson and MMX.
  + More fast paths in the MIPS DSPr2 backend.
  + Faster scaling in general and on SSE2 in particular.</changelog>
  <changelog author="vuntz@opensuse.org" date="1355227200">- Update to version 0.28.2:
  + Fixes for 64 bit Windows, clang, and PowerPC on MacOS and
    OpenBSD.</changelog>
  <changelog author="dimstar@opensuse.org" date="1368100800">- Update to version 0.30.0:
  + Support for high-quality image downscaling.
  + Much improved ARMv6 assembly.
  + Improved rendering quality for gradients.
  + Improvements to the SSE2 backend.
  + Improvements to MIPS DSPr2 backend.
  + Improvements to test suite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1375876800">- Update to version 0.30.2:
  + Require GTK+ version &gt;= 2.16.
  + Use AC_LINK_IFELSE to check if the Loongson MMI code can link.
  + configure.ac: Don't use '+=' since it's not POSIX.
  + test:
  - Fix build on MSVC.
  - fix matrix-test on big endian systems.
  + Fix broken build when HAVE_CONFIG_H is undefined, e.g. on
    Win32.</changelog>
  <changelog author="dmueller@suse.com" date="1382184000">- Disable neon on all %arm platforms.</changelog>
  <changelog author="dimstar@opensuse.org" date="1384776000">- Update to version 0.32.4:
  + Fix the SSSE3 CPUID detection.
- Changes from version 0.32.2:
  + Build fixes.
- Changes from version 0.32.0:
  + This release contains performance improvements to bilinear
    scaling, and a large number of bug fixes.</changelog>
  <changelog author="fcrozat@suse.com" date="1402056000">- RENDER extension hotfix: Add --disable-vmx for PPC64LE.
  This makes the RENDER extension work for the time being.
  Proper fix for vmx will come later (bnc#876757) (from Egbert
  Eich).</changelog>
  <changelog author="dimstar@opensuse.org" date="1404993600">- Update to version 0.32.6:
  + MIPS: Fix exported symbols in public API.
  + build: Check if the compiler supports GCC vector extensions.
  + Bugs fixed: rh#972647, fdo#69014.</changelog>
  <changelog author="zaitor@opensuse.org" date="1440244800">- Update to version 0.33.2:
  + ARMv6 - Many fast paths implementations were added.
  + PPC64/PPC64LE - Fix all outstanding bugs and add many fast
    paths implementations using vmx.
  + Major enhancements to lowlevel-blt-bench utility.
  + A couple of fixes and enhancements to mmx code.</changelog>
  <changelog author="zaitor@opensuse.org" date="1445947200">- Update to version 0.33.4:
  + Important security fix to prevent stack buffer overflow.
  + POWER: New fast-paths and optimizations to existing fast-paths.
  + ARMv6: New fast-path.
  + Tests: New cover and fence-image-self tests.
  + Remove redundant corrections in various calculations for
    COVER-CLIP and COVER analysis.</changelog>
  <changelog author="zaitor@opensuse.org" date="1451736000">- Update to version 0.33.6:
  + configura.ac: fix test for SSE2 &amp; SSSE3 assembler support.
  + mmx: Improve detection of support for "K" constraint.
  + Revert "mmx: Use MMX2 intrinsics from xmmintrin.h directly".</changelog>
  <changelog author="zaitor@opensuse.org" date="1454328000">- Update to version 0.34.0:
  + No changes from last version, stable version release only.</changelog>
  <changelog author="zaitor@opensuse.org" date="1459771200">- Add pixman-private-correct-include.patch: pixman-private: include
  &lt;float.h&gt; only in C code, patch from upstream git.</changelog>
  <changelog author="mgorse@suse.com" date="1460721600">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="mgorse@suse.com" date="1667563200">- Add pixman-CVE-2022-44638.patch: avoid an integer overflow
  (boo#1205033 CVE-2022-44638).</changelog>
</package>
<package pkgid="b365f1c286d304e800ef5dffbe9c67b1af720ec10432a26b3bbce029a02c5d0c" name="podman" arch="aarch64">
  <version epoch="0" ver="3.4.7" rel="150300.9.12.1"/>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
  <changelog author="dcermak@suse.com" date="1663848000">- Add fix for CVE-2022-2989 / bsc#1202809
  Add patch: 0001-Add-container-GID-to-additional-groups.patch</changelog>
</package>
<package pkgid="74308a66703f161a431fbe5dc682fd45caf0e6f58af01fc1e0e04733a22e52ba" name="podman" arch="src">
  <version epoch="0" ver="3.4.7" rel="150300.9.12.1"/>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
  <changelog author="dcermak@suse.com" date="1663848000">- Add fix for CVE-2022-2989 / bsc#1202809
  Add patch: 0001-Add-container-GID-to-additional-groups.patch</changelog>
</package>
<package pkgid="d8b43aadf2724b97d3e74fd71652ae1f4a02e237d9e7ba24086305c3c16e6852" name="podman" arch="x86_64">
  <version epoch="0" ver="3.4.7" rel="150300.9.12.1"/>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
  <changelog author="dcermak@suse.com" date="1663848000">- Add fix for CVE-2022-2989 / bsc#1202809
  Add patch: 0001-Add-container-GID-to-additional-groups.patch</changelog>
</package>
<package pkgid="9f5b35c7ef4618ead49aa4d446b60ec4c251800cd84789519b75bd25021391a6" name="podman" arch="aarch64">
  <version epoch="0" ver="3.4.7" rel="150300.9.9.2"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1618833600">- Update to version 3.1.1:
  * Bump to v3.1.1
  * Update release notes for v3.1.1
  * podman play kube apply correct log driver
  * Fix build with GO111MODULE=off
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Fix missing podman-remote build options
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Move socket activation check into init() and set global condition.
  * rootless: use is_fd_inherited
  * Recreate until container prune tests for bindings
  * System tests: special case for RHEL: require runc
  * Document --volume from podman-remote run/create client
  * Containers prune endpoint should use only prune filters
  * Trim white space from /top endpoint results
  * Fix unmount doc reference in image.rst
  * Fix handling of remove --log-rusage param
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Should send the OCI runtime path not just the name to buildah
  * Fixed podman-remote --network flag
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add default template functions
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add transport and destination info to manifest doc
  * Verify existence of auth file if specified
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Update swagger definition of inspect manifest
  * Volumes prune endpoint should use only prune filters
  * Adjust libpod API Container Wait documentation to the code
  * Add missing return
  * [CI:DOCS] Fix formatting of podman-build man page
  * cgroups: force 64 bits to ParseUint
  * Fix slashes in socket URLs
  * [CI:DOCS] Correct status code for /pods/create
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix message about runtime to show only the actual runtime
  * Fix handling of $NAME and $IMAGE in runlabel
  * Fix flake on failed podman-remote build : try 2
  * Fix flake on failed podman-remote build
  * Update documentation of podman-run to reflect volume "U" option
  * Fixes invalid expression in save command
  * Fix possible panic in libpod/image/prune.go
  * Update all containers/ project vendors
  * Fix tests
  * Bump to v3.1.1-dev</changelog>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
</package>
<package pkgid="c3045120a28818a9295efe5cb65bba24af86ac510bf858b95dd7585c05506a10" name="podman" arch="src">
  <version epoch="0" ver="3.4.7" rel="150300.9.9.2"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1618833600">- Update to version 3.1.1:
  * Bump to v3.1.1
  * Update release notes for v3.1.1
  * podman play kube apply correct log driver
  * Fix build with GO111MODULE=off
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Fix missing podman-remote build options
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Move socket activation check into init() and set global condition.
  * rootless: use is_fd_inherited
  * Recreate until container prune tests for bindings
  * System tests: special case for RHEL: require runc
  * Document --volume from podman-remote run/create client
  * Containers prune endpoint should use only prune filters
  * Trim white space from /top endpoint results
  * Fix unmount doc reference in image.rst
  * Fix handling of remove --log-rusage param
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Should send the OCI runtime path not just the name to buildah
  * Fixed podman-remote --network flag
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add default template functions
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add transport and destination info to manifest doc
  * Verify existence of auth file if specified
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Update swagger definition of inspect manifest
  * Volumes prune endpoint should use only prune filters
  * Adjust libpod API Container Wait documentation to the code
  * Add missing return
  * [CI:DOCS] Fix formatting of podman-build man page
  * cgroups: force 64 bits to ParseUint
  * Fix slashes in socket URLs
  * [CI:DOCS] Correct status code for /pods/create
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix message about runtime to show only the actual runtime
  * Fix handling of $NAME and $IMAGE in runlabel
  * Fix flake on failed podman-remote build : try 2
  * Fix flake on failed podman-remote build
  * Update documentation of podman-run to reflect volume "U" option
  * Fixes invalid expression in save command
  * Fix possible panic in libpod/image/prune.go
  * Update all containers/ project vendors
  * Fix tests
  * Bump to v3.1.1-dev</changelog>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
</package>
<package pkgid="ee34b1ab211010e21629b61307b715793ed2242caf73f3670760a11025a8cd48" name="podman" arch="x86_64">
  <version epoch="0" ver="3.4.7" rel="150300.9.9.2"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1618833600">- Update to version 3.1.1:
  * Bump to v3.1.1
  * Update release notes for v3.1.1
  * podman play kube apply correct log driver
  * Fix build with GO111MODULE=off
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Fix missing podman-remote build options
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Move socket activation check into init() and set global condition.
  * rootless: use is_fd_inherited
  * Recreate until container prune tests for bindings
  * System tests: special case for RHEL: require runc
  * Document --volume from podman-remote run/create client
  * Containers prune endpoint should use only prune filters
  * Trim white space from /top endpoint results
  * Fix unmount doc reference in image.rst
  * Fix handling of remove --log-rusage param
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Should send the OCI runtime path not just the name to buildah
  * Fixed podman-remote --network flag
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add default template functions
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add transport and destination info to manifest doc
  * Verify existence of auth file if specified
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Update swagger definition of inspect manifest
  * Volumes prune endpoint should use only prune filters
  * Adjust libpod API Container Wait documentation to the code
  * Add missing return
  * [CI:DOCS] Fix formatting of podman-build man page
  * cgroups: force 64 bits to ParseUint
  * Fix slashes in socket URLs
  * [CI:DOCS] Correct status code for /pods/create
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix message about runtime to show only the actual runtime
  * Fix handling of $NAME and $IMAGE in runlabel
  * Fix flake on failed podman-remote build : try 2
  * Fix flake on failed podman-remote build
  * Update documentation of podman-run to reflect volume "U" option
  * Fixes invalid expression in save command
  * Fix possible panic in libpod/image/prune.go
  * Update all containers/ project vendors
  * Fix tests
  * Bump to v3.1.1-dev</changelog>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
</package>
<package pkgid="81b920d78168dbad707efb2c98ded2bd9369960b30e366b5c557a23646faab15" name="podman" arch="aarch64">
  <version epoch="0" ver="4.3.1" rel="150300.9.15.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="d6f4478bfc02368d7cc4f348ccbf8545565d23e4bc6ea9877b6f5f1bbe3560b4" name="podman" arch="src">
  <version epoch="0" ver="4.3.1" rel="150300.9.15.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="573ba61f2586e3a9a8b3f5deb87a6c3b4d9690b790cef7a28b35de46085b8093" name="podman" arch="x86_64">
  <version epoch="0" ver="4.3.1" rel="150300.9.15.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="c48e6894566e1ff436d259ec63e1b374ff890bde3b38a381bac8c5217f53c165" name="podman-cni-config" arch="noarch">
  <version epoch="0" ver="3.4.7" rel="150300.9.12.1"/>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
  <changelog author="dcermak@suse.com" date="1663848000">- Add fix for CVE-2022-2989 / bsc#1202809
  Add patch: 0001-Add-container-GID-to-additional-groups.patch</changelog>
</package>
<package pkgid="12a7b18fe464d55e7c271fdae9fe8295cb60a82a275cd3bcfa25ae3c663ffc12" name="podman-cni-config" arch="noarch">
  <version epoch="0" ver="3.4.7" rel="150300.9.9.2"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1618833600">- Update to version 3.1.1:
  * Bump to v3.1.1
  * Update release notes for v3.1.1
  * podman play kube apply correct log driver
  * Fix build with GO111MODULE=off
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Fix missing podman-remote build options
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Move socket activation check into init() and set global condition.
  * rootless: use is_fd_inherited
  * Recreate until container prune tests for bindings
  * System tests: special case for RHEL: require runc
  * Document --volume from podman-remote run/create client
  * Containers prune endpoint should use only prune filters
  * Trim white space from /top endpoint results
  * Fix unmount doc reference in image.rst
  * Fix handling of remove --log-rusage param
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Should send the OCI runtime path not just the name to buildah
  * Fixed podman-remote --network flag
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add default template functions
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add transport and destination info to manifest doc
  * Verify existence of auth file if specified
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Update swagger definition of inspect manifest
  * Volumes prune endpoint should use only prune filters
  * Adjust libpod API Container Wait documentation to the code
  * Add missing return
  * [CI:DOCS] Fix formatting of podman-build man page
  * cgroups: force 64 bits to ParseUint
  * Fix slashes in socket URLs
  * [CI:DOCS] Correct status code for /pods/create
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix message about runtime to show only the actual runtime
  * Fix handling of $NAME and $IMAGE in runlabel
  * Fix flake on failed podman-remote build : try 2
  * Fix flake on failed podman-remote build
  * Update documentation of podman-run to reflect volume "U" option
  * Fixes invalid expression in save command
  * Fix possible panic in libpod/image/prune.go
  * Update all containers/ project vendors
  * Fix tests
  * Bump to v3.1.1-dev</changelog>
  <changelog author="fvogt@suse.com" date="1619179200">- Update to version 3.1.2:
  * Bump to v3.1.2
  * Update release notes for v3.1.2
  * Ensure mount destination is clean, no trailing slash
  * Fixes podman-remote save to directories does not work
  * [CI:DOCS] Add missing dash to verbose option
  * [CI:DOCS] Fix Markdown table layout bugs
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * rmi: don't break when the image is missing a manifest
  * Bump containers/image to v5.11.1
  * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1
  * Fix lint
  * Bump to v3.1.2-dev
- Split podman-remote into a subpackage
- Add missing scriptlets for systemd units
- Escape macros in comments
- Drop some obsolete workarounds, including %{go_nostrip}</changelog>
  <changelog author="idesmi@protonmail.com" date="1623153600">- Update to version 3.2.0:
  * Bump to v3.2.0
  * Fix network create macvlan with subnet option
  * Final release notes updates for v3.2.0
  * add ipv6 nameservers only when the container has ipv6 enabled
  * Use request context instead of background
  * [v.3.2] events: support disjunctive filters
  * System tests: add :Z to volume mounts
  * generate systemd: make mounts portable
  * vendor containers/storage@v1.31.3
  * vendor containers/common@v0.38.5
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC3
  * Update release notes for v3.2.0-RC3
  * Fix race on podman start --all
  * Fix race condition in running ls container in a pod
  * docs: --cert-dir: point to containers-certs.d(5)
  * Handle hard links in different directories
  * Improve OCI Runtime error
  * Handle hard links in remote builds
  * Podman info add support for status of cgroup controllers
  * Drop container does not exist on removal to debugf
  * Downgrade API service routing table logging
  * add libimage events
  * docs: generate systemd: XDG_RUNTIME_DIR
  * Fix problem copying files when container is in host pid namespace
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-RC2
  * update c/common
  * Update Cirrus DEST_BRANCH to v3.2
  * Updated vendors of c/image, c/storage, Buildah
  * Initial release notes for v3.2.0-RC2
  * Add script for identifying commits in release branches
  * Add host.containers.internal entry into container's etc/hosts
  * image prune: remove unused images only with `--all`
  * podman network reload add rootless support
  * Use more recent `stale` release...
  * network tutorial: update with rootless cni changes
  * [CI:DOCS] Update first line in intro page
  * Use updated VM images + updated automation tooling
  * auto-update service: prune images
  * make vendor
  * fix system upgrade tests
  * Print "extracting" only on compressed file
  * podman image tree: restore previous behavior
  * fix network restart always test
  * fix incorrect log driver in podman container image
  * Add support for cli network prune --filter flag
  * Move filter parsing to common utils
  * Bump github.com/containers/storage from 1.30.2 to 1.30.3
  * Update nix pin with `make nixpkgs`
  * [CI:DOCS] hack/bats - new helper for running system tests
  * fix restart always with slirp4netns
  * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94
  * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2
  * Add host.serviceIsRemote to podman info results
  * Add client disconnect to build handler loop
  * Remove obsolete skips
  * Fix podman-remote build --rm=false ...
  * fix: improved "containers/{name}/wait" endpoint
  * Bump github.com/containers/storage from 1.30.1 to 1.30.2
  * Add envars to the generated systemd unit
  * fix: use UTC Time Stamps in response JSON
  * fix container startup for empty pidfile
  * Kube like pods should share ipc,net,uts by default
  * fix: compat API "images/get" for multiple images
  * Revert escaped double dash man page flag syntax
  * Report Download complete in Compatibility mode
  * Add documentation on short-names
  * Bump github.com/docker/docker
  * Adds support to preserve auto update labels in generate and play kube
  * [CI:DOCS] Stop conversion of `--` into en dash
  * Revert Patch to relabel if selinux not enabled
  * fix per review request
  * Add support for environment variable secrets
  * fix pre review request
  * Fix infinite loop in isPathOnVolume
  * Add containers.conf information for changing defaults
  * CI: run rootless tests under ubuntu
  * Fix wrong macvlan PNG in networking doc.
  * Add restart-policy to container filters &amp; --filter to podman start
  * Fixes docker-compose cannot set static ip when use ipam
  * channel: simplify implementation
  * build: improve regex for iidfile
  * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0
  * cgroup: fix rootless --cgroup-parent with pods
  * fix: docker APIv2 `images/get`
  * codespell cleanup
  * Minor podmanimage docs updates.
  * Fix handling of runlabel IMAGE and NAME
  * Bump to v3.2.0-dev
  * Bump to v3.2.0-rc1
  * rootless: improve automatic range split
  * podman: set volatile storage flag for --rm containers
  * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2
  * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0
  * migrate Podman to containers/common/libimage
  * Add filepath glob support to --security-opt unmask
  * Force log_driver to k8s-file for containers in containers
  * add --mac-address to podman play kube
  * compat api: Networks must be empty instead of null
  * System tests: honor $OCI_RUNTIME (for CI)
  * is this a bug?
  * system test image: add arm64v8 image
  * Fix troubleshooting documentation on handling sublemental groups.
  * Add --all to podman start
  * Fix variable reference typo. in multi-arch image action
  * cgroup: always honor --cgroup-parent with cgroupfs
  * Bump github.com/uber/jaeger-client-go
  * Don't require tests for github-actions &amp; metadata
  * Detect if in podman machine virtual vm
  * Fix multi-arch image workflow typo
  * [CI:DOCS] Add titles to remote docs (windows)
  * Remove unused VolumeList* structs
  * Cirrus: Update F34beta -&gt; F34
  * Update container image docs + fix unstable execution
  * Bump github.com/containers/storage from 1.30.0 to 1.30.1
  * TODO complete
  * Docker returns 'die' status rather then 'died' status
  * Check if another VM is running on machine start
  * [CI:DOCS] Improve titles of command HTML pages
  * system tests: networking: fix another race condition
  * Use seccomp_profile as default profile if defined in containers.conf
  * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11
  * Vendored
  * Autoupdate local label functional
  * System tests: fix two race conditions
  * Add more documentation on conmon
  * Allow docker volume create API to pass without name
  * Cirrus: Update Ubuntu images to 21.04
  * Skip blkio-weight test when no kernel BFQ support
  * rootless: Tell the user what was led to the error, not just what it is
  * Add troubleshooting advice about the --userns option.
  * Fix images prune filter until
  * Fix logic for pushing stable multi-arch images
  * Fixes generate kube incorrect when bind-mounting "/" and "/root"
  * libpod/image: unit tests: don't use system's registries.conf.d
  * runtime: create userns when CAP_SYS_ADMIN is not present
  * rootless: attempt to copy current mappings first
  * [CI:DOCS] Restore missing content to manpages
  * [CI:DOCS] Fix Markdown layout bugs
  * Fix podman ps --filter ancestor to match exact ImageName/ImageID
  * Add machine-enabled to containers.conf for machine
  * Several multi-arch image build/push fixes
  * Add podman run --timeout option
  * Parse slirp4netns net options with compat api
  * Fix rootlesskit port forwarder with custom slirp cidr
  * Fix removal race condition in ListContainers
  * Add github-action workflow to build/push multi-arch
  * rootless: if root is not sub?id raise a debug message
  * Bump github.com/containers/common from 0.36.0 to 0.37.0
  * Add go template shell completion for --format
  * Add --group-add keep-groups: suplimentary groups into container
  * Fixes from make codespell
  * Typo fix to usage text of --compress option
  * corrupt-image test: fix an oops
  * Add --noheading flag to all list commands
  * Bump github.com/containers/storage from 1.29.0 to 1.30.0
  * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1
  * [CI:DOCS] Fix Markdown table layout bugs
  * podman-remote should show podman.sock info
  * rmi: don't break when the image is missing a manifest
  * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and podman-run.1.md
  * Add support for CDI device configuration
  * [CI:DOCS] Add missing dash to verbose option
  * Bump github.com/uber/jaeger-client-go
  * Remove an advanced layer diff function
  * Ensure mount destination is clean, no trailing slash
  * add it for inspect pidfile
  * [CI:DOCS] Fix introduction page typo
  * support pidfile on container restore
  * fix start it
  * skip pidfile test on remote
  * improve document
  * set pidfile default value int containerconfig
  * add pidfile in inspection
  * add pidfile it for container start
  * skip pidfile it on remote
  * Modify according to comments
  * WIP: drop test requirement
  * runtime: bump required conmon version
  * runtime: return findConmon to libpod
  * oci: drop ExecContainerCleanup
  * oci: use `--full-path` option for conmon
  * use AttachSocketPath when removing conmon files
  * hide conmon-pidfile flag on remote mode
  * Fix possible panic in libpod/image/prune.go
  * add --ip to podman play kube
  * add flag autocomplete
  * add ut
  * add flag "--pidfile" for podman create/run
  * Add network bindings tests: remove and list
  * Fix build with GO111MODULE=off
  * system tests: build --pull-never: deal with flakes
  * compose test: diagnose flakes v3
  * podman play kube apply correct log driver
  * Fixes podman-remote save to directories does not work
  * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2
  * Update documentation of podman-run to reflect volume "U" option
  * Fix flake on failed podman-remote build : try 2
  * compose test: ongoing efforts to diagnose flakes
  * Test that we don't error out on advertised --log-level values
  * At trace log level, print error text using %+v instead of %v
  * pkg/errorhandling.JoinErrors: don't throw away context for lone errors
  * Recognize --log-level=trace
  * Fix flake on failed podman-remote build
  * System tests: fix racy podman-inspect
  * Fixes invalid expression in save command
  * Bump github.com/containers/common from 0.35.4 to 0.36.0
  * Update nix pin with `make nixpkgs`
  * compose test: try to get useful data from flakes
  * Remove in-memory state implementation
  * Fix message about runtime to show only the actual runtime
  * System tests: setup: better cleanup of stray images
  * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1
  * Reflect current state of prune implementation in docs
  * Do not delete container twice
  * [CI:DOCS] Correct status code for /pods/create
  * vendor in containers/storage v1.29.0
  * cgroup: do not set cgroup parent when rootless and cgroupfs
  * Overhaul Makefile binary and release worflows
  * Reorganize Makefile with sections and guide
  * Simplify Makefile help target
  * Don't shell to obtain current directory
  * Remove unnecessary/not-needed release.txt target
  * Fix incorrect version number output
  * Exclude .gitignore from test req.
  * Fix handling of $NAME and $IMAGE in runlabel
  * Update podman image Dockerfile to support Podman in container
  * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0
  * Fix slashes in socket URLs
  * Add network prune filters support to bindings
  * Add support for play/generate kube volumes
  * Update manifest API endpoints
  * Fix panic when not giving a machine name for ssh
  * cgroups: force 64 bits to ParseUint
  * Bump k8s.io/api from 0.20.5 to 0.21.0
  * [CI:DOCS] Fix formatting of podman-build man page
  * buildah-bud tests: simplify
  * Add missing return
  * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1
  * speed up CI handling of images
  * Volumes prune endpoint should use only prune filters
  * Cirrus: Use Fedora 34beta images
  * Bump go.sum + Makefile for golang 1.16
  * Exempt Makefile changes from test requirements
  * Adjust libpod API Container Wait documentation to the code
  * [CI:DOCS] Update swagger definition of inspect manifest
  * use updated ubuntu images
  * podman unshare: add --rootless-cni to join the ns
  * Update swagger-check
  * swagger: remove name wildcards
  * Update buildah-bud diffs
  * Handle podman-remote --arch, --platform, --os
  * buildah-bud tests: handle go pseudoversions, plus...
  * Fix flaking rootless compose test
  * rootless cni add /usr/sbin to PATH if not present
  * System tests: special case for RHEL: require runc
  * Add --requires flag to podman run/create
  * [CI:DOCS] swagger-check: compare operations
  * [CI:DOCS] Polish swagger OpertionIDs
  * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`
  * Ensure that `--userns=keep-id` sets user in config
  * [CI:DOCS] Set all operation id to be compatibile
  * Move operationIds to swagger:operation line
  * swagger: add operationIds that match with docker
  * Cirrus: Make use of shared get_ci_vm container
  * Don't relabel volumes if running in a privileged container
  * Allow users to override default storage opts with --storage-opt
  * Add support for podman --context default
  * Verify existence of auth file if specified
  * fix machine naming conventions
  * Initial network bindings tests
  * Update release notes to indicate CVE fix
  * Move socket activation check into init() and set global condition.
  * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0
  * Http api tests for network prune with until filter
  * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for --userns
  * Fix typos --uidmapping and --gidmapping
  * Add transport and destination info to manifest doc
  * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1
  * Add default template functions
  * Fix missing podman-remote build options
  * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1
  * Add ssh connection to root user
  * Add rootless docker-compose test to the CI
  * Use the slrip4netns dns in the rootless cni ns
  * Cleanup the rootless cni namespace
  * Add new docker-compose test for two networks
  * Make the docker-compose test work rootless
  * Remove unused rootless-cni-infra container files
  * Only use rootless RLK when the container has ports
  * Fix dnsname test
  * Enable rootless network connect/disconnect
  * Move slirp4netns functions into an extra file
  * Fix pod infra container cni network setup
  * Add rootless support for cni and --uidmap
  * rootless cni without infra container
  * Recreate until container prune tests for bindings
  * Remove --execute from podman machine ssh
  * Fixed podman-remote --network flag
  * Makefile: introduce install.docker-full
  * Makefile: ensure install.docker creates BINDIR
  * Fix unmount doc reference in image.rst
  * Should send the OCI runtime path not just the name to buildah
  * podman machine shell completion
  * Fix handling of remove --log-rusage param
  * Fix bindings prune containers flaky test
  * [CI:DOCS] Add local html build info to docs/README.md
  * Add podman machine list
  * Trim white space from /top endpoint results
  * Remove semantic version suffices from API calls
  * podman machine init --ignition-path
  * Document --volume from podman-remote run/create client
  * Update main branch to reflect the release of v3.1.0
  * Silence podman network reload errors with iptables-nft
  * Containers prune endpoint should use only prune filters
  * resolve proper aarch64 image names
  * APIv2 basic test: relax APIVersion check
  * Add machine support for qemu-system-aarch64
  * podman machine init user input
  * manpage xref: helpful diagnostic for unescaped dash-dash
  * Bump to v3.2.0-dev
  * swagger: update system version response body
  * buildah-bud tests: reenable pull-never test
  * [NO TESTS NEEDED] Shrink the size of podman-remote
  * Add powershell completions
  * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted
  * Fix long option format on docs.podman.io
  * system tests: friendier messages for 2-arg is()
  * service: use LISTEN_FDS
  * man pages: correct seccomp-policy label
  * rootless: use is_fd_inherited
  * podman generate systemd --new do not duplicate params
  * play kube: add support for env vars defined from secrets
  * play kube: support optional/mandatory env var from config map
  * play kube: prepare supporting other env source than config maps
  * Add machine support for more Linux distros
  * [NO TESTS NEEDED] Use same function podman-remote rmi as podman
  * Podman machine enhancements
  * Add problematic volume name to kube play error messages
  * Fix podman build --pull-never
  * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS
  * [NO TESTS NEEDED] Turn on podman-remote build --isolation
  * Fix list pods filter handling in libpod api
  * Remove resize race condition
  * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0
  * Use TMPDIR when commiting images
  * Add RequiresMountsFor= to systemd generate
  * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3
  * Fix swapped dimensions from terminal.GetSize
  * Rename podman machine create to init and clean up
  * Correct json field name
  * system tests: new interactive tests
  * Improvements for machine
  * libpod/image: unit tests: use a `registries.conf` for aliases
  * libpod/image: unit tests: defer cleanup
  * libpod/image: unit tests: use `require.NoError`
  * Add --execute flag to podman machine ssh
  * introduce podman machine
  * Podman machine CLI and interface stub
  * Support multi doc yaml for generate/play kube
  * Fix filters in image http compat/libpod api endpoints
  * Bump github.com/containers/common from 0.35.3 to 0.35.4
  * Bump github.com/containers/storage from 1.28.0 to 1.28.1
  * Check if stdin is a term in --interactive --tty mode
  * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot
  * [NO TESTS NEEDED] Fix rootless volume plugins
  * Ensure manually-created volumes have correct ownership
  * Bump github.com/rootless-containers/rootlesskit
  * Unification of until filter across list/prune endpoints
  * Unification of label filter across list/prune endpoints
  * fixup
  * fix: build endpoint for compat API
  * [CI:DOCS] Add note to mappings for user/group userns in build
  * Bump k8s.io/api from 0.20.1 to 0.20.5
  * Validate passed in timezone from tz option
  * WIP: run buildah bud tests using podman
  * Fix containers list/prune http api filter behaviour
  * Generate Kubernetes PersistentVolumeClaims from named volumes</changelog>
  <changelog author="idesmi@protonmail.com" date="1623672000">- Update to version 3.2.1:
  * Bump to v3.2.1
  * Updated release notes for v3.2.1
  * Fix network connect race with docker-compose
  * Revert "Ensure minimum API version is set correctly in tests"
  * Fall back to string for dockerfile parameter
  * remote events: fix --stream=false
  * [CI:DOCS] fix incorrect network remove api doc
  * remote: always send resize before the container starts
  * remote events: support labels
  * remote pull: cancel pull when connection is closed
  * Fix network prune api docs
  * Improve systemd-resolved detection
  * logs: k8s-file: fix race
  * Fix image prune --filter cmd behavior
  * Several shell completion fixes
  * podman-remote build should handle -f option properly
  * System tests: deal with crun 0.20.1
  * Fix build tags for pkg/machine...
  * Fix pre-checkpointing
  * container: ignore named hierarchies
  * [v3.2] vendor containers/common@v0.38.9
  * rootless: fix fast join userns path
  * [v3.2] vendor containers/common@v0.38.7
  * [v3.2] vendor containers/common@v0.38.6
  * Correct qemu options for Intel macs
  * Ensure minimum API version is set correctly in tests
  * Bump to v3.2.1-dev</changelog>
  <changelog author="idesmi@protonmail.com" date="1624795200">- Update to version 3.2.2:
  * Bump to v3.2.2
  * fix systemcontext to use correct TMPDIR
  * Scrub podman commands to use report package
  * Fix volumes with uid and gid options
  * Vendor in c/common v0.38.11
  * Initial release notes for v3.2.2
  * Fix restoring of privileged containers
  * Fix handling of podman-remote build --device
  * Add support for podman remote build -f - .
  * Fix panic condition in cgroups.getAvailableControllers
  * Fix permissions on initially created named volumes
  * Fix building static podman-remote
  * add correct slirp ip to /etc/hosts
  * disable tty-size exec checks in system tests
  * Fix resize race with podman exec -it
  * Fix documentation of the --format option of podman push
  * Fix systemd-resolved detection.
  * Health Check is not handled in the compat LibpodToContainerJSON
  * Do not use inotify for OCICNI
  * getContainerNetworkInfo: lock netNsCtr before sync
  * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership
  * Create the /etc/mtab file if does not exists
  * [v3.2] cp: do not allow dir-&gt;file copying
  * create: support images with invalid platform
  * vendor containers/common@v0.38.10
  * logs: k8s-file: restore poll sleep
  * logs: k8s-file: fix spurious error logs
  * utils: move message from warning to debug
  * Bump to v3.2.2-dev</changelog>
  <changelog author="michael@stroeder.com" date="1626523200">- Update to version 3.2.3:
  * Bump to v3.2.3
  * Update release notes for v3.2.3
  * vendor containers/common@v0.38.16
  * vendor containers/buildah@v1.21.3
  * Fix race conditions in rootless cni setup
  * CNI-in-slirp4netns: fix bind-mount for /run/systemd/resolve/stub-resolv.conf
  * Make rootless-cni setup more robust
  * Support uid,gid,mode options for secrets
  * vendor containers/common@v0.38.15
  * [CI:DOCS] podman search: clarify that results depend on implementation
  * vendor containers/common@v0.38.14
  * vendor containers/common@v0.38.13
  * [3.2] vendor containers/common@v0.38.12
  * Bump README to v3.2.2
  * Bump to v3.2.3-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1628856000">- Switch to crun (bsc#1188914)</changelog>
  <changelog author="michael@stroeder.com" date="1629460800">- Update to version 3.3.0:
  * Fix network aliases with network id
  * machine: compute sha256 as we read the image file
  * machine: check for file exists instead of listing directory
  * pkg/bindings/images.nTar(): slashify hdr.Name values
  * Volumes: Only remove from DB if plugin removal succeeds
  * For compatibility, ignore Content-Type
  * [v3.3] Bump c/image 5.15.2, buildah v1.22.3
  * Implement SD-NOTIFY proxy in conmon
  * Fix rootless cni dns without systemd stub resolver
  * fix rootlessport flake
  * Skip stats test in CGv1 container environments
  * Fix AVC denials in tests of volume mounts
  * Restore buildah-bud test requiring new images
  * Revert ".cirrus.yml: use fresh images for all VMs"
  * Fix device tests using ls test files
  * Enhance priv. dev. check
  * Workaround host availability of /dev/kvm
  * Skip cgroup-parent test due to frequent flakes
  * Cirrus: Fix not uploading logformatter html</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="bruno.leon@suse.com" date="1644494400">- fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion
- fix CVE-2021-4024  [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs
- fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost</changelog>
  <changelog author="dcermak@suse.com" date="1648555200">- Add patches to fix bsc#1196751:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch</changelog>
  <changelog author="dcermak@suse.com" date="1659960000">- Update to version 3.4.7:
  * Bump to v3.4.7
  * Update release notes for v3.4.7
  * fix CVE-2022-1227
  * Update readme version
  * Bump to v3.4.7-dev
  * Bump to v3.4.6
  * Add release notes for v3.4.6
  * Bump golang.org/x/crypto to 7b82a4e
  * Bump to v3.4.6-dev
  * Bump to v3.4.5
  * test: fix podman run test as rootless
  * do not set the inheritable capabilities
  * Release notes for v3.4.5
  * Backport of https://github.com/containers/podman/pull/13536 to 3.4
  * Bump github.com/prometheus/client_golang to v1.11.1
  * [v.3.4] vendor containers/common@v0.44.5
  * Disable search-images test
  * [CI:DOCS] logformatter: handle python logs
  * Changes of docker descriptions
  * Fix images since/after tests
  * Makefile: fix darwin detection
  * buildah bud tests: skip failing tests
  * System tests: fix RHEL8 gating tests
  * Record the image stream along with the path
  * Not all fields in machine list were set properly
  * Add completion for machine list format
  * Add JSON version of the machine list
  * Bump to v3.4.5-dev
- Remove merged patches:
  * 0002-Add-JSON-version-of-the-machine-list.patch
  * 0003-Add-completion-for-machine-list-format.patch
  * 0004-Not-all-fields-in-machine-list-were-set-properly.patch
  * 0005-Record-the-image-stream-along-with-the-path.patch
  * 0006-System-tests-fix-RHEL8-gating-tests.patch
  * 0007-buildah-bud-tests-skip-failing-tests.patch
  * 0008-Makefile-fix-darwin-detection.patch
  * 0009-Fix-images-since-after-tests.patch
  * 0010-Changes-of-docker-descriptions.patch
  * 0011-CI-DOCS-logformatter-handle-python-logs.patch
  * 0012-Disable-search-images-test.patch
  * 0013-v.3.4-vendor-containers-common-v0.44.5.patch
  * 0014-Bump-github.com-prometheus-client_golang-to-v1.11.1.patch
  * 0015-Backport-of-https-github.com-containers-podman-pull-.patch
- Fixed security issues:
  * CVE-2022-1227: https://github.com/advisories/GHSA-66vw-v2x9-hw75 bsc#1182428
  * CVE-2022-27191: https://github.com/advisories/GHSA-8c26-wmh5-6g9v bsc#1197284
  * CVE-2022-21698: https://github.com/advisories/GHSA-cg3q-j54f-5p7p bsc#1196338</changelog>
</package>
<package pkgid="8a5d599783815ad203229391b2ccf5421ec5c94cfbcc4a0abf8fe26545f85411" name="podman-cni-config" arch="noarch">
  <version epoch="0" ver="4.3.1" rel="150300.9.15.1"/>
  <changelog author="alexandre.vicenzi@suse.com" date="1629720000">- Revert crun change due to crun having exclusive arch targets
  that would drop podman support in PPC and IBM Z</changelog>
  <changelog author="michael@stroeder.com" date="1630411200">- Update to version 3.3.1:
  * Bugfixes
  - Fixed a bug where unit files created by podman generate systemd could
    not cleanup shut down containers when stopped by systemctl stop (#11304).
  - Fixed a bug where podman machine commands would not properly locate
    the gvproxy binary in some circumstances.
  - Fixed a bug where containers created as part of a pod using the
  - -pod-id-file option would not join the pod's network namespace (#11303).
  - Fixed a bug where Podman, when using the systemd cgroups driver,
    could sometimes leak dbus sessions.
  - Fixed a bug where the until filter to podman logs and podman events
    was improperly handled, requiring input to be negated (#11158).
  - Fixed a bug where rootless containers using CNI networking run on
    systems using systemd-resolved for DNS would fail to start if resolved
    symlinked /etc/resolv.conf to an absolute path (#11358).
  * API
  - A large number of potential file descriptor leaks from improperly closing
    client connections have been fixed.</changelog>
  <changelog author="michael@stroeder.com" date="1630584000">- require runc &gt;= 1.0.1</changelog>
  <changelog author="michael@stroeder.com" date="1633089600">- Update to version 3.4.0:
  * Features
  - Pods now support init containers! Init containers are containers which run before the rest of the pod starts. There are two types of init containers: "always", which always run before the pod is started, and "once", which only run the first time the pod starts and are subsequently removed. They can be added using the podman create command's --init-ctr option.
  - Support for init containers has also been added to podman play kube and podman generate kube - init containers contained in Kubernetes YAML will be created as Podman init containers, and YAML generated by Podman will include any init containers created.
  - The podman play kube command now supports building images. If the --build option is given and a directory with the name of the specified image exists in the current working directory and contains a valid Containerfile or Dockerfile, the image will be built and used for the container.
  - The podman play kube command now supports a new option, --teardown, which removes any pods and containers created by the given Kubernetes YAML.
  - The podman generate kube command now generates annotations for SELinux mount options on volume (:z and :Z) that are respected by the podman play kube command.
  - A new command has been added, podman pod logs, to return logs for all containers in a pod at the same time.
  - Two new commands have been added, podman volume export (to export a volume to a tar file) and podman volume import) (to populate a volume from a given tar file).
  - The podman auto-update command now supports simple rollbacks. If a container fails to start after an automatic update, it will be rolled back to the previous image and restarted again.
  - Pods now share their user namespace by default, and the podman pod create command now supports the --userns option. This allows rootless pods to be created with the --userns=keep-id option.
  - The podman pod ps command now supports a new filter with its --filter option, until, which returns pods created before a given timestamp.
  - The podman image scp command has been added. This command allows images to be transferred between different hosts.
  - The podman stats command supports a new option, --interval, to specify the amount of time before the information is refreshed.
  - The podman inspect command now includes ports exposed (but not published) by containers (e.g. ports from --expose when --publish-all is not specified).
  - The podman inspect command now has a new boolean value, Checkpointed, which indicates that a container was stopped as a result of a podman container checkpoint operation.
  - Volumes created by podman volume create now support setting quotas when run atop XFS. The size and inode options allow the maximum size and maximum number of inodes consumed by a volume to be limited.
  - The podman info command now outputs information on what log drivers, network drivers, and volume plugins are available for use (#11265).
  - The podman info command now outputs the current log driver in use, and the variant and codename of the distribution in use.
  - The parameters of the VM created by podman machine init (amount of disk space, memory, CPUs) can now be set in containers.conf.
  - The podman machine ls command now shows additional information (CPUs, memory, disk size) about VMs managed by podman machine.
  - The podman ps command now includes healthcheck status in container state for containers that have healthchecks (#11527).
  * Changes
  - The podman build command has a new alias, podman buildx, to improve compatibility with Docker. We have already added support for many docker buildx flags to podman build and aim to continue to do so.
  - Cases where Podman is run without a user session or a writable temporary files directory will now produce better error messages.
  - The default log driver has been changed from file to journald. The file driver did not properly support log rotation, so this should lead to a better experience. If journald is not available on the system, Podman will automatically revert to the file.
  - Podman no longer depends on ip for removing networks (#11403).
  - The deprecated --macvlan flag to podman network create now warns when it is used. It will be removed entirely in the Podman 4.0 release.
  - The podman machine start command now prints a message when the VM is successfully started.
  - The podman stats command can now be used on containers that are paused.
  - The podman unshare command will now return the exit code of the command that was run in the user namespace (assuming the command was successfully run).
  - Successful healthchecks will no longer add a healthy line to the system log to reduce log spam.
  - As a temporary workaround for a lack of shortname prompts in the Podman remote client, VMs created by podman machine now default to only using the docker.io registry.
  * Bugfixes
  - Fixed a bug where whitespace in the definition of sysctls (particularly default sysctls specified in containers.conf) would cause them to be parsed incorrectly.
  - Fixed a bug where the Windows remote client improperly validated volume paths (#10900).
  - Fixed a bug where the first line of logs from a container run with the journald log driver could be skipped.
  - Fixed a bug where images created by podman commit did not include ports exposed by the container.
  - Fixed a bug where the podman auto-update command would ignore the io.containers.autoupdate.authfile label when pulling images (#11171).
  - Fixed a bug where the --workdir option to podman create and podman run could not be set to a directory where a volume was mounted (#11352).
  - Fixed a bug where systemd socket-activation did not properly work with systemd-managed Podman containers (#10443).
  - Fixed a bug where environment variable secrets added to a container were not available to exec sessions launched in the container.
  - Fixed a bug where rootless containers could fail to start the rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to a long path.
  - Fixed a bug where arguments to the --systemd option to podman create and podman run were case-sensitive (#11387).
  - Fixed a bug where the podman manifest rm command would also remove images referenced by the manifest, not just the manifest itself (#11344).
  - Fixed a bug where the Podman remote client on OS X would not function properly if the TMPDIR environment variable was not set (#11418).
  - Fixed a bug where the /etc/hosts file was not guaranteed to contain an entry for localhost (this is still not guaranteed if --net=host is used; such containers will exactly match the host's /etc/hosts) (#11411).
  - Fixed a bug where the podman machine start command could print warnings about unsupported CPU features (#11421).
  - Fixed a bug where the podman info command could segfault when accessing cgroup information.
  - Fixed a bug where the podman logs -f command could hang when a container exited (#11461).
  - Fixed a bug where the podman generate systemd command could not be used on containers that specified a restart policy (#11438).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the UID and GID on the client were higher than 65536 (#11474).
  - Fixed a bug where the remote Podman client's podman build command would fail to build containers if the context directory was a symlink (#11732).
  - Fixed a bug where the --network flag to podman play kube was not properly parsed when a non-bridge network configuration was specified.
  - Fixed a bug where the podman inspect command could error when the container being inspected was removed as it was being inspected (#11392).
  - Fixed a bug where the podman play kube command ignored the default pod infra image specified in containers.conf.
  - Fixed a bug where the --format option to podman inspect was nonfunctional under some circumstances (#8785).
  - Fixed a bug where the remote Podman client's podman run and podman exec commands could skip a byte of output every 8192 bytes (#11496).
  - Fixed a bug where the podman stats command would print nonsensical results if the container restarted while it was running (#11469).
  - Fixed a bug where the remote Podman client would error when STDOUT was redirected on a Windows client (#11444).
  - Fixed a bug where the podman run command could return 0 when the application in the container exited with 125 (#11540).
  - Fixed a bug where containers with --restart=always set using the rootlessport port-forwarding service could not be restarted automatically.
  - Fixed a bug where the --cgroups=split option to podman create and podman run was silently discarded if the container was part of a pod.
  - Fixed a bug where the podman container runlabel command could fail if the image name given included a tag.
  - Fixed a bug where Podman could add an extra 127.0.0.1 entry to /etc/hosts under some circumstances (#11596).
  - Fixed a bug where the remote Podman client's podman untag command did not properly handle tags including a digest (#11557).
  - Fixed a bug where the --format option to podman ps did not properly support the table argument for tabular output.
  - Fixed a bug where the --filter option to podman ps did not properly handle filtering by healthcheck status (#11687).
  - Fixed a bug where the podman run and podman start --attach commands could race when retrieving the exit code of a container that had already been removed resulting in an error (e.g. by an external podman rm -f) (#11633).
  - Fixed a bug where the podman generate kube command would add default environment variables to generated YAML.
  - Fixed a bug where the podman generate kube command would add the default CMD from the image to generated YAML (#11672).
  - Fixed a bug where the podman rm --storage command could fail to remove containers under some circumstances (#11207).
  - Fixed a bug where the podman machine ssh command could fail when run on Linux (#11731).
  - Fixed a bug where the podman stop command would error when used on a container that was already stopped (#11740).
  - Fixed a bug where renaming a container in a pod using the podman rename command, then removing the pod using podman pod rm, could cause Podman to believe the new name of the container was permanently in use, despite the container being removed (#11750).
  * API
  - The Libpod Pull endpoint for Images now has a new query parameter, quiet, which (when set to true) suppresses image pull progress reports (#10612).
  - The Compat Events endpoint now includes several deprecated fields from the Docker v1.21 API for improved compatibility with older clients.
  - The Compat List and Inspect endpoints for Images now prefix image IDs with sha256: for improved Docker compatibility (#11623).
  - The Compat Create endpoint for Containers now properly sets defaults for healthcheck-related fields (#11225).
  - The Compat Create endpoint for Containers now supports volume options provided by the Mounts field (#10831).
  - The Compat List endpoint for Secrets now supports a new query parameter, filter, which allows returned results to be filtered.
  - The Compat Auth endpoint now returns the correct response code (500 instead of 400) when logging into a registry fails.
  - The Version endpoint now includes information about the OCI runtime and Conmon in use (#11227).
  - Fixed a bug where the X-Registry-Config header was not properly handled, leading to errors when pulling images (#11235).
  - Fixed a bug where invalid query parameters could cause a null pointer dereference when creating error messages.
  - Logging of API requests and responses at trace level has been greatly improved, including the addition of an X-Reference-Id header to correlate requests and responses (#10053).
  * Misc
  - Updated Buildah to v1.23.0
  - Updated the containers/storage library to v1.36.0
  - Updated the containers/image library to v5.16.0
  - Updated the containers/common library to v0.44.0</changelog>
  <changelog author="michael@stroeder.com" date="1634731200">- Update to version 3.4.1:
  * Bugfixes
  - Fixed a bug where podman machine init could, under some circumstances,
    create invalid machine configurations which could not be started (#11824).
  - Fixed a bug where the podman machine list command would not properly
    populate some output fields.
  - Fixed a bug where podman machine rm could leave dangling sockets from
    the removed machine (#11393).
  - Fixed a bug where podman run --pids-limit=-1 was not supported (it now
    sets the PID limit in the container to unlimited) (#11782).
  - Fixed a bug where podman run and podman attach could throw errors about
    a closed network connection when STDIN was closed by the client (#11856).
  - Fixed a bug where the podman stop command could fail when run on a
    container that had another podman stop command run on it previously.
  - Fixed a bug where the --sync flag to podman ps was nonfunctional.
  - Fixed a bug where the Windows and OS X remote clients' podman stats
    command would fail (#11909).
  - Fixed a bug where the podman play kube command did not properly handle
    environment variables whose values contained an = (#11891).
  - Fixed a bug where the podman generate kube command could generate
    invalid annotations when run on containers with volumes that use SELinux
    relabelling (:z or :Z) (#11929).
  - Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. user and group,
    entrypoint, default protocol for forwarded ports) (#11914, #11915, and #11965).
  - Fixed a bug where the podman generate kube command could, under some
    circumstances, generate YAML including an invalid targetPort field for
    forwarded ports (#11930).
  - Fixed a bug where rootless Podman's podman info command could, under
    some circumstances, not read available CGroup controllers (#11931).
  - Fixed a bug where podman container checkpoint --export would fail to
    checkpoint any container created with --log-driver=none (#11974).
  * API
  - Fixed a bug where the Compat Create endpoint for Containers could panic
    when no options were passed to a bind mount of tmpfs (#11961).</changelog>
  <changelog author="michael@stroeder.com" date="1636804800">- Update to version 3.4.2:
  * Fixed a bug where podman tag could not tag manifest lists (#12046).
  * Fixed a bug where built-in volumes specified by images would not be
    created correctly under some circumstances.
  * Fixed a bug where, when using Podman Machine on OS X, containers in pods
    did not have working port forwarding from the host (#12207).
  * Fixed a bug where the podman network reload command command on containers
    using the slirp4netns network mode and the rootlessport port forwarding
    driver would make an unnecessary attempt to restart rootlessport
    on containers that did not forward ports.
  * Fixed a bug where the podman generate kube command would generate YAML
    including some unnecessary (set to default) fields (e.g. empty SELinux and
    DNS configuration blocks, and the privileged flag when set to false) (#11995).
  * Fixed a bug where the podman pod rm command could, if interrupted at the right moment,
    leave a reference to an already-removed infra container behind (#12034).
  * Fixed a bug where the podman pod rm command would not remove pods with
    more than one container if all containers save for the infra container
    were stopped unless --force was specified (#11713).
  * Fixed a bug where the --memory flag to podman run and podman create did
    not accept a limit of 0 (which should specify unlimited memory) (#12002).
  * Fixed a bug where the remote Podman client's podman build command could
    attempt to build a Dockerfile in the working directory of the podman
    system service instance instead of the Dockerfile specified by the user (#12054).
  * Fixed a bug where the podman logs --tail command could function improperly
    (printing more output than requested) when the journald log driver was used.
  * Fixed a bug where containers run using the slirp4netns network mode with
    IPv6 enabled would not have IPv6 connectivity until several seconds after they started (#11062).
  * Fixed a bug where some Podman commands could cause an extra dbus-daemon
    process to be created (#9727).
  * Fixed a bug where rootless Podman would sometimes print warnings
    about a failure to move the pause process into a given CGroup (#12065).
  * Fixed a bug where the checkpointed field in podman inspect on a container
    was not set to false after a container was restored.
  * Fixed a bug where the podman system service command would print
    overly-verbose logs about request IDs (#12181).
  * Fixed a bug where Podman could, when creating a new container without a name
    explicitly specified by the user, sometimes use an auto-generated name already
    in use by another container if multiple containers were being created in parallel (#11735).</changelog>
  <changelog author="michael@stroeder.com" date="1638878400">- Update to version 3.4.3:
  * Security
  - This release addresses CVE-2021-4024 / bsc#1193166, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
  - This release addresses CVE-2021-41190 / bsc#1193273, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.
  * Features
  - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).
  * Bugfixes
  - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
  - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
  - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
  - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
  - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
  - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
  - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
  - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
  - Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
  - Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
  - Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
  - Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
  - Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
  - Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
  - Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra " (#11416).
  * API
  - Updated the containers/image library to v5.17.0
  - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as part of its payload, and will use provided any ConfigMap to configure provided pods and services.
  - Fixed a bug where the Compat Create endpoint for Containers would not always create the container's working directory if it did not exist (#11842).
  - Fixed a bug where the Compat Create endpoint for Containers returned an incorrect error message with 404 errors when the requested image was not found (#12315).
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle the HostConfig.Mounts field (#12419).
  - Fixed a bug where the Compat Archive endpoint for Containers did not properly report errors when the operation failed (#12420).
  - Fixed a bug where the Compat Build endpoint for Images ignored the layers query parameter (for caching intermediate layers from the build) (#12378).
  - Fixed a bug where the Compat Build endpoint for Images did not report errors in a manner compatible with Docker (#12392).
  - Fixed a bug where the Compat Build endpoint for Images would fail to build if the context directory was a symlink (#12409).
  - Fixed a bug where the Compat List endpoint for Images included manifest lists (and not just images) in returned results (#12453).
  * Misc
  - Podman now builds by default with cgo enabled on OS X, resolving some issues with SSH (#10737).</changelog>
  <changelog author="michael@stroeder.com" date="1638964800">- Update to version 3.4.4:
  * Bugfixes
  - Fixed a bug where the podman exec command would, under some circumstances,
    print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  - Fixed a bug where named volumes created as part of container creation
    (e.g. podman run --volume avolume:/a/mountpoint or similar) would be
    mounted with incorrect permissions (#12523).
  - Fixed a bug where the podman-remote create and podman-remote run commands
    did not properly handle the --entrypoint="" option (to clear the container's entrypoint) (#12521).</changelog>
  <changelog author="dcermak@suse.com" date="1639051200">- Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade
  path from podman &lt; 3.1.2</changelog>
  <changelog author="rbrown@suse.com" date="1647432000">- Update to version 4.0.2:
  * Bump to v4.0.2
  * Update release notes for v4.0.2
  * Revert "use GetRuntimeDir() from c/common"
  * Revert "Option --url and --connection should imply --remote."
  * Option --url and --connection should imply --remote.
  * Bump to v4.0.2-dev
  * Bump to v4.0.1
  * Update release notes for v4.0.1
  * Fix a potential flake in volume plugins tests
  * Propagate $CONTAINERS_CONF to conmon
  * tests: Remove inaccurate comment
  * System tests: show one-line config overview
  * provide better error on invalid flag
  * use GetRuntimeDir() from c/common
  * kube: honor --build=false and make --build=true by default
  * system tests: cleanup networks on teardown
  * Remove the runtime lock
  * Don't log errors on removing volumes inuse, if container --volumes-from
  * kube: honor mount propagation mode
  * Load ip_tables modules at boot
  * Cirrus: Disable F34 aka prior-fedora testing
  * Cirrus: Update VM Images for 4.0 release
  * Bump to v4.0.1-dev
  * Bump to v4.0.0
  * Release notes for v4.0.0 final
  * Fix lint
  * Fix manifest 4.0 Endpoints Branch forced 4.0 only endpoints
  * Introduce podman machine init --root=t|f and podman machine set --root=t|f
  * Initial implementation of mac forwarding using a privileged docker sock claim helper
  * ignition: propagate proxy settings from a host into a vm
  * Update to podman4 copr stream
  * Unify ls --filter docs for networks and pods
  * e2e: merge after/since image-filter tests
  * podman network: add documentation for netavark
  * create: Fix key=value annotation in the flag output
  * enable netavark specific tests
  * Fix checkpoint/restore pod tests
  * Make sure building with relative paths work correctly.
  * Add 409 response to swagger godoc
  * Fix images since/after tests
  * Changes of docker descriptions
  * Temporarily pull machine images from side repo
  * Cirrus: TODO: netavark/aardvark release branches
  * Cirrus: Expand netavark testing to include rootless
  * Cirrus: Minor - limit release task applicability
  * Cirrus: Add [CI:BUILD] magic that only builds
  * CI: fix nightly builds
  * Cirrus: Log netavark/aardvark binary build info.
  * Cirrus: Add netavark/aardvark system test task
  * Cirrus: Also download aardvark-dns binary
  * Cirrus: Add e2e task w/ upstream netavark
  * Revert minimum API change
  * netavark e2e tests
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC5
  * Update release notes for v4.0.0-RC5
  * Modify /etc/resolv.conf when connecting/disconnecting
  * Do not set the network config dir to cni plugin dir
  * Show API doc for several versions
  * [NO NEW TEST NEEDED] Add schema for ImageCreate 200 response.
  * fix: Multiplication of durations
  * move rootless netns slirp4netns process to systemd user.slice
  * compat: endpoint /build must set header content type as application/json in reponse
  * Cleanup: remove obsolete/misleading bug workaround
  * tests: retrofit healthcheck system tests
  * healthcheck, libpod: Read healthcheck event output from os pipe
  * Fix: Do not print error when parsing journald log fails
  * Bump github.com/buger/goterm from 1.0.1 to 1.0.4
  * append podman dns search domain
  * Podman pod create --share-parent vs --share=cgroup
  * System tests: revert emergency skip of checkpoint tests
  * Add version guard to libpod API endpoints
  * [v4.0] Bump c/common to v0.47.4
  * idmap should be able to be specified along with other options
  * Vendor in containers/buildah v1.24.1
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC4
  * Disable failing E2E test
  * Revert "Move each search dns to its own line"
  * Move each search dns to its own line
  * Update release notes for v4.0.0-RC4
  * Document `schema` values in the `--url` flag
  * podman image scp syntax correction
  * system prune: remove all networks
  * Only change network fields if they were actually changed by the user
  * docs: clarify rootless net stats
  * Fix size to match Docker selection
  * libpod: enforce noexec,nosuid,nodev for /dev/shm
  * Clarify remote client means Mac and Windows
  * libpod: report slirp4netns network stats
  * Add notes to "--oom-kill-disable" not supported on cgroups V2
  * Fix use of infra image to clarify default
  * Adapt podman images ls filters docs to be aligned with prune filters docs
  * ignition, machine: delegate cpu,io cgroup controllers to machine's default users
  * pkg/bindings/images.Build(): slashify "dockerfile" values, too
  * Remove mention of IPv6 portfwd from release notes
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC3
  * Update release notes for v4.0.0-RC3
  * Fix Cirrus destination branch
  * volume: add support for non-volatile upperdir,workdir for overlay volumes
  * github: label issues based on os fix regex
  * github: label issues based on os
  * Cirrus: Fix get_ci_vm.sh initial setup
  * System tests: emergency skip of checkpoint tests
  * network create: allow multiple subnets
  * Update troubleshooting.md
  * Fix sort ordering of filters
  * Unify podman prune filter description: volumes, networks, system
  * Bump Buildah to v1.24.0
  * rootless: drop permission check for devices
  * switch podman image scp from depending on machinectl to just os/exec
  * Bump github.com/containers/image/v5 from 5.18.0 to 5.19.0
  * Bump github.com/containers/storage from 1.38.0 to 1.38.1
  * change location of where make outputs podman binary on osx
  * Github workflow: Fix parsing of GraphQL response JSON
  * Github-workflow: Fix YAML syntax
  * Update godoc, swagger using wrong struct
  * Makefile: install targets independent of build
  * [CI:DOCS] Fix typos and improve language
  * CI: enable rootless-remote system tests
  * pkg/specgen/generate/security: fix error message
  * Github workflow: Send e-mail on job error
  * Github workflow: Update Cirrus-cron GraphQL query
  * remote build: set rootless oci isolation correctly
  * [CI:DOCS] Fix typos and improve language
  * Fix handling of duplicate matches on id expansion
  * Show correct default values or show none
  * exec: retry rm -rf on ENOTEMPTY and EBUSY
  * container create: do not check for network dns support
  * libpod: fix leaking fd
  * libpod: fix connection leak
  * [CI:DOCS] fix typo subpordinate
  * Fix filter description and unify filters docs for containers/images prune
  * Remove unused param and clean API handlers
  * Restore machine start logic that was hanging
  * Bump to v4.0.0-dev
  * Bump to v4.0.0-RC2
  * Final release notes for v4.0.0-rc2
  * Run codespell on code
  * Update release notes for Podman v4.0.0
  * Fix #2 for compat commit handling of --changes
  * Fix nil pointer dereference for configmap optional
  * Make error message matching in 030-run.bats less fragile
  * Don't explicitly check for crun|runc in package information
  * Don't segfault if an image layer has no creation timestamp
  * compat: remove hardcoded index from load images output report
  * compat: images/load must be able to load tar with multiple images
  * System tests: fix for new systemd on rawhide
  * Remove rootless_networking option from containers.conf
  * vendor c/psgo@v1.7.2 (fixes CVE-2022-1227 / bsc#1182428)
  * Engine.Remote from containers.conf
  * vendor: bump c/common and other vendors
  * rootless: report correctly the error
  * Implement API forwarding for podman machine on Windows
  * Implement env parsing on Windows
  * Handle changes in docker compat mode
  * Show package version when running on alpine
  * Handlers for `generate systemd` with custom dependencies
  * APIv2 tests: followup to recent log test
  * Add IndexConfigs to compat /info endpoint
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * apiv2 test: add regression test for #12904
  * SECURITY.md: fix the project name
  * rename --cni-config-dir to --network-config-dir
  * compat attach: fix write on closed channel
  * upgrade all dependencies
  * Revert "Cirrus: Temporarily disable OSX Cross task"
  * Bump github.com/opencontainers/runc from 1.0.3 to 1.1.0
  * bump go module to version 4
  * [NO NEW TESTS NEEDED] add builddeps to copr template
  * CI: rootless user: also create in some root tests
  * [WIP] Tests for podman image scp (the sudo form)
  * Revamp Libpod state strings for Docker compat
  * Cirrus: Temporarily disable OSX Cross task
  * update c/common to latest
  * Use PODMAN_USERNS environment variable when running as a service
  * Unify the method of parsing filters in cmd
  * fix default branch links
  * [CI:DOCS] fix default branch links
  * [CI:DOCS] Unprivileged native overlayfs is now supported
  * [CI:DOCS] Fix typo in --env
  * Recursively copy cert files.
  * Refactor manifest list operations
  * Add rpkg template for COPR autobuild
  * Fix cgroup mode handling in api server
  * Standardize on capatalized Cgroups
  * test/system: podman run update /etc/hosts
  * Remove two GetImages functions from API
  * Use fully-qualified device name in CDI test
  * Use new CDI API
  * troubleshooting links to main branch
  * Podman Build use absolute filepath
  * Prohibit --uid/gid map and --pod for container create/run
  * podman container rm: remove pod
  * Manual fixes for PR #12642:
  * podman build enable --all-platforms and --unsetenv
  * use events_logfile_path from containers.conf for events log.
  * Podman Pod Create --sysctl support
  * Wait for podman stop to complete
  * libpod: fix check for systemd session
  * libpod: refine check for empty pod cgroup
  * fix buildah-bud test diff
  * upgrade test: check that network backend is cni
  * use netns package from c/common
  * update buildah to latest and use new network stack
  * podman image scp: implement --quiet
  * use libnetwork from c/common
  * Add --noout option to prevent the output of ids
  * remote events: convert TimeNano properly
  * Bump github.com/BurntSushi/toml from 0.4.1 to 1.0.0
  * vendor latest c/common
  * add additional fields to podman machine ls --json
  * buildah bud tests: skip failing tests
  * Fix permission on secrets directory
  * Add podman rm --depend
  * fix host.containers.internal entry for macvlan networks
  * It takes some time to start a VM
  * Pretty Print output of podman machine ls --format json
  * Use the InfraImage defined in containers.conf
  * Cirrus: Freshen VM images
  * Revert "Cirrus: Temp. ignore gitlab task failures"
  * pkg: use PROXY_VARS from c/common
  * ignition: add support from setting SSL_CERT_FILE
  * ignition: propogate HTTP proxy variables from host to remote
  * System tests: fix RHEL8 gating tests
  * vendor c/common
  * Remove dead RuntimeOption functions
  * Update docker cli message for case where user creates directory
  * Don't add env if optional and not found
  * Fix type-o in podman.wxs
  * [CI:DOCS] fixes indentation of example pod yaml
  * Prevent double decoding of storage options
  * Emergency system-test fixes
  * add OCI Runtime name to errors
  * fix healthcheck timeouts and ut8 coercion
  * Don't rename pod if container has the same name
  * Set volume NeedsCopyUp to false iff data was copied up
  * Fix CI
  * correct typo words in docs
  * Change Tests to ignore missing containers when removing --all
  * test/e2e/pod_initcontainers: fix a flake
  * test/e2e/run: don't use date +%N on Alpine
  * Support all volume mounts for rootless containers
  * Fix wrong 'podman search --format' placeholder
  * Fix Container List API call to return mount info
  * fix misleading comment regarding default value of cpu period [NO NEW TESTS NEEDED]
  * add --ip6 flag to podman create/run
  * legacy events: also set exitCode
  * Don't initialize the global RNG with GinkgoRandomSeed() in e2e tests
  * Avoid collisions on RemoteSocket paths
  * Refactor remote socket path determination in tests
  * fix doc
  * test/system: podman run image with filesystem permission
  * test/system: podman run with log-opt option
  * Update swagger documentation
  * Make it possible to select the volume driver
  * Check the mount type for future compatibility
  * Implement virtfs volumes for podman machine
  * [CI:DOCS] Add example of cpus to init command
  * prefix imageId with sha256: in containers list test for compat API ImageId
  * Pod Security Option support
  * ignition: add certs from current user into the machine while init
  * docs: sort swagger operations alpabetically
  * .service file removal on failure
  * Introduce Windows WSL implementation of podman machine
  * podman image scp never enter podman user NS
  * Allow users to add host user accounts to /etc/passwd
  * container creation: don't apply reserved annotations from image
  * [CI:DOCS] clarify `io.podman.annotations.seccomp`
  * Error out early if system does not support pre-copy checkpointing
  * Update go-criu to v5.3.0
  * [CI:DOCS] docs: document rootless userns mappings
  * Switch to a new installer approach using a path manipulation helper
  * e2e: Add dev/shm checkpoint/restore test
  * Enable checkpoint/restore for /dev/shm
  * Update github.com/checkpoint-restore/checkpointctl
  * Always run passwd management code when DB value is nil
  * Warn on use of --kernel-memory
  * support hosts without /etc/hosts
  * Podman run --passwd
  * ci: force scratch build for crun
  * Use hosts public ip address in rootless containers
  * compat: image normalization: handle sha256 prefix
  * specgen: honor userns=auto from containers.conf
  * [CI:DOCS] Small checkpoint/restore man page fixes
  * [CI:DOCS] Explicitly mention that checkpointing systemd containers might fail
  * vendor: update containers/storage
  * build: fix test for subid 4
  * test: add --rm to podman run commands
  * fix(generate): fix up podman generate kube missing env field bug
  * legacy events: also set Action="die"
  * rootless: include the args in the debug message
  * apiv2 tests: use quay.io/libpod/testimage:20210610 for platform tests
  * image rm: allow for force-remove infra images
  * tests: adjust old build test to expect exit code
  * Test for checkpoint specific inspect fields
  * Add more checkpoint/restore information to 'inspect'
  * build: relay exitcode from imagebuildah to registry
  * Removed .service file for healthchecks
  * Set machine timezone
  * MovePauseProcessToScope do not seed everytime
  * bindings rmi test: clarify behavior
  * bump cobra to 1.3.0
  * .github: revert to the old template
  * oci: configure the devices cgroup with default devices
  * kill: fix output
  * e2e: search flake: skip test on registry.redhat.io
  * APIv2 tests: fail on syntax/logic errors
  * Show --external containers even without --all option
  * apiv2 tests: refactor complicated curls
  * fix network id handling
  * Update Windows Install Doc
  * Fixes #12063 Add docker compatible output after image build.
  * pause scope: don't use the global math/rand RNG
  * specgen: check that networks are only set with bridge
  * container restore/import: store networks from db
  * play kube add support for multiple networks
  * support advanced network configuration via cli
  * Add new networks format to spegecen
  * fix incorrect swagger doc for network dis/connect
  * network connect allow ip, ipv6 and mac address
  * network db: add new strucutre to container create
  * remove unneeded return value from c.Networks()
  * network db rewrite: migrate existing settings
  * network ls: show networks in deterministic order
  * Bump github.com/docker/docker
  * pprof flakes: bump timeout to 20 seconds
  * Add secret list --filter to cli
  * Cirrus: Temp. ignore gitlab task failures
  * compat build: adhere to q/quiet
  * Make XRegistryAuthHeader and XRegistryConfigHeader private
  * Remove the authfile parameter of MakeXRegistryAuthHeader
  * Simplify the header decision in pkg/bindings/images.Build a bit
  * Remove the authfile parameter of MakeXRegistryConfigHeader
  * Remove no-longer-useful name variables
  * Consolidate creation of SystemContext with auth.json into a helper
  * Remove pkg/auth.Header
  * Call MakeXRegistryAuthHeader instead of Header(..., XRegistryAuthHeader)
  * Turn headerAuth into MakeXRegistryAuthHeader
  * Call MakeXRegistryConfigHeader instead of Header(..., XRegistryConfigHeader)
  * Turn headerConfig into MakeXRegistryConfigHeader
  * Move the auth file creation to GetCredentials
  * Consolidate the error handling path in GetCredentials
  * Only look up HTTP header values once in GetCredentials
  * Use Header.Values in GetCredentials.has
  * Beautify GetCredentials.has a bit
  * Pass a header value directly to parseSingleAuthHeader and parseMultiAuthHeader
  * Simplify parseSingleAuthHeader
  * Simplify the interface of parseSingleAuthHeader
  * Don't return a header name from auth.GetCredentials
  * Fix normalizeAuthFileKey to use the correct semantics
  * Rename normalize and a few variables
  * Add TestHeaderGetCredentialsRoundtrip
  * Add tests for auth.Header
  * Improve TestAuthConfigsToAuthFile
  * Add unit tests for singleAuthHeader
  * Add unit tests for multiAuthHeader
  * fix e2e test missing network cleanup
  * pprof CI flakes: enforce 5 seconds grace period
  * [NO NEW TESTS NEEDED] rootless: declare TEMP_FAILURE_RETRY before usage (Fixes: #12563)
  * --hostname should be set when using --pod new:foobar
  * Cirrus: Use cached swagger binary
  * inotify: make sure to remove files
  * System tests: remove rm_pause_image()
  * specgen: honor empty args for entrypoint
  * generate systemd: support entrypoint JSON strings
  * Bump github.com/uber/jaeger-client-go
  * remove runlabel test for global opts
  * utils: reintroduce moveToCgroup
  * autocopr: distro conditionals for containers-common
  * vendor c/image/v5@main
  * Update vendor or containers/common moving pkg/cgroups there
  * volume: apply exact permission of target directory without adding extra 0111
  * Cirrus: Remove remnants of nix-based static build
  * Refactor podman pods to report.Formatter
  * rootless netns: resolve all path components for resolv.conf
  * tests: clean up FIXMEs and noise
  * fix remote run/start flake
  * e2e: fix pprof flakes
  * Bump github.com/opencontainers/runc from 1.0.2 to 1.0.3
  * vendor c/common@main
  * Escape trailing slash in install directory location so the closing quote is not escaped
  * centos 9 stream cannot use %autochangelog
  * Refactor podman system to report.Formatter [NO NEW TESTS NEEDED]
  * add spec file for automated copr builds
  * Add restart-sec option to systemd generate
  * Fix documentation of (podman image save --compress --uncompressed)
  * Improve documentation of (podman image save --format)
  * Add support for configmap volumes to play kube
  * cmd, push: use the configured compression format
  * [CI:DOCS] logformatter: fix corner case with links
  * UPdate vendor of image-spec and containers/storage
  * vendor: update containers/common
  * Update doc to explictly mention using ed25519 in ssh keys
  * Refactor podman image command output
  * Manual fixes
  * Same thing, with BeNumerically("==", x)
  * Use HaveLen(x) instead of Expect(len(y)).To(Equal(x))
  * Same thing, for BeNumerically("==", 0)
  * Use BeEmpty() instead of len(x).To(Equal(0))
  * Same as previous, for assertions other than Equal()
  * e2e tests: a little more minor cleanup
  * compat API: push: report size of manifest
  * compat: images/json
  * Add ashley-cui, lsm5 and floutoc to owners
  * remove ARTIFACT_DIR and ArtifactPath
  * Image caches: allow overriding cache dir
  * Rename CrioRoot as just Root
  * Fix possible rootless netns cleanup race
  * [NO NEW TESTS NEEDED] Refactor podman container command output
  * Hostname in `spec.hostname` should be passed to infra ctr init opt
  * container, cgroup: detect pid termination
  * top: parse ps(1) args correctly
  * podman, push: expose --compression-format
  * e2e: yet more cleanup of BeTrue/BeFalse
  * Ensure the generated NodePort values are unique
  * Allow containerPortsToServicePorts to fail
  * Don't use the global math/rand RNG for service ports
  * Move a comment to the relevant place
  * a few more manual BeTrue cleanups
  * Convert strings.Contains() to Expect(ContainSubstring)
  * e2e tests: more cleanup of BeTrue()s
  * Implement 'podman run --blkio-weight-device'
  * systemd: replace multi-user with default.target
  * compat API: allow enforcing short-names resolution to Docker Hub
  * Fixed the containerfile not found during remote build.
  * podman-remote: prevent leaking secret into image
  * podman-remote: copy secret to contextdir is absolute path on host
  * api: allow build api to accept secrets
  * Only open save output file with WRONLY
  * List /etc/containers/certs.d as default for --cert-path
  * e2e tests: enable golint
  * fix: parsing of HostConfig.Mounts for container create
  * Move the chown to after the ADDs
  * fix: error reporting for archive endpoint
  * Bindings test: emit GIT_COMMIT, for links in logs
  * checkpoint do not modify XDG_RUNTIME_DIR
  * libpod: improve heuristic to detect cgroup
  * libpod, inspect: export cgroup path
  * stats: get the memory limit from the spec
  * compat: Add compatiblity with Docker/Moby API for scenarios where build fails
  * libpod: leave thread locked on errors
  * Find and fix empty Expect()s
  * Unset SocketLabel after system finishes checkpointing
  * Remove StringInSlice(), part 2
  * Remove StringInSlice(), part 1
  * e2e test cleanup, continued
  * Update basic_networking.md
  * Warn on failing to update container status
  * oci: ack crun output when container is not there
  * oci: exit gracefully if container is already dead
  * Support env variables based on ConfigMaps sent in payload
  * image lookup: do not match *any* tags
  * generate systemd: add --start-timeout flag
  * Oops! Manual edits to broken tests
  * e2e tests: clean up antihelpful BeTrue()s
  * Cirrus: Strip out static nix build
  * Rename pod on generate of container
  * [CI:DOCS] Update notes on java TZ in man page
  * Bump github.com/containers/image/v5 from 5.16.1 to 5.17.0
  * Fix netavark error handling and teardown issue
  * swagger: add layers to build api docs
  * compat: add layer caching compatiblity for non podman clients
  * Bump github.com/opencontainers/selinux from 1.9.1 to 1.10.0
  * Add note about volume with unprivileged container
  * Add EXPOSE e2e test
  * Support EXPOSE with port ranges
  * compat: Add subnet mask behind IP address to match Docker API
  * [CI:DOCS] Add java TZ note to run manpage
  * Bump github.com/rootless-containers/rootlesskit from 0.14.5 to 0.14.6
  * podman-remote does not support signature-policy
  * Add tests for restore runtime verification
  * Use same runtime to restore a container as during checkpointing
  * Force iptables driver for netavark tests
  * Make sure netavark output is logged to the syslog
  * filter: use filepath.Match to maintain consistency with other pattern matching in podman
  * Semiperiodic cleanup of obsolete Skip()s
  * [CI:DOCS]upload a translation file
  * api/handlers: Add checkpoint/restore FileLocks
  * test: Update error string for --file-locks test
  * fix duplicated logs command
  * Bump github.com/docker/docker
  * Bump k8s.io/api from 0.22.3 to 0.22.4
  * Do not store the exit command in container config
  * Add test for checkpoint/restore with --file-locks
  * Add --file-locks checkpoint/restore option
  * Cirrus: Bump Fedora to release 35
  * Cirrus: Partially revert catatonit --force install
  * Revert "Cirrus: Temp. disable prior-fedora testing"
  * Cirrus: Workaround log_driver=journald setting
  * Cirrus: Fix bindings test hang b/c logging config mismatch
  * Cirrus: Timeout bindings test after 30m
  * Cirrus: Log more things in bindings and unit tests
  * Minor Makefile fix
  * rootless netns, one netns per libpod tmp dir
  * Introduce Address type to be used in secondary IPv4 and IPv6 inspect data structure.
  * volumes: add new option idmap
  * remote checkpoint/restore: more fixes
  * fix CI
  * fix: take absolute path for dd on apple silicon
  * System tests: new checkpoint tests
  * rootless: use catatonit to maintain user+mnt namespace
  * rootless: drop strerror(errno) calls
  * rootless: reuse existing open_namespace function
  * rootless: use auto cleanup functions
  * utils: use podman-pause-$RANDOM.scope name
  * hack/bats: deal with new bin helpers
  * Change error message for compatibility with docker
  * rename libpod nettypes fields
  * podman machine start wait for ssh
  * fix remote checkpoint/restore
  * Add --unsetenv &amp; --unsetenv-all to remove def environment variables
  * Set config environment variables early in Podman init
  * journald logs: keep reading until the journal's end
  * secret: honor custom target for secrets with run
  * bindings: reuse context for API requests
  * podman machine improve port forwarding
  * Network test: fix podman-remote-rootless corner case
  * filter: add basic pattern matching for label keys
  * cirrus: force-install catatonit
  * infra container: replace pause with catatonit
  * Revert "add kubernetes pause"
  * Added test for checkpoint/restore --print-stats
  * Update man pages for checkpoint/restore --print-stats
  * Added optional container restore statistics
  * Added optional container checkpointing statistics
  * Error logs --follow if events-backend != journald, event-logger=journald
  * Enable 'podman run --memory-swappiness=0'
  * Fix network mode in play kube
  * Always create working directory when using compat API
  * play kube: don't force-pull infra image
  * Podman Image SCP transfer patch
  * --authfile command line argument for image sign command.
  * Cirrus: Temp. disable prior-fedora testing
  * Cirrus: Update to Ubuntu 21.10
  * Add failing run test for netavark
  * Add flag to overwrite network backend from config
  * libpod: create /etc/mtab safely
  * Add network backend to podman info
  * Add more netavark tests
  * select network backend based on config
  * Fix RUST_LOG envar for netavark
  * netavark IPAM assignment
  * netavark network interface
  * Make networking code reusable
  * Fix flake in upgrade tests
  * export adding id-specifier code to setContainerNameForTemplate
  * VOLUME must be declared after RUN chown command
  * network reload return error if we cannot reload ports
  * network reload without ports should not reload ports
  * Print headers for system connection ls
  * [CI:DOCS] Add CI check for SEE ALSO in man pages
  * podman load: support downloading files
  * Add links to all SEE ALSO sections
  * pod create: read infra image from containers.conf
  * rootless: adjust error message
  * Fix rootless networking with userns and ports
  * support health checks from image configs
  * change from run to create in 250-systemd.bats
  * Exclude already built sources for static build
  * shm_lock: Handle ENOSPC better in AllocateSemaphore
  * Fix Zsh completion command documentation
  * Match .c files in Makefile
  * Add Static Build download instructions to README
  * Add links to podman build,run, create see also
  * Minor test tweaks
  * pod create: read network mode from config
  * Bump Catatonit up to v0.1.7
  * test connection add
  * system: Adds support for removing all named destination via --all
  * pod/container create: resolve conflicts of generated names
  * podman-generate-kube - remove empty structs from YAML
  * Add some information about disabling SELinux when using system volumes
  * Fix swagger definition for the new mac address type
  * Log Apache access_log-like entries at Info level [NO NEW TESTS NEEDED]
  * Test to check for presence of 'stats-dump' in exported checkpoints
  * Add 'stats-dump' file to exported checkpoint
  * Podman Image SCP rootful to rootless transfer
  * rename rootless cni ns to rootless netns
  * mount full XDG_RUNTIME_DIR in rootless cni ns
  * Bump github.com/checkpoint-restore/go-criu/v5 from 5.1.0 to 5.2.0
  * Keep error semantics intact
  * Fix rootless cni netns cleanup logic
  * tweak a couple of flag descriptions in help output
  * Update swagger doc make filed optional
  * Fix bindings container log test
  * test: run --cgroups=split in new cgroup
  * MAC address json unmarshal should allow strings
  * Make stop message more similar to start
  * Implement top streaming for containers and pods
  * Handle HTTP 409 error messages properly for Pod actions
  * Add tests
  * Fix swagger definitions
  * More conforming libpod API and swagger types
  * More conforming libpod API and swagger types
  * Better emptiness test for custom JSON serializer
  * System tests: enhance volume test, add debug prints
  * add unit test to containers_test
  * Use correct swagger type in doc-comment
  * Cirrus: Authorize rootless user self-ssh
  * Fix libpod API conformance to swagger
  * Fix help message case for `podman version`
  * Fix pause usage example
  * Use systemctl in local system test
  * Allow label and labels when creating volumes
  * volumes: be more tolerant and fix infinite loop
  * Add information on how podman machine is updated
  * volumes: allow more options for devpts
  * volumes: do not pass mount opt as formatter string
  * Bump k8s.io/api from 0.22.2 to 0.22.3
  * runtime: change PID existence check
  * oci: rename sub-cgroup to runtime instead of supervisor
  * libpod: deduplicate ports in db
  * Set flags to test 'logs -f' with journald driver
  * Set Checkpointed state to false after restore
  * container create: fix --tls-verify parsing
  * runtime: check for pause pid existence
  * utils: do not overwrite the err variable
  * Fix systemd PID1 test
  * Record the image stream along with the path
  * cgroups: use SessionBusPrivateNoAutoStartup
  * vendor: update godbus to v5.0.6
  * Slirp4netns with ipv6 set net.ipv6.conf.default.accept_dad=0
  * Fix a few problems in 'podman logs --tail' with journald driver
  * Allow 'container restore' with '--ipc host'
  * Document to not set K8S envars for CNI
  * Bump github.com/docker/docker
  * pod create: remove need for pause image
  * add kubernetes pause
  * cirrus: containers: mount directory in /var/tmp to /tmp
  * overlay root fs: create mount on runtime dir
  * Update vendor github.com/opencontainers/runtime-tools
  * If Dockerfile exists in same directory as service, we should not use it.
  * Fix tests of podman image trust --raw and --json
  * Tighten the expected output of the "podman image trust show" test
  * Use INTEGRATION_ROOT instead of current directory
  * Add support to play kube for --log-opt
  * [NO NEW TESTS NEEDED] Fix off-by-one index comparision (reported by LGTM)
  * Fix some typos in documentation and comments (found by codespell)
  * Replace 'an user' =&gt; 'a user'
  * [CI:DOCS] Fix typo keep_id -&gt; keep-id
  * Set DOCKER_HOST in the VM
  * fuse-overlay probably means fuse-overlayfs.
  * Support template unit files in podman generate systemd
  * Remove --kernel-memory options
  * tag: Support tagging manifest list instead of resolving to images
  * Remove infra ID from DB before removing containers
  * System tests: confirm that -a and -l clash
  * systemd: compatible with rootless mode
  * system tests: CONTAINER_* and --help: cleanup
  * podman run --memory=0 ... should not set memory limit
  * Add information on how to discover default log driver
  * Add test for system connection
  * Generate Kube should not print default structs
  * libpod: change mountpoint ownership c.Root when using overlay on top of external rootfs
  * Change podman connection list to use default field
  * Allow API to specify size and inode quota
  * Use exponential backoff when waiting for a journal entry
  * Pod Rm Infra Improvements
  * system tests: socket activation: clean up
  * rootfs-overlay: fix overlaybase path for cleanups
  * Move CONTAINER_HOST and _CONNECTION to IsRemote Function
  * We should only be relabeling when on first run
  * If CONTAINER_HOST env variable is set default podman --remote=true
  * Set targetPort to the port value in the kube yaml
  * Do not add TCP to protocol in generated kube yaml
  * Use CGO_ENABLED=1 when building natively on darwin
  * Test-hang fix: Wait for ready + timeout on connect.
  * Checkpoint/Restore test fixes
  * Don't include ctr.log if not using file logging
  * Don't use docker/pkg/archive, use containers/storage/pkg/archive
  * Fix codespell errors
  * Adjust tests to verify all subcommands show the help message
  * Fix panic in container create compat api
  * Don't add image entrypoint to the generate kube yaml
  * Display help text on empty subcommand by default
  * podman search: display only name and description by default
  * codespell code
  * Add information about .containerignore to podman build man page
  * CNI: fix network create --ip-range
  * Kube Gen run as user/group issues
  * rootlessport: reduce memory usage of the process
  * No space in kube annotations for bind mounts
  * Fix CI flake on time of shutdown for API service
  * Refactor podman search to be more code friendly
  * Unit files: Use actual installed path for podman
  * Bump github.com/onsi/ginkgo from 1.16.4 to 1.16.5
  * cgroups: use cgroup.controllers to read controllers
  * builder: Add support for builder prune
  * Remove a volume with --force if container is running
  * Use SplitN(2) when copying env variables
  * podman stats: move cgroup validation to server
  * fix test
  * Support readonly rootfs contains colon
  * [CI:DOCS] oci-hooks.5.md: fixup section in header
  * Enable /debug/pprof API service endpoints
  * Not all fields in machine list were set properly
  * faster image inspection
  * Warn if podman stop timeout expires that sigkill was sent
  * [CI:DOCS] introduce --replace flag for play kube
  * [CI:DOCS] Include manifest example usage
  * Change podman.1 man page to show corret log-level default
  * Bump github.com/opencontainers/selinux from 1.8.5 to 1.9.1
  * Fixes #11668
  * libpod: fix race when closing STDIN
  * Ensure `podman ps --sync` functions
  * Allow `podman stop` to be run on Stopping containers
  * Bump github.com/containers/image/v5 from 5.16.0 to 5.16.1
  * Bump github.com/docker/docker
  * It really should be no **NEW** tests needed
  * README.md: Point to Podman's channels
  * Add podman-plugins to upstream image
  * CNI networks: reload networks if needed
  * bump c/common to latest and c/storage to 1.37.0
  * Add --time out for podman * rm  -f commands
  * Cirrus: Fix defunct package metadata breaking cache
  * Pod Events Logging Fix
  * [NO TESTS NEEDED] Ignore removed containers
  * Pod Volumes From Support
  * Add note about empty fields and null values for API responses
  * Bump github.com/containers/buildah from 1.23.0 to 1.23.1
  * Add podman play kube --no-hosts options
  * Gating tests: fix permissions error
  * pkg/specgen: cache image in generator
  * cirrus: gitlab: download packages
  * Add guard for BuildOptions.CommonBuildOpts
  * System tests: tighten 'is' operator
  * Update README and release notes for v3.4.0
  * sdnotify test: accept MAINPID anywhere
  * machine: silently cleanup dangling sockets before rm if possible
  * Add expose type map[uint16]string to description
  * [NO TESTS NEEDED] Fix typo in storage.conf file exists message
  * Support selinux options with bind mounts play/gen
  * kube: fix conversion from milliCPU to period/quota
  * Bump github.com/mattn/go-isatty from 0.0.12 to 0.0.14
  * test: use new helper
  * test: skip test on rootless cgroupsv1
  * machine: Info on successfully stopping qemu machine
  * Allow a value of -1 to set unlimited pids limit
  * Vendor in latest containers/storage
  * Storage can remove ErrNotAContainer as well
  * libpod: container create: init variable: do not deep copy spec
  * libpod: add GetConfigNoCopy()
  * libpod: add execSessionNoCopy
  * libpod: do not call (*container).Spec()
  * Pod Device-Read-BPS support
  * Remind user to check connection or use podman machine
  * Ensure pod ID bucket is properly updated on rename
  * Fix contributor make targets on Ubuntu and Debian
  * Implement PR template to assist review &amp; release
  * libpod: do not call (*container).Config()
  * [NO TESTS NEEDED] Add port configuration to first regular container
  * [CI:DOCS] cmd/podman: no dot for short descriptions
  * move network alias validation to container create
  * set --cni-config-dir for exit command
  * always add short container id as net alias
  * image prune: support removing external containers
  * System tests: speed up. They've gotten too slow.
  * Add dockerfile.5 as man link to containerfile man page
  * Set MSI to be 64-bit only.
  * fix podman network prune integration test flakes
  * Cirrus: Add gitlab podman runner test
  * CNI: network remove do not error for ENOENT
  * remote build: EvalSymlinks() the context directory
  * stop: Do nothing if container was never created in runtime
  * logging: new mode -l passthrough
  * Allow machine options to be set from containers.conf
  * Vendor in containers/common v0.46.0
  * podman machine: do not join userns
  * Disable docker and alias to podman in FCOS ignition
  * added healthcheck to ps command
  * Fix english on prune prompt
  * Document missing /images/search query parameters
  * rootful: do not set XDG_RUNTIME_DIR for cni plugins
  * Revert "rootful: unset XDG_RUNTIME_DIR"
  * Add completion for machine list format
  * Set context dir for play kube build
  * Makefile: use -ldflags/-gccgoflags depending on the go implemenatiton
  * Update docs for --platform in podman-build.1
  * shell completion: do not show images without tag
  * podman inspect add State.Health field for docker compat
  * podman save: enforce signature removal
  * Add JSON version of the machine list
  * Add support for :U flag with --mount option
  * [CI:DOCS] Add link to running ctrimage on enablesysadm
  * Ignore mount errors except ErrContainerUnknown when cleaningup container
  * standardize logrus messages to upper case
  * podman generate kube should not include images command
  * Fix machine image
  * sync container state before reading the healthcheck
  * Also show the (initial) disk size
  * Show cpus and memory in machine list
  * Eighty-six eighty-eighty
  * net types: remove omitempty from required fields
  * podman save: add `--uncompressed`
  * Bump CNI to v1.0.1
  * vendor c/psgo@v1.7.1
  * [CI:DOCS] Add network alias note in man pages
  * Add a backoff and retries to retrieving exited event
  * Cross-build release-archives w/ arch in filename
  * Fix Error, empty output for info: 'VERSION'
  * Generate kube should'd add podman default environment vars
  * volume: Add support for overlay on named volumes
  * Pod Device Support
  * Support --format tables in ps output
  * Remove references to kube being development
  * Add support for retrieving system service --timeout
  * Add podman image/container inspect man pages
  * [CI:DOCS] Add link to skopeo delete in podman rmi
  * vendor c/common@main
  * remote untag: support digests
  * Created MapOptions for PodCreate
  * Bump k8s.io/api from 0.22.1 to 0.22.2
  * compat API: /images/json prefix image id with sha256
  * podman machine: use gvproxy for host.containers.internal
  * utils: return error message from StartTransientUnit
  * utils: raise warning only on cgroupv2
  * Add podman machine init --now option
  * System tests: cleanup, and remove obsolete skips
  * Add username flag for machine ssh
  * Remove unused code from libpod
  * [CI:DOCS] markdown cleanup
  * Fix up build the docs site
  * Use a new markdown converter for sphinx
  * runtime: move pause process to scope
  * system: move MovePauseProcessToScope to utils
  * system: always move pause process when running on systemd
  * system: avoid reading pause pid file
  * Only add 127.0.0.1 entry to /etc/hosts with --net=none
  * Add no-trunc support to podman-events
  * CNI: add ipvlan driver
  * CNI: network create support macvlan modes
  * Do not allow network modes to be used as network names
  * fix inverted condition
  * Fix /auth compat endpoint
  * Add Drivers method to the Network Interface
  * CI: load ipv6 kernel modules for rootless tests
  * Drop OCICNI dependency
  * Wire network interface into libpod
  * cni network configs set ipv6 enables correctly
  * default network: do not validate the used subnets
  * network create: validate the input subnet
  * Set default storage from containers.conf for temporary images
  * container runlabel remove image tag from name
  * build.bats: fix copy tests after containers/buildah#3486
  * build: mirror --authfile to filesystem if pointing to FD instead of file
  * Fix example in podman machine init man page
  * vendor: Bump github.com/containers/buildah from 1.22.3 to 1.23.0
  * api: handle nil pointer dereference in rest endpoints
  * build: take advantage of --platform lists
  * Document `all` query parameter for /libpod/images/prune
  * Show variant and codename of the distribution
  * Use new aarch64 fcos repos
  * Enhance bindings for IDE hints
  * Pod Volumes Support
  * test: enable --cgroup-parent test
  * libpod: honor --cgroups=split also with pods
  * tests: enable --cgroups=disabled test for rootless
  * tests: simplify --cgroups=disabled test
  * libpod: rootful close binded ports
  * Search gvproxy with config.FindHelperBinary()
  * rootfs: Add support for rootfs-overlay and bump to buildah v1.22.1-0.202108
  * fix restart always with rootlessport
  * Cirrus: NM/CNI workaround + Remove prior-Ubuntu
  * If container exits with 125 podman should exit with 125
  * Bump github.com/json-iterator/go from 1.1.11 to 1.1.12
  * bump c/common to v0.44.0
  * remove rootlessport socket to prevent EADDRINUSE
  * Add deprecated fields for 1.22+ clients that still expect them
  * Use default username for podman machine ssh</changelog>
  <changelog author="michael@stroeder.com" date="1648814400">- Update to version 4.0.3:
  * Security
  - This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.
  * Changes
  - The podman machine rm --force command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
  - When a podman machine VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).
  * Bugfixes
  - Fixed a bug where devices added to containers by the --device option to podman run and podman create would not be accessible within the container.
  - Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
  - Fixed a bug where pods would be created with cgroups even if cgroups were disabled in containers.conf (#13411).
  - Fixed a bug where the podman play kube command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
  - Fixed a bug where the podman machine rm command would not remove the Podman API socket on the host that was associated with the VM.
  - Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
  - Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
  - Fixed a bug where the podman version command could sometimes print excess blank lines as part of its output.
  - Fixed a bug where the podman generate systemd command would sometimes generate systemd services with names beginning with a hyphen (#13272).
  - Fixed a bug where locally building the pause image could fail if the current directory contained a .dockerignore file (#13529).
  - Fixed a bug where root containers in VMs created by podman machine could not bind ports to specific IPs on the host (#13543).
  - Fixed a bug where the storage utilization percentages displayed by podman system df were incorrect (#13516).
  - Fixed a bug where the CPU utilization percentages displayed by podman stats were incorrect (#13597).
  - Fixed a bug where containers created with the --no-healthcheck option would still display healthcheck status in podman inspect (#13578).
  - Fixed a bug where the podman pod rm command could print a warning about a missing cgroup (#13382).
  - Fixed a bug where the podman exec command could sometimes print a timed out waiting for file error after the process in the container exited (#13227).
  - Fixed a bug where virtual machines created by podman machine were not tolerant of changes to the path to the qemu binary on the host (#13394).
  - Fixed a bug where the remote Podman client's podman build command did not properly handle the context directory if a Containerfile was manually specified using -f (#13293).
  - Fixed a bug where Podman would not properly detect the use of systemd as PID 1 in a container when the entrypoint was prefixed with /bin/sh -c (#13324).
  - Fixed a bug where rootless Podman could, on systems that do not use systemd as init, print a warning message about the rootless network namespace (#13703).
  - Fixed a bug where the default systemd unit file for podman system service did not delegate all cgroup controllers, resulting in podman info queries against the remote API returning incorrect cgroup controllers (#13710).
  - Fixed a bug where the slirp4netns port forwarder for rootless Podman would only publish the first port of a range (#13643).
  * API
  - Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).
  * Misc
  - The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
  - Updated Buildah to v1.24.3
  - Updated the containers/storage library to v1.38.3
  - Updated the containers/image library to v5.19.2
  - Updated the containers/common library to v0.47.5</changelog>
  <changelog author="fvogt@suse.com" date="1649332800">- Add patch to fix starting containers on btrfs with SELinux
  (gh#opencontainers/selinux#172):
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
- Add patch to fix starting containers as user service with systemd 250
  (boo#1197672, gh#containers/podman#13731):
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch</changelog>
  <changelog author="fvogt@suse.com" date="1649332801">- Add patch to make buildah happy after selinux change:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch</changelog>
  <changelog author="rbrown@suse.com" date="1649764800">- Require catatonit &gt;= 0.1.7 for pause functionality needed by pods</changelog>
  <changelog author="dfaggioli@suse.com" date="1653307200">- Backport upstream commit be5abf03ababc ("fix: Container.cGroupPath()
  skip empty line to avoid false error logging") for fixing "Error parsing
  cgroup: expected 3 fields but got 1" (see bsc#1199790, as it applies
  to Factory/Tumbleweed too)
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="rbrown@suse.com" date="1655899200">- Update to version 4.1.1:
  * The output of the podman load command now mirrors that of docker load.
  * Podman now supports Docker Compose v2.2 and higher. Please note that it may be necessary to disable the use of Buildkit by setting the environment variable DOCKER_BUILDKIT=0.
  * A new container command has been added, podman container clone. This command makes a copy of an existing container, with the ability to change some settings (e.g. resource limits) while doing so.
  * Podman now supports sending JSON events related to machines to a Unix socket named machine_events.*\.sock in XDG_RUNTIME_DIR/podman or to a socket whose path is set in the PODMAN_MACHINE_EVENTS_SOCK environment variable.
  * Two new volume commands have been added, podman volume mount and podman volume unmount. These allow for Podman-managed named volumes to be mounted and accessed from outside containers.
  * The podman container checkpoint and podman container restore options now support checkpointing to and restoring from OCI images. This allows checkpoints to be distributed via standard image registries.
  * The podman play kube command now supports environment variables that are specified using the fieldRef and resourceFieldRef sources.
  * The podman play kube command will now set default resource limits when the provided YAML does not include them.
  * The podman play kube command now supports a new option, --annotation, to add annotations to created containers.
  * The podman play kube --build command now supports a new option, --context-dir, which allows the user to specify the context directory to use when building the Containerfile.
  * The podman container commit command now supports a new option, --squash, which squashes the generated image into a single layer.
  * The podman pod logs command now supports two new options, --names, which identifies which container generated a log message by name, instead of ID and --color, which colors messages based on what container generated them.
  * The podman rmi command now supports a new option, --ignore, which will ignore errors caused by missing images.
  * The podman network create command now features a new option, --ipam-driver, to specify details about how IP addresses are assigned to containers in the network.
  * The podman machine list command now features a new option, --quiet, to print only the names of configured VMs and no other information.
  * The --ipc option to the podman create, podman run, and podman pod create commands now supports three new modes: none, private, and shareable. The default IPC mode is now shareable, indicating the the IPC namespace can be shared with other containers.
  * The --mount option to the podman create and podman run commands can now set options for created named volumes via the volume-opt parameter.
  * The --mount option to the podman create and podman run commands now allows parameters to be passed in CSV format.
  * The --userns option to the podman create and podman run commands now supports a new option, nomap, that (only for rootless containers) does not map the UID of the user that started the container into the container, increasing security.
  * The podman import command now supports three new options, --arch, --os, and --variant, to specify what system the imported image was built for.
  * The podman inspect command now includes information on the network configuration of containers that joined a pre-configured network namespace with the --net ns: option to podman run, podman create, and podman pod create.
  * The podman run and podman create commands now support a new option, --chrootdirs, which specifies additional locations where container-specific files managed by Podman (e.g. /etc/hosts, `/etc/resolv.conf, etc) will be mounted inside the container (#12961).
  * The podman run and podman create commands now support a new option, --passwd-entry, allowing entries to be added to the container's /etc/passwd file.
  * The podman images --format command now accepts two new format directives: {{.CreatedAt}} and {{.CreatedSince}}.
  * The podman volume create command's -o option now accepts a new argument, o=noquota, to disable XFS quotas entirely and avoid potential issues when Podman is run on an XFS filesystem with existing quotas defined.
  * The podman info command now includes additional information on the machine Podman is running on, including disk utilization on the drive Podman is storing containers and images on, and CPU utilization.
  * Fix CVE-2022-27191 / bsc#1197284
- Drop obsolete patches:
  * 0001-Adjust-buildah-to-opencontainers-selinux-v1.10.1.patch
  * 0001-Relabel-relabel-links-instead-of-their-targets.patch
  * 0002-specgen-do-not-set-OOMScoreAdj-by-default.patch
  * 0004-fix-Container.cGroupPath-skip-empty-line-to-avoid-fa.patch</changelog>
  <changelog author="predivan@mts.rs" date="1656676800">- Fix build on Leap
    Use libexec macro to set correct, per-distribution specific, directory.</changelog>
  <changelog author="michael@stroeder.com" date="1660219200">- Update to version 4.2.0:
  * Features
  - Podman now supports the Gitlab Runner (using the Docker executor), allowing its use in Gitlab CI/CD pipelines.
  - A new command has been added, podman pod clone, to create a copy of an existing pod. It supports several options, including --start to start the new pod, --destroy to remove the original pod, and --name to change the name of the new pod (#12843).
  - A new command has been added, podman volume reload, to sync changes in state between Podman's database and any configured volume plugins (#14207).
  - A new command has been added, podman machine info, which displays information about the host and the versions of various machine components.
  - Pods created by podman play kube can now be managed by systemd unit files. This can be done via a new systemd service, podman-kube@.service - e.g. systemctl --user start podman-play-kube@$(systemd-escape my.yaml).service will run the Kubernetes pod or deployment contained in my.yaml under systemd.
  - The podman play kube command now honors the RunAsUser, RunAsGroup, and SupplementalGroups setting from the Kubernetes pod's security context.
  - The podman play kube command now supports volumes with the BlockDevice and CharDevice types (#13951).
  - The podman play kube command now features a new flag, --userns, to set the user namespace of created pods. Two values are allowed at present: host and auto (#7504).
  - The podman play kube command now supports setting the type of created init containers via the io.podman.annotations.init.container.type annotation.
  - Pods now have include an exit policy (configurable via the --exit-policy option to podman pod create), which determines what will happen to the pod's infra container when the entire pod stops. The default, continue, acts as Podman currently does, while a new option, stop, stops the infra container after the last container in the pod stops, and is used by default for pods from podman play kube (#13464).
  - The podman pod create command now allows the pod's name to be specified as an argument, instead of using the --name option - for example, podman pod create mypod instead of the prior podman pod create --name mypod. Please note that the --name option is not deprecated and will continue to work.
  - The podman pod create command's --share option now supports adding namespaces to the set by prefacing them with + (as opposed to specifying all namespaces that should be shared) (#13422).
  - The podman pod create command has a new option, --shm-size, to specify the size of the /dev/shm mount that will be shared if the pod shares its UTS namespace (#14609).
  - The podman pod create command has a new option, --uts, to configure the UTS namespace that will be shared by containers in the pod.
  - The podman pod create command now supports setting pod-level resource limits via the --cpus, --cpuset-cpus, and --memory options. These will set a limit for all containers in the pod, while individual containers within the pod are allowed to set further limits. Look forward to more options for resource limits in our next release!
  - The podman create and podman run commands now include the -c short option for the --cpu-shares option.
  - The podman create and podman run commands can now create containers from a manifest list (and not an image) as long as the --platform option is specified (#14773).
  - The podman build command now supports a new option, --cpp-flag, to specify options for the C preprocessor when using Containerfile.in files that require preprocessing.
  - The podman build command now supports a new option, --build-context, allowing the user to specify an additional build context.
  - The podman machine inspect command now prints the location of the VM's Podman API socket on the host (#14231).
  - The podman machine init command on Windows now fetches an image with packages pre-installed (#14698).
  - Unused, cached Podman machine VM images are now cleaned up automatically. Note that because Podman now caches in a different directory, this will not clean up old images pulled before this change (#14697).
  - The default for the --image-volume option to podman run and podman create can now have its default set through the image_volume_mode setting in containers.conf (#14230).
  - Overlay volumes now support two new options, workdir and upperdir, to allow multiple overlay volumes from different containers to reuse the same workdir or upperdir (#14427).
  - The podman volume create command now supports two new options, copy and nocopy, to control whether contents from the overmounted folder in a container will be copied into the newly-created named volume (copy-up).
  - Volumes created using a volume plugin can now specify a timeout for all operations that contact the volume plugin (replacing the standard 5 second timeout) via the --opt o=timeout= option to podman volume create (BZ 2080458).
  - The podman volume ls command's --filter name= option now supports regular expression matching for volume names (#14583).
  - When used with a podman machine VM, volumes now support specification of the 9p security model using the security_model option to podman create -v and podman run -v.
  - The remote Podman client's podman push command now supports the --remove-signatures option (#14558).
  - The remote Podman client now supports the podman image scp command.
  - The podman image scp command now supports tagging the transferred image with a new name.
  - The podman network ls command supports a new filter, --filter dangling=, to list networks not presently used by any containers (#14595).
  - The --condition option to podman wait can now be specified multiple times to wait on any one of multiple conditions.
  - The podman events command now includes the -f short option for the --filter option.
  - The podman pull command now includes the -a short option for the --all-tags option.
  - The podman stop command now includes a new flag, --filter, to filter which containers will be stopped (e.g. podman stop --all --filter label=COM.MY.APP).
  - The Podman global option --url now has two aliases: -H and --host.
  - The podman network create command now supports a new option with the default bridge driver, --opt isolate=, which isolates the network by blocking any traffic from it to any other network with the isolate option enabled. This option is enabled by default for networks created using the Docker-compatible API.
  - Added the ability to create sigstore signatures in podman push and podman manifest push.
  - Added an option to read image signing passphrase from a file.
  * Changes
  - Paused containers can now be killed with the podman kill command.
  - The podman system prune command now removes unused networks.
  - The --userns=keep-id and --userns=nomap options to the podman run and podman create commands are no longer allowed (instead of simply being ignored) with root Podman.
  - If the /run directory for a container is part of a volume, Podman will not create the /run/.containerenv file (#14577).
  - The podman machine stop command on macOS now waits for the machine to be completely stopped to exit (#14148).
  - All podman machine commands now only support being run as rootless, given that VMs only functioned when run rootless.
  - The podman unpause --all command will now only attempt to unpause containers that are paused, not all containers.
  - Init containers created with podman play kube now default to the once type (#14877).
  - Pods created with no shared namespaces will no longer create an infra container unless one is explicitly requested (#15048).
  - The podman create, podman run, and podman cp commands can now autocomplete paths in the image or container via the shell completion.
  - The libpod/common package has been removed as it's not used anywhere.
  - The --userns option to podman create and podman run is no longer accepted when an explicit UID or GID mapping is specified (#15233).
  * Bugfixes
  - Fixed a bug where bind-mounting /dev into a container which used the --init flag would cause the container to fail to start (#14251).
  - Fixed a bug where the podman image mount command would not pretty-print its output when multiple images were mounted.
  - Fixed a bug where the podman volume import command would print an unrelated error when attempting to import into a nonexistent volume (#14411).
  - Fixed a bug where the podman system reset command could race against other Podman commands (#9075).
  - Fixed a bug where privileged containers were not able to restart if the layout of host devices changed (#13899).
  - Fixed a bug where the podman cp command would overwrite directories with non-directories and vice versa. A new --overwrite flag to podman cp allows for retaining the old behavior if needed (#14420).
  - Fixed a bug where the podman machine ssh command would not preserve the exit code from the command run via ssh (#14401).
  - Fixed a bug where VMs created by podman machine would fail to start when created with more than 3072MB of RAM on Macs with M1 CPUs (#14303).
  - Fixed a bug where the podman machine init command would fail when run from C:\Windows\System32 on Windows systems (#14416).
  - Fixed a bug where the podman machine init --now did not respect proxy environment variables (#14640).
  - Fixed a bug where the podman machine init command would fail if there is no $HOME/.ssh dir (#14572).
  - Fixed a bug where the podman machine init command would add a connection even if creating the VM failed (#15154).
  - Fixed a bug where interrupting the podman machine start command could render the VM unable to start.
  - Fixed a bug where the podman machine list --format command would still print a heading.
  - Fixed a bug where the podman machine list command did not properly set the Starting field (#14738).
  - Fixed a bug where the podman machine start command could fail to start QEMU VMs when the machine name started with a number.
  - Fixed a bug where Podman Machine VMs with proxy variables could not be started more than once (#14636 and #14837).
  - Fixed a bug where containers created using the Podman API would, when the Podman API service was managed by systemd, be killed when the API service was stopped (BZ 2052697).
  - Fixed a bug where the podman -h command did not show help output.
  - Fixed a bug where the podman wait command (and the associated REST API endpoint) could return before a container had fully exited, breaking some tools like the Gitlab Runner.
  - Fixed a bug where healthchecks generated exec events, instead of health_status events (#13493).
  - Fixed a bug where the podman pod ps command could return an error when run at the same time as podman pod rm (#14736).
  - Fixed a bug where the podman systemd df command incorrectly calculated reclaimable storage for volumes (#13516).
  - Fixed a bug where an exported container checkpoint using a non-default OCI runtime could not be restored.
  - Fixed a bug where Podman, when used with a recent runc version, could not remove paused containers.
  - Fixed a bug where the remote Podman client's podman manifest rm command would remove images, not manifests (#14763).
  - Fixed a bug where Podman did not correctly parse wildcards for device major number in the podman run and podman create commands' --device-cgroup-rule option.
  - Fixed a bug where the podman play kube command on 32 bit systems where the total memory was calculated incorrectly (#14819).
  - Fixed a bug where the podman generate kube command could set ports and hostname incorrectly in generated YAML (#13030).
  - Fixed a bug where the podman system df --format "{{ json . }}" command would not output the Size and Reclaimable fields (#14769).
  - Fixed a bug where the remote Podman client's podman pull command would display duplicate progress output.
  - Fixed a bug where the podman system service command could leak memory when a client unexpectedly closed a connection when reading events or logs (#14879).
  - Fixed a bug where Podman containers could fail to run if the image did not contain an /etc/passwd file (#14966).
  - Fixed a bug where the remote Podman client's podman push command did not display progress information (#14971).
  - Fixed a bug where a lock ordering issue could cause podman pod rm to deadlock if it was run at the same time as a command that attempted to lock multiple containers at once (#14929).
  - Fixed a bug where the podman rm --force command would exit with a non-0 code if the container in question did not exist (#14612).
  - Fixed a bug where the podman container restore command would fail when attempting to restore a checkpoint for a container with the same name as an image (#15055).
  - Fixed a bug where the podman manifest push --rm command could remove image, instead of manifest lists (#15033).
  - Fixed a bug where the podman run --rm command could fail to remove the container if it failed to start (#15049).
  - Fixed a bug where the podman generate systemd --new command would create incorrect unit files when the container was created with the --sdnotify parameter (#15052).
  - Fixed a bug where the podman generate systemd --new command would fail when -h &lt;hostname&gt; was used to create the container (#15124).
  * API
  - The Docker-compatible API now supports API version v1.41 (#14204).
  - Fixed a bug where containers created via the Libpod API had an incorrect umask set (#15036).
  - Fixed a bug where the remote parameter to the Libpod API's Build endpoint for Images was nonfunctional (#13831).
  - Fixed a bug where the Libpod List endpoint for Containers did not return the application/json content type header when there were no containers present (#14647).
  - Fixed a bug where the Compat Stats endpoint for Containers could return incorrect memory limits (#14676).
  - Fixed a bug where the Compat List and Inspect endpoints for Containers could return incorrect strings for container status.
  - Fixed a bug where the Compat Create endpoint for Containers did not properly handle disabling healthchecks (#14493).
  - Fixed a bug where the Compat Create endpoint for Networks did not support the mtu, name, mode, and parent options (#14482).
  - Fixed a bug where the Compat Create endpoint for Networks did not allow the creation of networks name bridge (#14983).
  - Fixed a bug where the Compat Inspect endpoint for Networks did not properly set netmasks in the SecondaryIPAddresses and SecondaryIPv6Addresses fields (#14674).
  - The Libpod Stats endpoint for Pods now supports streaming output via two new parameters, stream and delay (#14674).
  * Misc
  - Podman will now check for nameservers in /run/NetworkManager/no-stub-resolv.conf if the /etc/resolv.conf file only contains a localhost server.
  - The podman build command now supports caching with builds that specify --squash-all by allowing the --layers flag to be used at the same time.
  - Podman Machine support for QEMU installations at non-default paths has been improved.
  - The podman machine ssh command no longer prints spurious warnings every time it is run.
  - When accessing the WSL prompt on Windows, the rootless user will be preferred.
  - The podman info command now includes a field for information on supported authentication plugins for improved Docker compatibility. Authentication plugins are not presently supported by Podman, so this field is always empty.
  - The podman system prune command now no longer prints the Deleted Images header if no images were pruned.
  - The podman system service command now automatically creates and moves to a sub-cgroup when running in the root cgroup (#14573).
  - Updated Buildah to v1.27.0 (fixes CVE-2022-21698 / bsc#1196338)
  - Updated the containers/image library to v5.22.0
  - Updated the containers/storage library to v1.42.0 (fixes bsc#1196751)
  - Updated the containers/common library to v0.49.1
  - Podman will automatically create a sub-cgroup and move itself into it when it detects that it is running inside a container (#14884).
  - Fixed an incorrect release note about regexp.
  - A new MacOS installer (via pkginstaller) is now supported.</changelog>
  <changelog author="asarai@suse.com" date="1663761600">- Update to version 4.2.1:
  * Bump to v4.2.1
  * Add release notes for v4.2.1
  * remove SkipIfNotFedora() from events test
  * fix podman events with custom format
  * Drop stale config value resulting in asymmetric config
  * Fix list of default capabilities
  * Add container GID to additional groups (CVE-2022-2989 / bsc#1202809, removes patch 0001-Add-container-GID-to-additional-groups.patch)
  * libpod: Ensure that generated container names are random
  * Fix bind-mount-option annotation in gen/play kube
  * Improved Windows compatibility for machine command
  * updated apiv2 tests to reflect hash compat fix
  * api: return imageID instead of imageName, for "Image" when Podman API is queried
  * Inhibit SIGTERM during Conmon startup
  * Fix example sections to follow the same format
  * Fix template name inconsistency
  * service: make move to sub-cgroup non fatal
  * Remove duplicate annotations in generated service yaml
  * Compat API image remove events now have 'delete' status
  * [CI:DOCS] Automatically set podman version in pkginstaller
  * Allow colons in windows file paths
  * Fixes isRootfull check using qemu machine on Windows
  * vendor containers/psgo@v1.7.3
  * Allow podman to run in an environment with keys containing spaces
  * Document restrictions on transport in FROM
  * Improved Windows compatibility
  * pass environment variables to container clone
  * podman save: update --compress validation
  * sort hc.Binds returned from compat api
  * Cirrus: Update podman-machine comment
  * podman images and friends can take one image as argument
  * [CI:DOCS] Add .DS_Store to gitignore
  * podman-kube@.service.in: Remove Restart=never option with typo
  * Fix #15499 already connected network
  * [CI:DOCS] Cirrus: Update meta-task for EC2 image
  * fix CI: remove hardcodeded alpine version
  * fix CI: remove hardcodeded alpine version
  * Preserve all unknown PolicyRequirement fields on (podman image trust set)
  * Reorganize the types in policy.go a bit
  * Add support for showing keyPaths in (podman image trust show)
  * Support (image trust show) for sigstoreSigned entries
  * BREAKING CHANGE: Change how (podman image trust show) represents multiple requirements
  * Reorganize descriptionsOfPolicyRequirements a bit
  * Use the full descriptionsOfPolicyRequirements for the default scope
  * Rename haveMatchRegistry to registriesDConfigurationForScope
  * Rename tempTrustShowOutput to entry
  * Split descriptionsOfPolicyRequirements out of getPolicyShowOutput
  * Recognize the new lookaside names for simple signing sigstore
  * Add a unit test for trust.PolicyDescription
  * Make the output of (podman image trust show) deterministic
  * Make most of pkg/trust package-private
  * Move most of ImageEngine.ShowTrust into pkg/trust.PolicyDescription
  * Add support for sigstoreSigned in (podman image trust set)
  * Create new policy entries together with validating input
  * Improve validation of data in ImageEngine.SetTrust
  * Move most of imageEngine.SetTrust to pkg/trust.AddPolicyEntries
  * Add a variable for scope
  * Make trust.CreateTempFile private
  * Reorganize pkg/trust
  * Remove an unused trust.ShowOutput type
  * Remove commented out code
  * libpod: UpdateContainerStatus: do not wait for container
  * Skip / update some tests under runc
  * Bump to v4.2.1-dev
  * test: update apply-podman-deltas for new tests
  * build: implement --cache-to,--cache-from and --cache-ttl
  * vendor: bump buildah to v1.27.0</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- switch to building with go 1.17
- use %%make_* macros
- drop /usr/share/user-tmpfiles.d/podman-docker.conf on SLE &amp; Leap
- remove rpmlintrc (contained only obsolete filters)
- remove obsolete with_libostree (we don't build on anything older than SLE 15)
- add patch: 0001-Revert-Default-missing-hostPort-to-containerPort-is-.patch
  (hotfix for https://github.com/containers/podman/issues/16765)
- Update to version 4.3.1:
  4.3.1:
  [#]## Bugfixes
- Fixed a deadlock between the `podman ps` and `podman container inspect` commands
  [#]## Misc
- Updated the containers/image library to v5.23.1
  4.3.0:
  [#]## Features
- A new command, `podman generate spec`, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
- A new command, `podman update`, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted ([#15067](https://github.com/containers/podman/issues/15067)).
- A new command, `podman kube down`, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to `podman kube play --down`, but it now has its own command).
- The `podman kube play` command now supports Kubernetes secrets using Podman's secrets backend.
- Systemd-managed pods created by the `podman kube play` command now integrate with sd-notify, using the `io.containers.sdnotify` annotation (or `io.containers.sdnotify/$name` for specific containers).
- Systemd-managed pods created by `podman kube play` can now be auto-updated, using the `io.containers.auto-update` annotation (or `io.containers.auto-update/$name` for specific containers).
- The `podman kube play` command can now read YAML from URLs, e.g. `podman kube play https://example.com/demo.yml` ([#14955](https://github.com/containers/podman/issues/14955)).
- The `podman kube play` command now supports the `emptyDir` volume type ([#13309](https://github.com/containers/podman/issues/13309)).
- The `podman kube play` command now supports the `HostUsers` field in the pod spec.
- The `podman play kube` command now supports `binaryData` in ConfigMaps.
- The `podman pod create` command can now set additional resource limits for pods using the new `--memory-swap`, `--cpuset-mems`, `--device-read-bps`, `--device-write-bps`, `--blkio-weight`, `--blkio-weight-device`, and `--cpu-shares` options.
- The `podman machine init` command now supports a new option, `--username`, to set the username that will be used to connect to the VM as a non-root user ([#15402](https://github.com/containers/podman/issues/15402)).
- The `podman volume create` command's `-o timeout=` option can now set a timeout of 0, indicating volume plugin operations will never time out.
- Added support for a new volume driver, `image`, which allows volumes to be created that are backed by images.
- The `podman run` and `podman create` commands support a new option, `--env-merge`, allowing environment variables to be specified relative to other environment variables in the image (e.g. `podman run --env-merge "PATH=$PATH:/my/app" ...`) ([#15288](https://github.com/containers/podman/issues/15288)).
- The `podman run` and `podman create` commands support a new option, `--on-failure`, to allow action to be taken when a container fails health checks, with the following supported actions: `none` (take no action, the default), `kill` (kill the container), `restart` (restart the container), and `stop` (stop the container).
- The `--keep-id` option to `podman create` and `podman run` now supports new options, `uid` and `gid`, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. `--userns=keep-id:uid=11` will made the user running Podman to UID 11 in the container) ([#15294](https://github.com/containers/podman/issues/15294)).
- The `podman generate systemd` command now supports a new option, `--env`/`-e`, to set environment variables in the generated unit file ([#15523](https://github.com/containers/podman/issues/15523)).
- The `podman pause` and `podman unpause` commands now support the `--latest`, `--cidfile`, and `--filter` options.
- The `podman restart` command now supports the `--cidfile` and `--filter` options.
- The `podman rm` command now supports the `--filter` option to select which containers will be removed.
- The `podman rmi` command now supports a new option, `--no-prune`, to prevent the removal of dangling parents of removed images.
- The `--dns-opt` option to `podman create`, `podman run`, and `podman pod create` has received a new alias, `--dns-option`, to improve Docker compatibility.
- The `podman` command now features a new global flag, `--debug`/`-D`, which enables debug-level logging (identical to `--log-level=debug`), improving Docker compatibility.
- The `podman` command now features a new global flag, `--config`. This flag is ignored, and is only included for Docker compatibility ([#14767](https://github.com/containers/podman/issues/14767)).
- The `podman manifest create` command now accepts a new option, `--amend`/`-a`.
- The `podman manifest create`, `podman manifest add` and `podman manifest push` commands now accept a new option, `--insecure` (identical to `--tls-verify=false`), improving Docker compatibility.
- The `podman secret create` command's `--driver` and `--format` options now have new aliases, `-d` for `--driver` and `-f` for `--format`.
- The `podman secret create` command now supports a new option, `--label`/`-l`, to add labels to created secrets.
- The `podman secret ls` command now accepts the `--quiet`/`-q` option.
- The `podman secret inspect` command now accepts a new option, `--pretty`, to print output in human-readable format.
- The `podman stats` command now accepts the `--no-trunc` option.
- The `podman save` command now accepts the `--signature-policy` option ([#15869](https://github.com/containers/podman/issues/15869)).
- The `podman pod inspect` command now allows multiple arguments to be passed. If so, it will return a JSON array of the inspected pods ([#15674](https://github.com/containers/podman/issues/15674)).
- A series of new hidden commands have been added under `podman context` as aliases to existing `podman system connection` commands, to improve Docker compatibility.
- The remote Podman client now supports proxying signals for attach sessions when the `--sig-proxy` option is set ([#14707](https://github.com/containers/podman/issues/14707)).
  [#]## Changes
- Duplicate volume mounts are now allowed with the `-v` option to `podman run`, `podman create`, and `podman pod create`, so long as source, destination, and options all match ([#4217](https://github.com/containers/podman/issues/4217)).
- The `podman generate kube` and `podman play kube` commands have been renamed to `podman kube generate` and `podman kube play` to group Kubernetes-related commands. Aliases have been added to ensure the old command names still function.
- A number of Podman commands (`podman init`, `podman container checkpoint`, `podman container restore`, `podman container cleanup`) now print the user-inputted name of the container, instead of its full ID, on success.
- When an unsupported option (e.g. resource limit) is specified for a rootless container on a cgroups v1 system, a warning message is now printed that the limit will not be honored.
- The installer for the Windows Podman client has been improved.
- The `--cpu-rt-period` and `--cpu-rt-runtime` options to `podman run` and `podman create` now print a warning and are ignored on cgroups v2 systems (cgroups v2 having dropped support for these controllers) ([#15666](https://github.com/containers/podman/issues/15666)).
- Privileged containers running systemd will no longer mount `/dev/tty*` devices other than `/dev/tty` itself into the container ([#15878](https://github.com/containers/podman/issues/15878)).
- Events for containers that are part of a pod now include the ID of the pod in the event.
- SSH functionality for `podman machine` commands has seen a thorough rework, addressing many issues about authentication.
- The `--network` option to `podman kube play` now allows passing `host` to set the pod to use host networking, even if the YAML does not request this.
- The `podman inspect` command on containers now includes the digest of the image used to create the container.
- Pods created by `podman play kube` are now, by default, placed into a network named `podman-kube`. If the `podman-kube` network does not exist, it will be created. This ensures pods can connect to each other by their names, as the network has DNS enabled.
  [#]## Bugfixes
- Fixed a bug where the `podman network prune` and `podman container prune` commands did not properly support the `--filter label!=` option ([#14182](https://github.com/containers/podman/issues/14182)).
- Fixed a bug where the `podman kube generate` command added an unnecessary `Secret: null` line to generated YAML ([#15156](https://github.com/containers/podman/issues/15156)).
- Fixed a bug where the `podman kube generate` command did not set `enableServiceLinks` and `automountServiceAccountToken` to false in generated YAML ([#15478](https://github.com/containers/podman/issues/15478) and [#15243](https://github.com/containers/podman/issues/15243)).
- Fixed a bug where the `podman kube play` command did not properly handle CPU limits ([#15726](https://github.com/containers/podman/issues/15726)).
- Fixed a bug where the `podman kube play` command did not respect default values for liveness probes ([#15855](https://github.com/containers/podman/issues/15855)).
- Fixed a bug where the `podman kube play` command did not bind ports if `hostPort` was not specified but `containerPort` was ([#15942](https://github.com/containers/podman/issues/15942)).
- Fixed a bug where the `podman kube play` command sometimes did not create directories on the host for `hostPath` volumes.
- Fixed a bug where the remote Podman client's `podman manifest push` command did not display progress.
- Fixed a bug where the `--filter "{{.Config.Healthcheck}}"` option to `podman image inspect` did not print the image's configured healthcheck ([#14661](https://github.com/containers/podman/issues/14661)).
- Fixed a bug where the `podman volume create -o timeout=` option could be specified even when no volume plugin was in use.
- Fixed a bug where the `podman rmi` command did not emit `untag` events when removing tagged images ([#15485](https://github.com/containers/podman/issues/15485)).
- Fixed a bug where API forwarding with `podman machine` VMs on windows could sometimes fail because the pipe was not created in time ([#14811](https://github.com/containers/podman/issues/14811)).
- Fixed a bug where the `podman pod rm` command could error if removal of a container in the pod was interrupted by a reboot.
- Fixed a bug where the `exited` and `exec died` events for containers did not include the container's labels ([#15617](https://github.com/containers/podman/issues/15617)).
- Fixed a bug where running Systemd containers on a system not using Systemd as PID 1 could fail ([#15647](https://github.com/containers/podman/issues/15647)).
- Fixed a bug where Podman did not pass all necessary environment variables (including `$PATH`) to Conmon when starting containers ([#15707](https://github.com/containers/podman/issues/15707)).
- Fixed a bug where the `podman events` command could function improperly when no events were present ([#15688](https://github.com/containers/podman/issues/15688)).
- Fixed a bug where the `--format` flag to various Podman commands did not properly handle template strings including a newline (`\n`) ([#13446](https://github.com/containers/podman/issues/13446)).
- Fixed a bug where Systemd-managed pods would kill every container in a pod when a single container exited ([#14546](https://github.com/containers/podman/issues/14546)).
- Fixed a bug where the `podman generate systemd` command would generate incorrect YAML for pods created without the `--name` option.
- Fixed a bug where the `podman generate systemd --new` command did not properly set stop timeout ([#16149](https://github.com/containers/podman/issues/16149)).
- Fixed a bug where a broken OCI spec resulting from the system rebooting while a container is being started could cause the `podman inspect` command to be unable to inspect the container until it was restarted.
- Fixed a bug where creating a container with a working directory on an overlay volume would result in the container being unable to start ([#15789](https://github.com/containers/podman/issues/15789)).
- Fixed a bug where attempting to remove a pod with running containers without `--force` would not error and instead would result in the pod, and its remaining containers, being placed in an unusable state ([#15526](https://github.com/containers/podman/issues/15526)).
- Fixed a bug where memory limits reported by `podman stats` could exceed the maximum memory available on the system ([#15765](https://github.com/containers/podman/issues/15765)).
- Fixed a bug where the `podman container clone` command did not properly handle environment variables whose value contained an `=` character ([#15836](https://github.com/containers/podman/issues/15836)).
- Fixed a bug where the remote Podman client would not print the container ID when running the `podman-remote run --attach stdin` command.
- Fixed a bug where the `podman machine list --format json` command did not properly show machine starting status.
- Fixed a bug where automatic updates would not error when attempting to update a container with a non-fully qualified image name ([#15879](https://github.com/containers/podman/issues/15879)).
- Fixed a bug where the `podman pod logs --latest` command could panic ([#15556](https://github.com/containers/podman/issues/15556)).
- Fixed a bug where Podman could leave lingering network namespace mounts on the system if cleaning up the network failed.
- Fixed a bug where specifying an unsupported URI scheme for `podman system service` to listen at would result in a panic.
- Fixed a bug where the `podman kill` command would sometimes not transition containers to the exited state ([#16142](https://github.com/containers/podman/issues/16142)).
  [#]## API
- Fixed a bug where the Compat DF endpoint reported incorrect reference counts for volumes ([#15720](https://github.com/containers/podman/issues/15720)).
- Fixed a bug in the Compat Inspect endpoint for Networks where an incorrect network option was displayed, causing issues with `docker-compose` ([#15580](https://github.com/containers/podman/issues/15580)).
- The Libpod Restore endpoint for Containers now features a new query parameter, `pod`, to set the pod that the container will be restored into ([#15018](https://github.com/containers/podman/issues/15018)).
- Fixed a bug where the REST API could panic while retrieving images.
- Fixed a bug where a cancelled connection to several endpoints could induce a memory leak.
  [#]## Misc
- Error messages when attempting to remove an image used by a non-Podman container have been improved ([#15006](https://github.com/containers/podman/issues/15006)).
- Podman will no longer print a warning that `/` is not a shared mount when run inside a container ([#15295](https://github.com/containers/podman/issues/15295)).
- Work is ongoing to port Podman to FreeBSD.
- The output of `podman generate systemd` has been adjusted to improve readability.
- A number of performance improvements have been made to `podman create` and `podman run`.
- A major reworking of the manpages to ensure duplicated options between commands have the same description text has been performed.
- Updated Buildah to v1.28.0
- Updated the containers/image library to v5.23.0
- Updated the containers/storage library to v1.43.0
- Updated the containers/common library to v0.50.1</changelog>
</package>
<package pkgid="b95ed5887d679ff9a9a5a529d952021752c73217f133ef70c25fc22cb150cdb8" name="procps" arch="aarch64">
  <version epoch="0" ver="3.3.15" rel="150000.7.25.1"/>
  <changelog author="werner@suse.de" date="1495454400">- Add patch procps-ng-3.3.12-sysctl-a.patch (bsc#1039941, had been
  accepted upstream) that is allow content lines below /proc/sys
  longer than 1024 characters</changelog>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
</package>
<package pkgid="4a7d3aaee65f15132e5aa9b24098e45e3b44acc00100322de925e88657ededde" name="procps" arch="src">
  <version epoch="0" ver="3.3.15" rel="150000.7.25.1"/>
  <changelog author="werner@suse.de" date="1495454400">- Add patch procps-ng-3.3.12-sysctl-a.patch (bsc#1039941, had been
  accepted upstream) that is allow content lines below /proc/sys
  longer than 1024 characters</changelog>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
</package>
<package pkgid="fa60bfb1dea4ca3747f3b0578adabc871484c1079d9f04107375328a2d61189d" name="procps" arch="x86_64">
  <version epoch="0" ver="3.3.15" rel="150000.7.25.1"/>
  <changelog author="werner@suse.de" date="1495454400">- Add patch procps-ng-3.3.12-sysctl-a.patch (bsc#1039941, had been
  accepted upstream) that is allow content lines below /proc/sys
  longer than 1024 characters</changelog>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
</package>
<package pkgid="a5c7887f524f767d35e18cc69f1b461d0893aadfedc08b1d7b0a6714ac19fc4b" name="procps" arch="aarch64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="ea6a4d83252dc5523ccdd55e8e54502595dfb47d80f8d3c0e7a04abd691a4aef" name="procps" arch="src">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="169e6309fb8f6761e46704599c63fb70a5ed86978373ffc261beafc4450fb8dc" name="procps" arch="x86_64">
  <version epoch="0" ver="3.3.15" rel="150000.7.28.1"/>
  <changelog author="mpluskal@suse.com" date="1497614400">- Drop support for xinetd (systat.xinetd)
  * xinetd is being obsoleted
  * provided service is considered unsecure and is unlikely to be
    used anyways
- Small packaging cleanup with spec-cleaner</changelog>
  <changelog author="werner@suse.de" date="1499342400">- Add patch procps-ng-3.3.12-sysctl-iobuf.patch to increase I/O
  buffer for reading and writing values below /proc/sys (bsc#1039941)
- Add patch procps-ng-3.3.12-stable_secret.patch to avoid messages
  on unset /proc/sys/net/ipv6/conf/*/stable_secret due EIO</changelog>
  <changelog author="schwab@linux-m68k.org" date="1501675200">- procps-ng-3.3.12-sysctl-iobuf.patch: fix crash</changelog>
  <changelog author="werner@suse.de" date="1513684800">- Add patch procps-ng-3.3.12-sysctl-iobuf-write.patch to use
  increased buffer on writing /proc/sys/net/ipv4/ip_local_reserved_ports</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Remove patch procps-ng-3.3.12-sysctl-iobuf-write.patch (bsc#1077746)
- Add patches
  0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
  0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
  0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
  from my project https://gitlab.com/bitstreamout/procps/tree/procio
  which implements a flexible buffer for reading and writing values
  below /proc/sys (bsc#1039941)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1522843200">- Update to procps-ng-3.3.13
  * library: Increment to 7:0:1
    No changes, no removals
    New fuctions: numa_init, numa_max_node, numa_node_of_cpu,
    numa_uninit, xalloc_err_handler
  * doc: Document I idle state in ps.1 and top.1           Debian #886967
  * free: fix some of the SI multiples                     issue #45
  * kill: -l space between name parses correctly           Debian #854407
  * library: dont use vm_min_free on non Linux             Debian #831396
  * library: dont use SIGPWR on FreeBSD                    Debian #832148
  * library: don't strip off wchan prefixes (ps &amp; top)     Redhat #1322111
  * pgrep: warn about 15+ char name only if -f not used
  * pgrep/pkill: only match in same namespace by default   merge #41
  * pidof: specify separator between pids                  merge #58
  * pkill: Return 0 only if we can kill process            Debian #852758
  * pmap: fix duplicate output line under '-x' option      Redhat #1374061
  * ps: avoid eip/esp address truncations                  Debian #846361
  * ps: recognizes SCHED_DEADLINE as valid CPU scheduler
  * ps: display NUMA node under which a thread ran         issue #58
  * ps: Add seconds display for cputime and time           merge #43
  * ps: Add LUID field                                     merge #57 Redhat #1518986
  * sysctl: Permit empty string for value                  issue #74
  * sysctl: Don't segv when file not available             issue #76
  * sysctl: Read and write large buffers                   merge #56
  * top: add config file support for XDG specification
  * top: eliminated minor libnuma memory leak
  * top: show fewer memory decimal places (configurable)   issue #50
  * top: provide command line switch for memory scaling    Redhat #1034466, issue #53
  * top: provide command line switch for CPU States        issue #55
  * top: provides more accurate cpu usage at startup       Redhat #1182327
  * top: display NUMA node under which a thread ran        issue #58
  * top: fix argument parsing quirk resulting in SEGV      Redhat #1450429
  * top: delay interval accepts non-locale radix point     Redhat #1182248
  * top: address a wishlist man page NLS suggestion        Debian #865689
  * top: fix potential distortion in 'Mem' graph display   issue #64
  * top: provide proper multi-byte string handling         issue #68
  * top: startup defaults are fully customizable           Redhat #1153049, #1499410, issues #6, #78
  * see man page 6c. SYSTEM Configuration File
  * watch: define HOST_NAME_MAX where not defined          Debian #830734
  * vmstat: Fix alignment for disk partition format        issue #69
  * watch: Support ANSI 39,49 reset sequences              issue #73
- Removed now patch now upstream
    0001-Preload-sysctl-lines-even-if-longer-than-stdio-buffe.patch
    0002-Add-flexible-buffered-I-O-based-on-fopencookie-3.patch
    0003-Use-new-standard-I-O-for-reading-writing-sysctl-valu.patch
    procps-ng-3.3.12-stable_secret.patch
    procps-ng-3.3.12-strtod.patch
    procps-ng-3.3.12-sysctl-a.patch
    procps-ng-3.3.12-sysctl-iobuf.patch
- Port patches
    procps-ng-3.3.10-bnc634071_procstat2.diff
    procps-ng-3.3.10-errno.patch
    procps-ng-3.3.10-fdleak.dif
    procps-ng-3.3.10-integer-overflow.patch
    procps-ng-3.3.10-large_pcpu.patch
    procps-ng-3.3.10-slab.patch
    procps-ng-3.3.11-pmap4suse.patch
    procps-ng-3.3.8-accuracy.dif
    procps-ng-3.3.8-bnc634840.patch
    procps-ng-3.3.8-ignore-scan_unevictable_pages.patch
    procps-ng-3.3.8-petabytes.patch
    procps-ng-3.3.8-readeof.patch
    procps-ng-3.3.8-tinfo.dif
    procps-ng-3.3.8-top.1.diff
    procps-v3.3.3-read-sysctls-also-from-boot-sysctl.conf-kernelversion.diff</changelog>
  <changelog author="werner@suse.de" date="1522929600">- Remove sysvinit boot script
- Add procps-rpmlintrc</changelog>
  <changelog author="jengelh@inai.de" date="1522929601">- Update descriptions.</changelog>
  <changelog author="werner@suse.de" date="1523534400">- Update to procps-ng-3.3.14
  * update translations
  * library: build on non-glibc systems
  * free: fix scaling on 32-bit systems
  * Revert "Support running with child namespaces"</changelog>
  <changelog author="werner@suse.de" date="1528200000">- Update to procps-ng-3.3.15 (bsc#1092100)
  * library: Increment to 8:0:1
    No removals, no new functions
    Changes: slab and pid structures
  * library: Just check for SIGLOST and don't delete it    issue #93
  * library: Fix integer overflow and LPE in file2strvec   CVE-2018-1124
  * library: Use size_t for alloc functions                CVE-2018-1126
  * library: Increase comm size to 64
  * pgrep: Fix stack-based buffer overflow                 CVE-2018-1125
  * pgrep: Remove &gt;15 warning as comm can be longer        issue #92
  * ps: Fix buffer overflow in output buffer, causing DOS  CVE-2018-1123
  * ps: Increase command name selection field to 64
  * top: Don't use cwd for location of config              CVE-2018-1122
- Increase so major number</changelog>
  <changelog author="werner@suse.de" date="1528286400">- Reference patch procps-ng-3.3.15-typo.patch</changelog>
  <changelog author="werner@suse.de" date="1547812800">- Add patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753) which
  is a backport of an upstream fix to get the first CPU summary correct</changelog>
  <changelog author="werner@suse.de" date="1576152000">- Add aptch procps-ng-3.3.16-comm_len.patch
  * "ps -C" does not allow anymore an argument longer than 15
    characters (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1600948800">- Replace patch procps-ng-3.3.16-comm_len.patch with upstream
  commitment patch procps-ng-3e1c00d0.patch (bsc#1158830)</changelog>
  <changelog author="werner@suse.de" date="1617192000">- Add upstream patch procps-3.3.17-bsc1181976.patch based on
  commit 3dd1661a to fix bsc#1181976 that is change descripton
  of psr, which is for 39th field of /proc/[pid]/stat</changelog>
  <changelog author="werner@suse.de" date="1619697600">- Add upstream patch procps-vmstat-1b9ea611.patch for bsc#1185417
  * Support up to 2048 CPU as well</changelog>
  <changelog author="werner@suse.de" date="1643976000">- Add patch bsc1195468-23da4f40.patch to fix bsc#1195468 that is
  ignore SIGURG</changelog>
  <changelog author="werner@suse.de" date="1655899200">- Add the patches
  * procps-3.3.17-library-bsc1181475.patch
  * procps-3.3.17-top-bsc1181475.patch
  which are backports of current newlib tree to solve bug bsc#1181475
  * 'free' command reports misleading "used" value</changelog>
  <changelog author="werner@suse.de" date="1671105600">- Extend patch procps-3.3.17-library-bsc1181475.patch (bsc#1206412)
- Make sure that correct library version is installed (bsc#1206412)</changelog>
</package>
<package pkgid="9bf934fdb48faed1f4609622978310a61f4ef7fab4d8052bf98c333f45b27d46" name="protobuf" arch="src">
  <version epoch="0" ver="3.9.2" rel="150200.4.19.2"/>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new upstream release 3.5.0
  * Proto3 messages are now preserving unknown fields by default.
    If you rely on unknowns fields being dropped, use
    DiscardUnknownFields() explicitly.
  * Deprecated the unsafe_arena_release_* and
    unsafe_arena_add_allocated_* methods for string fields.
  * Added move constructor and move assignment to RepeatedField,
    RepeatedPtrField and google::protobuf::Any.
  * Added perfect forwarding in Arena::CreateMessage.
  * In-progress experimental support for implicit weak fields
    with lite protos. This feature allows the linker to strip out
    more unused messages and reduce binary size.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1516622400">- Conditionalize python2 and python3 in order to be able to build
  without python2 present in distribution
  * Use singlespec macros to simplify the logic
- Run fdupes on python modules to avoid duplicates
- Remove shebangs from import-only code</changelog>
  <changelog author="mlin@suse.com" date="1519387200">- Add adding-Release_CompareAndSwap-64-bit-variant.patch
  * Fix compile error undefined reference to
    `google::protobuf::internal::Release_CompareAndSwap(long volatile*, long, long)'
    on s390x https://github.com/google/protobuf/issues/3937</changelog>
  <changelog author="tbechtold@suse.com" date="1526299200">update to version v3.5.2:
  * Update release date
  * Disable pip cache when testing uploaded packages
  * Replace private timelib_update_ts with public date_timestamp_get
  * Remove py2.6 support.
  * Cherrypick for csharp, including:
  * Update changelog
  * Update changelog for 3.5.1
  * Fix uploading binary wheel.
  * Fix memory leak when creating map field via array.
  * Update rake file to build of 2.1.6.
  * Avoid using php_date_get_date_ce() in case date extension is not
  * Update protoc-artfacts
  * Fix string::back() usage in googletest.cc
  * Fix memory leak in php7
  * Support ruby2.5
  * io_win32: support non-ASCII paths
  * Explicitly propagate the status of Flush().
  * Add discard unknown API in ruby. (#3990)
  * Update version for 3.5.0.post1
  * remove nullptr
  * Fix more memory leak for php c extension (#4211)
  * Bumping number to fix ruby 2.1 on mac
  * io_win32_unittest: remove incorrect error check
  * Fix memory leak when creating repeated field via array.
  * Update version number for php c extension (#3896)
  * Fix file permission for python package.
  * Create containing directory before generating well_known_types_embed.cc
  * Replace C++11 only method std::map::at
  * Recursively clear unknown fields in submessages. (#3982)
  * Update version number to 3.5.1
  * io_win32_unittest: fix condition in GetCwdAsUtf8
  * Add release log
  * io_win32_unittest: use CWD as last tempdir
  * Add PROTOBUF_ENABLE_TIMESTAMP to let user decide whether timestamp util
  * Add support for Windows ARM64 build
  * Add protobuf-all in post release
  * Use fully qualifed name for DescriptorPool in Any.php to avoid name (#3886)
  * Add _file_desc_by_toplevel_extension back
  * Fix setup.py for windows build.
  * io_win32_unittest: make //:win32_test run again
  * Provide discardUnknonwnFields API in php (#3976)
  * Update php c extension version number to 3.5.0.1
  * Fix ruby gc_test in ruby 2.4 (#4011)
  * Remove duplicate typedef. (#3975)
  * Accept DatetimeInterface in fromDatetime
  * io_win32: add more encoding-related tests
  * Bump version number to 3.5.2
  * Bump protoc-artifact version for a patch rebuild
  * Call php method via function name instead of calling directly.
  * Well known types are not initialized properly. (#4139)
  * Use matching enum type for IsPOD.
  * Fix several more memory leak
  * Fix for php5.5
  * Add backslach to make class explict in global namespace</changelog>
  <changelog author="tbechtold@suse.com" date="1536753600">- update to version v3.6.1:
  * PHP namespaces for nested messages and enums (#4536)
  * Allows the json marshaller to be passed json marshal options (#4252)
  * Make sure to delete temporary maps used by FileDescriptorTables
  * fix python cpp kokoro build
  * Change C# reflection to avoid using expression trees
  * Updated checked-in generated code
  * Removed unused variables in repeated_scalar_container.cc
  * Removed unused code pertaining to shared_ptr
  * Include no_package.proto in Python test
  * Only check filenames when end with .py in _CalledFromGeneratedFile() (#4262)
  * Convert descriptortype to type for upb_msgval_sizeof (#4357)
  * Removed duplicate using statement from ReflectionUtil.cs
  * Add support for power ppc64le
  * Cat the test-suite.log on errors for presubits
  * Address review comments
  * Add third-party RPC implementation: raster - a network framework supports pbrpc by 'service' keyword.
  * Delete javanano kokoro build configs.
  * Updated Ruby conformance test failure list
  * Removed use of some type traits
  * Adopt php_metadata_namespace in php code generator (#4622)
  * Move to Xcode 9.3 which also means a High Sierra image.
  * Add protoc release script for Linux build.
  * protoc-artifacts: Avoid storing temporary files and use fewer layers
  * Rewrite go_benchmark
  * Add files to build ruby artifact for mac on kokoro (#4814)
  * Remove javanano.
  * Comment out unused command from release script.
  * Avoid direct check of class name (#4601)
  * The JsonParseOptions::ignore_unknown_fields option behavior treats
  * Fix php memory leak test (#4692)
  * Fix benchmark build
  * Add VS2017 optional component dependency details to the C# readme (#4128)
  * Fix initialization with Visual Studio
  * For windows, all python version should use /MT (#4468)
  * use brew install instead of easy_install in OSX (#4537)
  * Sync upb change (#4373)
  * Always add -std=c++11 for mac (#4684)
  * Add kokoro build status badges.
  * Removed unrecognized option from no_package.proto
  * Fixed up proto3_lite_unittest.cc
  * Update Xcode settings
  * Cleanup LICENSE file.
  * Remove js_embed binary. (#4709)
  * Fixed JS parsing of unspecified map keys
  * Update version number to 3.6.0
  * Deliberately call simple code to avoid Unity linker pruning
  * Revert "Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources."
  * protoc-artifacts: Use ENTRYPOINT to enable devtoolset-1.1
  * MinGW build failed
  * Support using MSVC intrinsics in Log2FloorNonZero
  * Fix array constructor in c extension for compatibility (#4667)
  * Add space between class name and concat message (#4577)
  * fix python
  * Add performance.md and add instruction for linking tcmalloc
  * Add script for run and upload the benchmark result to bq
  * Add test for failing write of raw pointer to output stream
  * [objectivec] Fix memory leak of exceptions raised by RaiseException() (#4556)
  * Remove stray indent on normal imports.
  * Fix python ext build on kokoro (#4527)
  * Add compile test sources for to test include order.
  * Fixed a Visual Studio 2017 build error. (#4488)
  * fix linux kokoro build in docker
  * Fixes MSVC compiler warning C4800 "Forcing value to bool 'true' or 'false'" (#4350)
  * Updated Docker setup to use GCC 4.8
  * Remove broken build status icons.
  * Run autogen.sh in release script.
  * Output *_pb2_grpc.py when use_grpc_plugin=True
  * Adopt ruby_package in ruby generated code. (#4627)
  * Cygwin build failed
  * Work around an "old runtime" issue with reflection
  * Added Kokoro protoc release build for OS X (#4770)
  * Updated change log for 3.6.1 release
  * Move methods out of class (#4697)
  * Fix to allow AOT compilers to play nicely with reflection
  * Update Makefile.am for Java lite files.
  * Added map_lite_test.proto to fix LiteTest
  * Introduce a compatiblity shim to support .NET 3.5 delegate creation
  * Revert "Removed mention of Buffer in byteSourceToUint8Array"
  * Add gogo benchmark
  * Set ext.no_native = true for non mac platform
  * Removed atomicops.h since it is no longer used
  * Rename a shadowed variable.
  * Add kokoro bazel configs for 3.6.x branch.
  * Deleted scoped_ptr.h
  * Check the message to be encoded is the wrong type. (#4885) (#4949)
  * protoc-artifacts: Avoid checking out protobuf code
  * Add conformance test for null value in list JSON
  * Build ruby gem on kokoro (#4819)
  * Try using a new version of Visual Studio on AppVeyor
  * Make ruby release configs consistent with protoc.
  * fix for API change in PHP 7.3 (#4898)
  * Add .proto files to extract_includes.bat
  * Update protoc build scripts.
  * Blacklist all WELL_KNOWN_PROTOS from Bazel C++ code generation.
  * Additional support for building and deploying ppcle_64 artifacts
  * Fix php tests
  * Cleanup + documentation for Java Lite runtime.
  * Added Kokoro Windows release build config for protoc (#4766)
  * typo
  * fix golang kokoro linux build
  * Fix spelling error of __GNUC_MINOR__
  * Update code to work for Xcode 10b1 (#4729)
  * Added pyext/thread_unsafe_shared_ptr.h
  * Added missing .inc files to BUILD
  * js message support for jstype string on integers (#4332)
  * Improve error message when googletest is missing.
  * Make assertEquals pass for message (#4947)
  * Sync internal benchmark changes
  * Removed some unused C++ source files
  * Fix missing LIBPROTOC_EXPORT.
  * Added new test source files to Makefile.am
  * Update php version to 3.6.0 (#4736)
  * Fix RepeatedField#delete_if (#4292)
  * Merge branch (#4466)
  * Implement array constructor in php c extension.
  * protoc-artifacts: Update centos base from 6.6 to 6.9
  * PHP array constructors for protobuf messages (#4530)
  * Fix problem: cmake build failed in c++11  by clang
  * Don't assume Windows builds use MSVC.
  * Use legacy name in php runtime (#4741)
  * Add file option php_metadata_namespace and ruby_package (#4609)
  * Fix cpp benchmark dependency on mac
  * Use the first enum value instead of 0 in DefaultValueObjectWriter::FindEnumDefault
  * Check return value on write of raw pointer
  * Delete unused directories.
  * Replace //:protoc and similar default macro arguments with
  * Add extra C# file to Makefile.am
  * includes the expected class in the exception, otherwise the error is harder to track down (#3371)
  * Update instructions about getting protobuf source.
  * Add cpp tests under release docker image.
  * fix java benchmark, fix dashboard build
  * `update_file_lists.sh` depends on Bash features, thus needs Bash sebang.
  * Rename build_artifacts.cfg to release.cfg (#4818)
  * Fix bug: whether always_print_enums_as_ints is true or false, it always print the default value of enums as strings
  * source code info for interpreted options; fix source code info for extension range options (#4342)
  * Updated version numbers to 3.6.1
  * Trim imports for bundled generated protos.
  * Require C++11 and pass -std=c++11
  * Remove the iOS Test App.
  * fix duplicate mkdir in update_file_lists.sh
  * Updated csharp/README.md to reflect testing changes
  * Fix bazel build of examples.
  * Add missing ruby/tests/test_ruby_package.proto
  * Fix cpp_distcheck
  * Updated the change log with changes for 3.6.0
  * some fix
  * CMake: Update CXX Standard management
  * Add the files added in #4485.
  * Change to deal all messages in one loop
  * Fix php conformance test.
  * Add __init__.py files to compiler and util subpackages (#4117)
  * Updated .gitignore to exclude downloaded gmock/ directory
  * Fix error in Clang UndefinedBehaviorSanitizer
  * Work around MSVC issue with std::atomic initialization (#4777)
  * Updated conformance failure lists
  * Add back GeneratedClassName to public (#4686)
  * Add continuous test for ruby 2.3, 2.4 and 2.5 (#4829)
  * Throw error if user want to access message properties (#4603)
  * fix json_decode call parameters (#4381)
  * Move `compiler/plugin.pb.cc` to libprotobuf with the other WKT sources.
  * PHP: fixed typo in message.c
  * Add go benchmark
  * Allow list values to be null when parsing
  * Added instruction for existing ZLIB configuration
  * Fix 32bit php tests
  * Removed javanano from post_process_dist.sh
  * Don't generate imports for the WKTs unless generating the WKTs.
  * For encoding upb needs descriptor type instead of type. (#4354)
  * Include googletest as a submodule (#3993)
  * Write messages to backing field in generated C# cloning code (#4440)
  * Integrated internal changes from Google
- Drop adding-Release_CompareAndSwap-64-bit-variant.patch . Applied
  upstream.
- bump soname version</changelog>
  <changelog author="fstrba@suse.com" date="1545048000">- Add maven pom files to the protobuf-java package</changelog>
  <changelog author="mrostecki@suse.de" date="1546948800">- Add protobuf-source package - some programs using gRPC and
  protobuf need protobuf definitions which are included inside the
  source code, but are not included in the devel package.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1550664000">- Add upstream patch which fixes build with Bazel 0.22.0.
  * 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch</changelog>
  <changelog author="mliska@suse.cz" date="1556107200">- Disable LTO (boo#1133277).</changelog>
  <changelog author="jengelh@inai.de" date="1559736000">- Update to new upstream release 3.8.0
  * Introduced new MOMI (maybe-outside-memory-interval) parser.
  * Added use of C++ override keyword where appropriate.
  * Always declare enums to be int-sized.
  * Append '_' to C++ reserved keywords for message, enum, extension.
- Remove 0001-remove-PACKAGE_NAME-and-REPOSITORY_NAME-deprecated.patch
  (upstreamed)</changelog>
  <changelog author="fstrba@suse.com" date="1559995200">- Specify java source and target levels in order to build
  compatible protobuf-java binaries</changelog>
  <changelog author="jengelh@inai.de" date="1566475200">- Update to new upstream release 3.9.1
  * Optimized the implementation of RepeatedPtrFieldBase.
  * Added delimited parse and serialize util.
  * Added FieldDescriptor::PrintableNameForExtension() and
    DescriptorPool::FindExtensionByPrintableName(). The latter
    will replace Reflection::FindKnownExtensionByName().
  * Created a new Add method in repeated field that allows adding
    a range of elements all at once.
  * Drop building wheel for Python 3.4.</changelog>
  <changelog author="fstrba@suse.com" date="1569585600">- Package also the protobuf-bom pom file</changelog>
  <changelog author="mmnelemane@suse.com" date="1576756800">- Updated to version 3.9.2 (bsc#1162343)
  (Objective-C)
  * Remove OSReadLittle* due to alignment requirements. (#6678)
  * Don't use unions and instead use memcpy for the type swaps. (#6672)</changelog>
  <changelog author="mpluskal@suse.com" date="1576843200">- Use tarball provided by upstream
- Small package cleanup</changelog>
  <changelog author="mcepl@suse.com" date="1610539200">- Add missing dependency of python subpackages on python-six
  (bsc#1177127).</changelog>
  <changelog author="mcepl@suse.com" date="1612958400">- Fix Requires for python3 to python3-six.</changelog>
  <changelog author="mlin@suse.com" date="1647000000">- Fix incorrect parsing of nullchar in the proto symbol, CVE-2021-22570,
  bsc#1195258
  * Add protobuf-CVE-2021-22570.patch</changelog>
  <changelog author="mlin@suse.com" date="1664884800">- Fix potential Denial of Service in protobuf-java in the parsing procedure
  for binary data, CVE-2021-22569, bsc#1194530
  * Add protobuf-improve-performance-of-parsing-unknown-fields-in-Java.patch</changelog>
  <changelog author="mlin@suse.com" date="1666267200">- Fix a potential DoS issue in protobuf-cpp and protobuf-python,
  CVE-2022-1941, bsc#1203681
  * Add protobuf-CVE-2022-1941.patch
- Fix a potential DoS issue when parsing with binary data in
  protobuf-java, CVE-2022-3171, bsc#1204256
  * Add protobuf-CVE-2022-3171.patch
- Refresh protobuf-CVE-2021-22570.patch
- Backport changes from 3.16.x tree for apply recent CVE patches
  * Add protobuf-51026d922970e06475f005b39287963594134b96.patch
  * Add protobuf-6ee16a9c60e734104aeb738503fe3f411c97bd88.patch
  * Add protobuf-73e0d748b9acdc40b693f2879ce82ecb1a849b81.patch
  * Add protobuf-7bff8393cab939bfbb9b5c69b3fe76b4d83c41ee.patch
  * Add protobuf-4f02f056b5cea99052bfdfb6698afe47a3cf2964.patch
  * Add protobuf-763c3588740b97e8e80b1b1a1a2dc4f417647133.patch
  * Add protobuf-6c92f9dff1807c142edf6780d775b58a3b078591.patch
  * Add protobuf-4e93585e8bb234efeacb7737b8d080968c5ab91e.patch
  * Add protobuf-58d4420e2dd8a3cd354fff9db0052881c25369ce.patch
- Reorganize patch set ordering</changelog>
</package>
<package pkgid="408b5c1de880884dabc785f2f31c9ba7b6c9f22884869885d8d2dc99c32e5491" name="python-M2Crypto" arch="src">
  <version epoch="0" ver="0.35.2" rel="150000.3.11.1"/>
  <changelog author="michael@stroeder.com" date="1469188800">- update to 0.25.1
- set new dependency on package python-typing</changelog>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
</package>
<package pkgid="f536a42c4809e39dd17d0542fbe0956b44372a438726150d4b837f2278a61b1f" name="python-M2Crypto" arch="src">
  <version epoch="0" ver="0.35.2" rel="150000.3.14.1"/>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
  <changelog author="mcepl@suse.com" date="1657627200">- Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657,
  bsc#1178829), which mitigates the Bleichenbacher timing attacks
  in the RSA decryption API.
- Add python-M2Crypto.keyring to verify GPG signature of tarball.</changelog>
</package>
<package pkgid="5d6d55a55f97a243e3258506a9424ca7a2f515fd963a79d472b95a56e659f513" name="python-azure-agent" arch="noarch">
  <version epoch="0" ver="2.8.0.11" rel="150100.3.26.1"/>
  <changelog author="rjschwei@suse.com" date="1549540800">- Update to 2.2.36 (bsc#1119542)
  - Remove, included upstream
    + paa_fix_driver_install_detect.patch
    + paa_rdma_install_proper_driver.patch
    + 0001-Obtain-platform-information-in-Python-version-depend.patch
    + 0001-Detect-openSUSE-and-SLES.patch
    + 0001-Handle-the-disapperance-of-net-tools.patch
    + 0001-Properly-detect-SLES-15-for-rdma-support.patch
  - Forward port agent-no-auto-update.patch
  - [#1451] Do not utf-8 encode telemetry messages
- From 2.2.35
  + [#1434] Use files instead of pipes to capture stdout/stderr
  + [#1431] Prevent multiple downloads of zips
  + [#1418] Add main module to Python's egg
  + [#1416] Fix UTF-8 encoding for telemetry payload
  + [#1408] Honor the 'no_proxy' flag
  + [#1391, #1401, #1441] Azure Stack improvements
  + [#1384] Write status file in WALinuxAgent lib folder
  + [#1375] Add support for Redhat
  + [#1373] Handle different kernel builds on SUSE Linux Enterprise
  + [#1365, #1385, #1389] Fixes for RDMA
- From 2.2.34
  + [#1397] Send events when extensions fail to complete operation
  + [#1394/#1366] Fix the threshold telemetry issue
  + [#1298] Implementing extension sequencing in azure Linux agent
  + [#1340] Allow Clear Linux detection in python2 and python3
  + [#1345] FreeBSD swap issues fix (#1144)
  + [#1349] Use append_file in Redhat6xOSUtil.openssl_to_openssh()
  + [#1355] Ensure 'value' for authorized ssh keys end in "\n"
  + [#1361] Remove main module
- From 2.2.32
  + [#1325] Enable cgroups by default on all distros
  + [#1327, #1347] Allow enforcing of cgroups limits
  + [#1337] Allow configuration for cgroups
  + [#1333] Add support for NSBSD
  + [#1319] Stream extension downloads to disk
    (do not buffer the download in memory)
  + [#1303] Fix to support custom DNS servers
  + [#1306] Log extension stdout and stderr
  + [#1302] Better of cloud-init configuration during deprovisioning
  + [#1295] Fix to report the correct extension error code
  + [#1289] Allow disabling the agent or extensions
  + [#1290] Use the "ip route" command instead of the "route" comand
    during network configuration
  + [#1281] Delete JIT accounts
  + [#1234] Fix for reading KVP values from host
  + [#1287] Add UDEV rule in azure disk encryption
- From 2.2.31
  Upstream version jump
  + [#1196] Health store integration
  + [#1199] CGroups support
  + [#1194] Use host for status reporting
  + [#1188] Fix for sentinel and signal handlers
  + [#1182] Telemetry updates
  + [#1171] Add support for JIT
  + [#1164] Fix for name resolution in Ubuntu 18.04
  + [#1154] Set connection close header
  + [#1143] Remove extension packages after extraction
- From 2.2.26
  + Update Debian specific configuration and setup.
- From 2.2.25
  + Upstream version jump
  + Revert extension manifest caching to prevent downgrade issues.
- From 2.2.20
  + This is a hotfix release for #945, details and mitigation are available
    in the wiki.
- From 2.2.29
  + [#929] wire.py#update_goal_state does not handle out-of-date
    GoalState errors
  + [#908] Set Files to 0400 in /var/lib/waagent
  + [#906] Hardcoded value for sshd's ClientAliveInterval (180)
  + [#899] Improve HeartBeat Event
  + [#898] Send dummy status if extension fails to write a #.status file
  + [#897] 'Target handler state' wall of errors
  + [#896] End of Line Comments are Not Supported nor Handled
  + [#891] Create a Telemetry Event to Track Custom Data Execution
  + [#884] Cleanup Old Goal State and Extension Cache
  + [#876] The agent should use a scaling back-off when retrying HTTP requests
  + [#869] The agent should report OS information in the correct JSON format.
  + [#822] Update docs</changelog>
  <changelog author="rjschwei@suse.com" date="1551960000">- Add paa_cve_2019-0804.patch (bsc#1127838)
  - An issue with swapfile handling in the agent creates a data leak situation
    that exposes system memory data.</changelog>
  <changelog author="rjschwei@suse.com" date="1575547200">- Update to version 2.2.45 (jsc#ECO-80)
  + Remove paa_cve_2019-0804.patch, included upstream
  + Add support for Gen2 VM resource disks
  + Use alternate systemd detection
  + Fix /proc/net/route requirement that causes errors on FreeBSD
  + Add cloud-init auto-detect to prevent multiple provisioning mechanisms
    from relying on configuration for coordination
  + Disable cgroups when daemon is setup incorrectly
  + Remove upgrade extension loop for the same goal state
  + Add container id for extension telemetry events
  + Be more exact when detecting IMDS service health
  + Changing add_event to start sending missing fields
- From 2.2.44
  + Remove outdated extension ZIP packages
  + Improved error handling when starting extensions using systemd
  + Reduce provisioning time of some custom images
  + Improve the handling of extension download errors
  + New API for extension authors to handle errors during extension update
  + Fix handling of errors in calls to openssl
  + Improve logic to determine current distro
  + Reduce verbosity of several logging statements
- From 2.2.42
  + Poll for artifact blob, addresses goal state procesing issue
- From 2.2.41
  + Rewriting the mechanism to start the extension using systemd-run for
    systems using systemd for managing
  + Refactoring of resource monitoring framework using cgroup for both
    systemd and non-systemd approaches [#1530, #1534]
  + Telemetry pipeline for resource monitoring data
- From 2.2.40
  + Fixed tracking of memory/cpu usage
  + Do not prevent extensions from running if setting up cgroups fails
  + Enable systemd-aware deprovisioning on all versions &gt;= 18.04
  + Add systemd support for Debian Jessie, Stretch, and Buster
  + Support for Linux Openwrt
- From 2.2.38
  + Fix CVE-2019-0804
  + Add fixes for handling swap file and other nit fixes
- From 2.2.37
  + Improves re-try logic to handle errors while downloading extensions</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1585051200">- Add paa_use_hostnamectl.patch (bsc#1167601, bsc#1167602)
  + Set the hostname using hostnamectl to ensure setting is
    properly applied</changelog>
  <changelog author="rjschwei@suse.com" date="1594987200">- Add proper_dhcp_config_set.patch (bsc#1173866)
  + Properly set the dhcp configuration to push the hostname to the DHCP
    server
  + Do not bring the interface down to push the hostname, just use ifup</changelog>
  <changelog author="rjschwei@suse.com" date="1597406400">- Drop paa_sudo_sle15_nopwd.patch (bsc#1175198)
  + sudoers file is managed by cloud-init we no longer need this hack</changelog>
  <changelog author="rjschwei@suse.com" date="1599739200">- Update to version 2.2.49.2 (bsc#1176368, bsc#1176369)
  + Remove paa_use_hostnamectl.patch included upstream
  + Forwrad port proper_dhcp_config_set.patch
  + Do not use --unit with systemd-cgls (#1910)
  + Report processes that do not belong to the agent's cgroup (#1908)
  + Use controller mount point for extension cgroup path (#1899)
  + Improvements in setup of cgroups (#1896)
  + Remove ExtensionsMetricsData and per-process Memory data (#1884)
  + Fix return value of start_extension_command (#1927)
  + Remove import * (#1900)
  + Fix flaky ExtensionCleanupTest class (#1898)
  + Fix codecov badge (#1883)
  + Changed codecov to run on py3.8 (#1875)
  + Update documentation on /dev/random (#1909)
  + Mount options are in mount(8) (#1893)
  + Remove ssh host key thumbprint in report ready (#1913)
  + Emit AutoUpdate value at service start only (#1907)
  + Add logging for version mismatch (#1895)
  + Send telemetry event if libdir changes (#1897)
  + Add log collector utility (#1847)
  + Move AutoUpdate reporting to HeartBeat event (#1919)
  + Removing infinite download of extension manifest without a new GS (#1874)
  + Fix wrongful dir deletion (#1873)
  + Fix the cleanup-outdated-handlers to only delete handlers that are not
    present in the GS (#1889)
  + Expose periods of environment thread in waagent.conf (#1891)
  + Added user @kevinclark19a as Contributor. (#1906)
- From 2.2.48.1
  + Refactoring GoalState class out of Protocol, making Protocol thread-safe,
    removing stale dependencies of Protocol and removing the dependency on
    the file system to read the Protocol info
  + Fetch goal state when creating HostPluginProtocol (#1799)
  + Separate goal state from the protocol class (#1777)
  + Make protocol util a singleton per thread (#1743, #1756)
  + Fetch goal state before sending telemetry (#1751)
  + Remove file dependency (#1754)
  + Others (#1758, #1767, #1744, #1749, #1816, #1820)
  + New logs for goal state fetch (#1797) and refresh (#1794).
  + Thread name added to logs (#1778)
  + Populate telemetry events at creation time (#1791)
  + Periodic HeartBeat to be logged to the file (#1755)
  + Add unit test to verify call stacks on telemetry events (#1828)
  + Others (#1841, #1842, #1846)
  + Handling errors while reading extension status files
    (Limiting Size and Transient issues)(#1761)
  + Enable SWAP on Resource Disk as Application Certification Support
    suggested (#1762)
  + Update 'Provisioning' options in default configs ( #1853)
  + Drop Metadata Server Support (#1806, #1839, #1840 )
  + Improve documentation of ResourceDisk.EnableSwapEncryption (#1782)
  + Removed is_snappy function (#1774)
  + Handle exceptions in monitor thread (#1770)
  + Fix timestamp for periodic operations in the monitor thread (#1879)
  + Fix permissions on the Ubuntu systemd service file (#1814)
  + Update hostname setting for SUSE distros (#1832)
  + Python 3.8 improvements + support for Ubuntu 20.04 (#1860, #1865, #1738)
  + Testing and dev-infra improvements
    [#1771, #1768, #1800, #1826, #1827, #1833]
  + Others (#1854, #1858)
- From 2.2.46
  + [#1741] Do not update goal state when refreshing the host plugin
  + [#1731] Fix upgrade sequence when update command fails
  + [#1725] Initialize CPU usage
  + [#1716, #1737] Added UTC logging and correcting the format
  + [#1651, #1729] Start sending PerformanceCounter metrics and
    additional memory information for Cgroups</changelog>
  <changelog author="rjschwei@suse.com" date="1601726400">- Update proper_dhcp_config_set.patch (bsc#1177161, bsc#1177257)
  + Add missing imports</changelog>
  <changelog author="rjschwei@suse.com" date="1610452800">- Add sle_hpc-is-sles.patch (bsc#1180719)
  + Recognise SLE_HPC as SLES and use the proper RDMA handler and
    distro specific initialization code</changelog>
  <changelog author="rjschwei@suse.com" date="1612008000">- Add sysvinit-tools as dependency (bsc#1181600, bsc#1181601)</changelog>
  <changelog author="rjschwei@suse.com" date="1651752000">- Add reset-dhcp-deprovision.patch (bsc#1198258)
  + Reset the dhcp config when deprovisioning and instance to ensure
    instances from aVM image created from that instance send host information
    to the DHCP server.</changelog>
  <changelog author="pgajdos@suse.com" date="1652788800">- require python-rpm-macros to fix build for TW
- do not require test dependencies for build, they are not needed
  (no testsuite run in %check)</changelog>
  <changelog author="schubi@suse.com" date="1655294400">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1655726400">- Cleanup spec file:
  - - Removed %{_distconfdir}/logrotate.d from dirlist. It will be
    handled by package filelist now.
  - - %{_distconfdir}/logrotate.d/* can be changed by vendor only.
    So it will be replaced by an RPM update.</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Removed %config flag for files in /usr directory.</changelog>
  <changelog author="rjschwei@suse.com" date="1660219200">- Update to 2.7.3.0 (jsc#PED-1298)
  + Remove proper_dhcp_config_set.patch included upstream
  + Remove sle_hpc-is-sles.patch included upstream
  + Forward port reset-dhcp-deprovision.patch
  + Retry HGAP's extensionsArtifact requests on BAD_REQUEST status #2622
  + Use 'ip' instead of 'ifdown/ifup' to restart network interface on
    RHEL &gt;= 8.6 #2612 #2624
- From 2.7.1.0
  + hotfix for OOM errors on the log collector
- From 2.7.0.6
  + Increase time of autoupdates after updates are available #2403
  + Send telemetry when upgrade available #2421
  + Enable collection of debugging information #2436, #2453, #2510
  + Add support for Python 2.6 to the debug info collection code #2452
  + Enable CPU/memory data collection on RedHat and CentOS #2450
  + Exclude end-to-end tests from Agent setup #2396, #2402
  + Fix log message in cgroups management #2427
  + Fix parsing of malformed error.json files #2433
  + Allow DNS queries over TCP #2429
  + Dont exit extension handler process if unable to fetch
    first goal state #2440
  + Improvements for Mariner #2407, #2414
  + Add uos support #2420
  + Add support for VMware PhotonOS #2431
- From 2.6.0.2
  + added cloudlinux support (#2344)
  + Enable extensions cpu monitoring (#2357, #2384, #2391)
  + Support Flatcar Container Linux (#2365)
  + Retrieve VmSettings from HostGAPlugin
    (#2378, #2382, #2386, #2394, #2397, #2404)
  + Set Agent's CpuQuota to 75% (#2383)
  + Use handler status if extension status is None when computing
    the ExtensionsSummary (#2358) (#2361)
  + fix bug with dependent extensions with no settings (#2285) (#2362)
  + Create events dir for handlers if ETP enabled (#2366)
  + Report status even if goal state cannot be processed (#2370)
  + Define ExtensionsSummary.eq (#2371) (#2373)
  + Implement ExtensionsSummary.ne in terms of eq (#2375)
- From 2.5.0.2
  + Enable Extension Telemetry Pipeline (#2337, #2339)
  + Enable Periodic Log Collection in systemd distros (#2295,#2289)
  + Implement InitialGoalStatePeriod parameter + improvements in logging
    goal state processing(#2332)
  + Fix operation name in InitializeHostPlugin event(#2338)
  + Mock systemctl stop cmd (#2335)
  + Report transitioning when status file not found (#2330)
  + Dont create default status file for Single-Config extensions (#2318)
  + Do not create placeholder status file for AKS extensions (#2298)
  + Save waagent_status to history folder and add additional details to
    the status file (#2325,#2301,#2270)
  + Rename Debug.FetchVmSettings to Debug.EnableFastTrack (#2324)
  + Update HostGAplugin headers before fetching vmSettings (#2323)
  + Handle HTTP GONE in vmSettings request (#2321)
  + Added log statements to debug issues in vmSettings API(#2317)
  + Remove reference to re.IGNORECASE (#2316)
  + Add and remove extension slice (#2315)
  + FastTrack changes (#2314, #2313,#2306, #2304,#2294, #2293)
  + Helper to handle exception message(#2305)
  + Remove trailing spaces from command name (#2296)
  + Add debug info for systemd-run false positives (#2292)
  + Move Github Actions VMs to Ubuntu 18 (#2291)
  + Onboard redhat82, ubuntu20 (#2290, #2279)
  + Allow systemd-run in the Agent's cgroup (#2287)
  + Use handler status if extension status is None (#2358)
  + Bug Fix :Define ExtensionsSummary.ne (#2371)
- From 2.4.0.2
  + Support for Multi config (#2245, #2261)
  + Support sles 15 sp2 distro (#2272)
  + Cleanup history folder every 30 min (#2258)
  + Updated _read_status_file to include a fragment of status file in
    the exception (#2257)
  + Fix telemetry unicode errors (Re-add #1937) (#2278)
  + Match IPoIB interface with any alphanumeric characters (#2239)
  + Fix bug with dependent extensions with no settings (#2285)
  + Do not create placeholder status file for AKS extensions (#2298)
  + Refactoring of Agent's main loop (#2275)
  + Exception for Linux Patch Extension for creating placeholder
    status file (#2307)
  + Dont create default status file for Single-Config extensions (#2318)
  + Fix bad logging (#2241)
  + Fixed logging of PeriodicOperation (#2263)
  + Log collector broken pipe fix (#2267)
  + Improved logging for Multi config (#2246)
- From 2.3.1.1
  + revert for reducing the time window where we restart the network
    interfaces of the VM
- From 2.3.0.2
  + Enforce CPUQuota on agent #2222, #2226
  + Add support for RequiredFeatures and GoalStateAggregateStatus APIs
    [#2190], #2206, #2209, #2216
  + Added fallback locations for extension manifests #2188
  + Add missing call to str.format() when creating exception #2193
  + Remove helper network service on deprovision #2191
  + Use a helper script to start the network service #2225 #2253
  + Initialize published_hostname using /var/lib/cloud/data/set-hostname #2215
  + Fix utf logging for persist firewall rules #2237
  + Replace firewall-setup unit file if changed #2236
- From 2.2.54
  + PA changes to check cloud-init (#2061)
  + log collector (#2066)
  + cgroups CPU percentage py processor count (#2074)
  + Parse InVMGoalStateMetaData from Extension Config (#2081)
  + iscsi disk support for agent configs (#2073)
  + Add support for VMs with multiple IB devices (#2085)
  + Python 3.9 support (#2082)
  + Add support for CBL-Mariner distro (#2099)
  + Enable Provisioning.MonitorHostName for Ubuntu (#1934)
  + Added supportedFeatures flag in status reporting (#2089)
  + Parse ext runtime settings (#2087)
  + GHA merge validation (#2097)
  + Cgroups improvements
  + renamed the eventsFolder variable for preview and enabled ETP (#2140)
  + Agent slice and custom unit files telemetry (#2150)
  + Make IPoIB interface online (#2116)
  + Add option to disable NetworkConfigurationChanges (#2156)
  + Log network configuration on service start (#2157)
  + Setup persistent firewall rules on service restart (#2154)
  + switched to using run_command (#2060)
  + fixes for chained-comparison and dangerous-default-value pylint
    warnings (#2072)
  + fixed depends on errors (#2059)
  + WireIp env variable added (#2078)
  + Unstick HGAP channel as default (#2046)
  + shellutil.run_command fixes (#2086, #2098)
  + unit test fixes (#2090, #2091, #2108, #2153)
  + fix distro resolution for RedHat (#2083)
  + Read KVP value in binary mode (#2084)
  + Redact protected settings in goal state debug files (#2130)
  + Modify retry logic for empty goal state (#2140)
  + GS no config fix (#2141)
  + CommandExecution.log logrototate config -&gt; custom log management (#2143)
  + binary file for firewall rules (#2147)
  + Refresh host ga plugin periodically (#2155)
  + Disabled custom service (#2166)
  + update test zips (#2167)
- From 2.2.53.1
  + Extension Telemetry Pipeline as a private-preview feature
- From 2.2.53
  + Start exthandler with the same python interpreter (#2007)
  + Verify that the extension status is an array (#2010)
  + Remove enum _UpdateType and retry fetching goal state (#2018)
  + use dd for ext4 as well as xfs (#2042)
  + Fix path for error.json (#2044)
  + Switch to run command changes, + provisioning changes that need to be
    reverted. (#2050)
  + Fix timestamp for goal state archive (#2051)
  + Case insensitive parsing or Plugins and PluginSettings (#2054)
  + Revert "Fixed delays for HTTP retries rather than exponential
    delays (#1967)" (#2065)
  + Fixed bug causing "MAC verified OK" message (#2069)
  + Revert unicode fix manually (#1937) (#2070)
  + Recreate handler environment file on service startup (#1960)
  + Add log collection tool and thread (#1987)
  + Thread interface (#1990)
  + Verify that the CPU and Memory cgroups for the agent are properly
    initialized; disabled cgroups if they are not active. (#2015)
  + SUSE config: use Btrfs LZO compression for ResourceDisk (#2055)
  + Extension telemetry pipeline (#1918)
  + Reformatted the heartbeat event (#2009)
  + Add LIS version to OSInfo.message (#2011)
  + One thread for telemetry (#2019)
  + Limit description character length sent for health report (#2020)
  + Remove Serial Console Logging (#2028)
  + Echo log to /dev/console during provisioning (#2043)
  + Adding telemetry for logrotate (#2045)
  + Report placeholder extension status as an array (#2068)
  + Fix broken link in readme (#2014)
  + Add log collector flags to README (#2029)
- From 2.2.52
  + Do not retrieve users in each goal state (#1935)
  + Fix check for systemd-run failure when invoking extensions (#1943)
  + Fix telemetry unicode errors (#1937)
  + Uninstall unregistered extensions (#1970)
  + Use run_command to execute iptables (#1944)
  + Use run_command for ip route (#1958)
  + Fix handling of gen2 disks with udev rules (#1954)
  + Add API for uploading logs via host plugin (#1902)
  + Fixed delays for HTTP retries rather than exponential delays (#1967)
  + Resolve undefined variable (#1950)
  + Convert owner uid to string (#1949)
  + Fix Travis special checks for distro and remove useless cgroup tests (#1959)
  + Use tmp_dir instead of data_dir (#1968)</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="rjschwei@suse.com" date="1664452800">- Update to version 2.8.0.11 (bsc#1203164)
  + Enabled support for Fast Track (faster processing of extensions)
  + Add telemetry for VM Size
  + Add telemetry for environment variables passed to extensions
  + Enforce CPU quota on the Agent on Red Hat and CentOS 7.4+
  + Restore all firewall rules needed for communication with the WireServer
  + Fix false positives reporting processes in the Agent's cgroup
  + Fix false errors when collecting debug logs
  + Don't report incorrect CPU usage data
  + Fetching a goal state with empty certificates property
  + Silence goal state fetch errors after 3 logs
  + Change fast track timestamp default from None to datetime.min
  + Retry HGAP's extensionsArtifact requests on BAD_REQUEST status
  + Support for Rocky Linux
  + RHEL 8
  + RHEL 9
  + Preliminary work to enforce CPU quota on extensions
  + Preliminary work for management of agent self-updates [GA Versioning]
  + Add CentOS 7.9 to end-to-end-tests
  + Add Mariner to end-to-end-tests
- 2.8.0.11 followed 2.7.3.0, no intermediate releases</changelog>
  <changelog author="rjschwei@suse.com" date="1664452801">- Add paa_12_sp5_rdma_no_ext_driver.patch (bsc#1203181)</changelog>
</package>
<package pkgid="a4a6452e56696275adf825a6ba8d7d6e018423ce3f0c8ffd9d2fb26bd75fa644" name="python-azure-agent" arch="src">
  <version epoch="0" ver="2.8.0.11" rel="150100.3.26.1"/>
  <changelog author="rjschwei@suse.com" date="1549540800">- Update to 2.2.36 (bsc#1119542)
  - Remove, included upstream
    + paa_fix_driver_install_detect.patch
    + paa_rdma_install_proper_driver.patch
    + 0001-Obtain-platform-information-in-Python-version-depend.patch
    + 0001-Detect-openSUSE-and-SLES.patch
    + 0001-Handle-the-disapperance-of-net-tools.patch
    + 0001-Properly-detect-SLES-15-for-rdma-support.patch
  - Forward port agent-no-auto-update.patch
  - [#1451] Do not utf-8 encode telemetry messages
- From 2.2.35
  + [#1434] Use files instead of pipes to capture stdout/stderr
  + [#1431] Prevent multiple downloads of zips
  + [#1418] Add main module to Python's egg
  + [#1416] Fix UTF-8 encoding for telemetry payload
  + [#1408] Honor the 'no_proxy' flag
  + [#1391, #1401, #1441] Azure Stack improvements
  + [#1384] Write status file in WALinuxAgent lib folder
  + [#1375] Add support for Redhat
  + [#1373] Handle different kernel builds on SUSE Linux Enterprise
  + [#1365, #1385, #1389] Fixes for RDMA
- From 2.2.34
  + [#1397] Send events when extensions fail to complete operation
  + [#1394/#1366] Fix the threshold telemetry issue
  + [#1298] Implementing extension sequencing in azure Linux agent
  + [#1340] Allow Clear Linux detection in python2 and python3
  + [#1345] FreeBSD swap issues fix (#1144)
  + [#1349] Use append_file in Redhat6xOSUtil.openssl_to_openssh()
  + [#1355] Ensure 'value' for authorized ssh keys end in "\n"
  + [#1361] Remove main module
- From 2.2.32
  + [#1325] Enable cgroups by default on all distros
  + [#1327, #1347] Allow enforcing of cgroups limits
  + [#1337] Allow configuration for cgroups
  + [#1333] Add support for NSBSD
  + [#1319] Stream extension downloads to disk
    (do not buffer the download in memory)
  + [#1303] Fix to support custom DNS servers
  + [#1306] Log extension stdout and stderr
  + [#1302] Better of cloud-init configuration during deprovisioning
  + [#1295] Fix to report the correct extension error code
  + [#1289] Allow disabling the agent or extensions
  + [#1290] Use the "ip route" command instead of the "route" comand
    during network configuration
  + [#1281] Delete JIT accounts
  + [#1234] Fix for reading KVP values from host
  + [#1287] Add UDEV rule in azure disk encryption
- From 2.2.31
  Upstream version jump
  + [#1196] Health store integration
  + [#1199] CGroups support
  + [#1194] Use host for status reporting
  + [#1188] Fix for sentinel and signal handlers
  + [#1182] Telemetry updates
  + [#1171] Add support for JIT
  + [#1164] Fix for name resolution in Ubuntu 18.04
  + [#1154] Set connection close header
  + [#1143] Remove extension packages after extraction
- From 2.2.26
  + Update Debian specific configuration and setup.
- From 2.2.25
  + Upstream version jump
  + Revert extension manifest caching to prevent downgrade issues.
- From 2.2.20
  + This is a hotfix release for #945, details and mitigation are available
    in the wiki.
- From 2.2.29
  + [#929] wire.py#update_goal_state does not handle out-of-date
    GoalState errors
  + [#908] Set Files to 0400 in /var/lib/waagent
  + [#906] Hardcoded value for sshd's ClientAliveInterval (180)
  + [#899] Improve HeartBeat Event
  + [#898] Send dummy status if extension fails to write a #.status file
  + [#897] 'Target handler state' wall of errors
  + [#896] End of Line Comments are Not Supported nor Handled
  + [#891] Create a Telemetry Event to Track Custom Data Execution
  + [#884] Cleanup Old Goal State and Extension Cache
  + [#876] The agent should use a scaling back-off when retrying HTTP requests
  + [#869] The agent should report OS information in the correct JSON format.
  + [#822] Update docs</changelog>
  <changelog author="rjschwei@suse.com" date="1551960000">- Add paa_cve_2019-0804.patch (bsc#1127838)
  - An issue with swapfile handling in the agent creates a data leak situation
    that exposes system memory data.</changelog>
  <changelog author="rjschwei@suse.com" date="1575547200">- Update to version 2.2.45 (jsc#ECO-80)
  + Remove paa_cve_2019-0804.patch, included upstream
  + Add support for Gen2 VM resource disks
  + Use alternate systemd detection
  + Fix /proc/net/route requirement that causes errors on FreeBSD
  + Add cloud-init auto-detect to prevent multiple provisioning mechanisms
    from relying on configuration for coordination
  + Disable cgroups when daemon is setup incorrectly
  + Remove upgrade extension loop for the same goal state
  + Add container id for extension telemetry events
  + Be more exact when detecting IMDS service health
  + Changing add_event to start sending missing fields
- From 2.2.44
  + Remove outdated extension ZIP packages
  + Improved error handling when starting extensions using systemd
  + Reduce provisioning time of some custom images
  + Improve the handling of extension download errors
  + New API for extension authors to handle errors during extension update
  + Fix handling of errors in calls to openssl
  + Improve logic to determine current distro
  + Reduce verbosity of several logging statements
- From 2.2.42
  + Poll for artifact blob, addresses goal state procesing issue
- From 2.2.41
  + Rewriting the mechanism to start the extension using systemd-run for
    systems using systemd for managing
  + Refactoring of resource monitoring framework using cgroup for both
    systemd and non-systemd approaches [#1530, #1534]
  + Telemetry pipeline for resource monitoring data
- From 2.2.40
  + Fixed tracking of memory/cpu usage
  + Do not prevent extensions from running if setting up cgroups fails
  + Enable systemd-aware deprovisioning on all versions &gt;= 18.04
  + Add systemd support for Debian Jessie, Stretch, and Buster
  + Support for Linux Openwrt
- From 2.2.38
  + Fix CVE-2019-0804
  + Add fixes for handling swap file and other nit fixes
- From 2.2.37
  + Improves re-try logic to handle errors while downloading extensions</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1585051200">- Add paa_use_hostnamectl.patch (bsc#1167601, bsc#1167602)
  + Set the hostname using hostnamectl to ensure setting is
    properly applied</changelog>
  <changelog author="rjschwei@suse.com" date="1594987200">- Add proper_dhcp_config_set.patch (bsc#1173866)
  + Properly set the dhcp configuration to push the hostname to the DHCP
    server
  + Do not bring the interface down to push the hostname, just use ifup</changelog>
  <changelog author="rjschwei@suse.com" date="1597406400">- Drop paa_sudo_sle15_nopwd.patch (bsc#1175198)
  + sudoers file is managed by cloud-init we no longer need this hack</changelog>
  <changelog author="rjschwei@suse.com" date="1599739200">- Update to version 2.2.49.2 (bsc#1176368, bsc#1176369)
  + Remove paa_use_hostnamectl.patch included upstream
  + Forwrad port proper_dhcp_config_set.patch
  + Do not use --unit with systemd-cgls (#1910)
  + Report processes that do not belong to the agent's cgroup (#1908)
  + Use controller mount point for extension cgroup path (#1899)
  + Improvements in setup of cgroups (#1896)
  + Remove ExtensionsMetricsData and per-process Memory data (#1884)
  + Fix return value of start_extension_command (#1927)
  + Remove import * (#1900)
  + Fix flaky ExtensionCleanupTest class (#1898)
  + Fix codecov badge (#1883)
  + Changed codecov to run on py3.8 (#1875)
  + Update documentation on /dev/random (#1909)
  + Mount options are in mount(8) (#1893)
  + Remove ssh host key thumbprint in report ready (#1913)
  + Emit AutoUpdate value at service start only (#1907)
  + Add logging for version mismatch (#1895)
  + Send telemetry event if libdir changes (#1897)
  + Add log collector utility (#1847)
  + Move AutoUpdate reporting to HeartBeat event (#1919)
  + Removing infinite download of extension manifest without a new GS (#1874)
  + Fix wrongful dir deletion (#1873)
  + Fix the cleanup-outdated-handlers to only delete handlers that are not
    present in the GS (#1889)
  + Expose periods of environment thread in waagent.conf (#1891)
  + Added user @kevinclark19a as Contributor. (#1906)
- From 2.2.48.1
  + Refactoring GoalState class out of Protocol, making Protocol thread-safe,
    removing stale dependencies of Protocol and removing the dependency on
    the file system to read the Protocol info
  + Fetch goal state when creating HostPluginProtocol (#1799)
  + Separate goal state from the protocol class (#1777)
  + Make protocol util a singleton per thread (#1743, #1756)
  + Fetch goal state before sending telemetry (#1751)
  + Remove file dependency (#1754)
  + Others (#1758, #1767, #1744, #1749, #1816, #1820)
  + New logs for goal state fetch (#1797) and refresh (#1794).
  + Thread name added to logs (#1778)
  + Populate telemetry events at creation time (#1791)
  + Periodic HeartBeat to be logged to the file (#1755)
  + Add unit test to verify call stacks on telemetry events (#1828)
  + Others (#1841, #1842, #1846)
  + Handling errors while reading extension status files
    (Limiting Size and Transient issues)(#1761)
  + Enable SWAP on Resource Disk as Application Certification Support
    suggested (#1762)
  + Update 'Provisioning' options in default configs ( #1853)
  + Drop Metadata Server Support (#1806, #1839, #1840 )
  + Improve documentation of ResourceDisk.EnableSwapEncryption (#1782)
  + Removed is_snappy function (#1774)
  + Handle exceptions in monitor thread (#1770)
  + Fix timestamp for periodic operations in the monitor thread (#1879)
  + Fix permissions on the Ubuntu systemd service file (#1814)
  + Update hostname setting for SUSE distros (#1832)
  + Python 3.8 improvements + support for Ubuntu 20.04 (#1860, #1865, #1738)
  + Testing and dev-infra improvements
    [#1771, #1768, #1800, #1826, #1827, #1833]
  + Others (#1854, #1858)
- From 2.2.46
  + [#1741] Do not update goal state when refreshing the host plugin
  + [#1731] Fix upgrade sequence when update command fails
  + [#1725] Initialize CPU usage
  + [#1716, #1737] Added UTC logging and correcting the format
  + [#1651, #1729] Start sending PerformanceCounter metrics and
    additional memory information for Cgroups</changelog>
  <changelog author="rjschwei@suse.com" date="1601726400">- Update proper_dhcp_config_set.patch (bsc#1177161, bsc#1177257)
  + Add missing imports</changelog>
  <changelog author="rjschwei@suse.com" date="1610452800">- Add sle_hpc-is-sles.patch (bsc#1180719)
  + Recognise SLE_HPC as SLES and use the proper RDMA handler and
    distro specific initialization code</changelog>
  <changelog author="rjschwei@suse.com" date="1612008000">- Add sysvinit-tools as dependency (bsc#1181600, bsc#1181601)</changelog>
  <changelog author="rjschwei@suse.com" date="1651752000">- Add reset-dhcp-deprovision.patch (bsc#1198258)
  + Reset the dhcp config when deprovisioning and instance to ensure
    instances from aVM image created from that instance send host information
    to the DHCP server.</changelog>
  <changelog author="pgajdos@suse.com" date="1652788800">- require python-rpm-macros to fix build for TW
- do not require test dependencies for build, they are not needed
  (no testsuite run in %check)</changelog>
  <changelog author="schubi@suse.com" date="1655294400">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="schubi@suse.com" date="1655726400">- Cleanup spec file:
  - - Removed %{_distconfdir}/logrotate.d from dirlist. It will be
    handled by package filelist now.
  - - %{_distconfdir}/logrotate.d/* can be changed by vendor only.
    So it will be replaced by an RPM update.</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Removed %config flag for files in /usr directory.</changelog>
  <changelog author="rjschwei@suse.com" date="1660219200">- Update to 2.7.3.0 (jsc#PED-1298)
  + Remove proper_dhcp_config_set.patch included upstream
  + Remove sle_hpc-is-sles.patch included upstream
  + Forward port reset-dhcp-deprovision.patch
  + Retry HGAP's extensionsArtifact requests on BAD_REQUEST status #2622
  + Use 'ip' instead of 'ifdown/ifup' to restart network interface on
    RHEL &gt;= 8.6 #2612 #2624
- From 2.7.1.0
  + hotfix for OOM errors on the log collector
- From 2.7.0.6
  + Increase time of autoupdates after updates are available #2403
  + Send telemetry when upgrade available #2421
  + Enable collection of debugging information #2436, #2453, #2510
  + Add support for Python 2.6 to the debug info collection code #2452
  + Enable CPU/memory data collection on RedHat and CentOS #2450
  + Exclude end-to-end tests from Agent setup #2396, #2402
  + Fix log message in cgroups management #2427
  + Fix parsing of malformed error.json files #2433
  + Allow DNS queries over TCP #2429
  + Dont exit extension handler process if unable to fetch
    first goal state #2440
  + Improvements for Mariner #2407, #2414
  + Add uos support #2420
  + Add support for VMware PhotonOS #2431
- From 2.6.0.2
  + added cloudlinux support (#2344)
  + Enable extensions cpu monitoring (#2357, #2384, #2391)
  + Support Flatcar Container Linux (#2365)
  + Retrieve VmSettings from HostGAPlugin
    (#2378, #2382, #2386, #2394, #2397, #2404)
  + Set Agent's CpuQuota to 75% (#2383)
  + Use handler status if extension status is None when computing
    the ExtensionsSummary (#2358) (#2361)
  + fix bug with dependent extensions with no settings (#2285) (#2362)
  + Create events dir for handlers if ETP enabled (#2366)
  + Report status even if goal state cannot be processed (#2370)
  + Define ExtensionsSummary.eq (#2371) (#2373)
  + Implement ExtensionsSummary.ne in terms of eq (#2375)
- From 2.5.0.2
  + Enable Extension Telemetry Pipeline (#2337, #2339)
  + Enable Periodic Log Collection in systemd distros (#2295,#2289)
  + Implement InitialGoalStatePeriod parameter + improvements in logging
    goal state processing(#2332)
  + Fix operation name in InitializeHostPlugin event(#2338)
  + Mock systemctl stop cmd (#2335)
  + Report transitioning when status file not found (#2330)
  + Dont create default status file for Single-Config extensions (#2318)
  + Do not create placeholder status file for AKS extensions (#2298)
  + Save waagent_status to history folder and add additional details to
    the status file (#2325,#2301,#2270)
  + Rename Debug.FetchVmSettings to Debug.EnableFastTrack (#2324)
  + Update HostGAplugin headers before fetching vmSettings (#2323)
  + Handle HTTP GONE in vmSettings request (#2321)
  + Added log statements to debug issues in vmSettings API(#2317)
  + Remove reference to re.IGNORECASE (#2316)
  + Add and remove extension slice (#2315)
  + FastTrack changes (#2314, #2313,#2306, #2304,#2294, #2293)
  + Helper to handle exception message(#2305)
  + Remove trailing spaces from command name (#2296)
  + Add debug info for systemd-run false positives (#2292)
  + Move Github Actions VMs to Ubuntu 18 (#2291)
  + Onboard redhat82, ubuntu20 (#2290, #2279)
  + Allow systemd-run in the Agent's cgroup (#2287)
  + Use handler status if extension status is None (#2358)
  + Bug Fix :Define ExtensionsSummary.ne (#2371)
- From 2.4.0.2
  + Support for Multi config (#2245, #2261)
  + Support sles 15 sp2 distro (#2272)
  + Cleanup history folder every 30 min (#2258)
  + Updated _read_status_file to include a fragment of status file in
    the exception (#2257)
  + Fix telemetry unicode errors (Re-add #1937) (#2278)
  + Match IPoIB interface with any alphanumeric characters (#2239)
  + Fix bug with dependent extensions with no settings (#2285)
  + Do not create placeholder status file for AKS extensions (#2298)
  + Refactoring of Agent's main loop (#2275)
  + Exception for Linux Patch Extension for creating placeholder
    status file (#2307)
  + Dont create default status file for Single-Config extensions (#2318)
  + Fix bad logging (#2241)
  + Fixed logging of PeriodicOperation (#2263)
  + Log collector broken pipe fix (#2267)
  + Improved logging for Multi config (#2246)
- From 2.3.1.1
  + revert for reducing the time window where we restart the network
    interfaces of the VM
- From 2.3.0.2
  + Enforce CPUQuota on agent #2222, #2226
  + Add support for RequiredFeatures and GoalStateAggregateStatus APIs
    [#2190], #2206, #2209, #2216
  + Added fallback locations for extension manifests #2188
  + Add missing call to str.format() when creating exception #2193
  + Remove helper network service on deprovision #2191
  + Use a helper script to start the network service #2225 #2253
  + Initialize published_hostname using /var/lib/cloud/data/set-hostname #2215
  + Fix utf logging for persist firewall rules #2237
  + Replace firewall-setup unit file if changed #2236
- From 2.2.54
  + PA changes to check cloud-init (#2061)
  + log collector (#2066)
  + cgroups CPU percentage py processor count (#2074)
  + Parse InVMGoalStateMetaData from Extension Config (#2081)
  + iscsi disk support for agent configs (#2073)
  + Add support for VMs with multiple IB devices (#2085)
  + Python 3.9 support (#2082)
  + Add support for CBL-Mariner distro (#2099)
  + Enable Provisioning.MonitorHostName for Ubuntu (#1934)
  + Added supportedFeatures flag in status reporting (#2089)
  + Parse ext runtime settings (#2087)
  + GHA merge validation (#2097)
  + Cgroups improvements
  + renamed the eventsFolder variable for preview and enabled ETP (#2140)
  + Agent slice and custom unit files telemetry (#2150)
  + Make IPoIB interface online (#2116)
  + Add option to disable NetworkConfigurationChanges (#2156)
  + Log network configuration on service start (#2157)
  + Setup persistent firewall rules on service restart (#2154)
  + switched to using run_command (#2060)
  + fixes for chained-comparison and dangerous-default-value pylint
    warnings (#2072)
  + fixed depends on errors (#2059)
  + WireIp env variable added (#2078)
  + Unstick HGAP channel as default (#2046)
  + shellutil.run_command fixes (#2086, #2098)
  + unit test fixes (#2090, #2091, #2108, #2153)
  + fix distro resolution for RedHat (#2083)
  + Read KVP value in binary mode (#2084)
  + Redact protected settings in goal state debug files (#2130)
  + Modify retry logic for empty goal state (#2140)
  + GS no config fix (#2141)
  + CommandExecution.log logrototate config -&gt; custom log management (#2143)
  + binary file for firewall rules (#2147)
  + Refresh host ga plugin periodically (#2155)
  + Disabled custom service (#2166)
  + update test zips (#2167)
- From 2.2.53.1
  + Extension Telemetry Pipeline as a private-preview feature
- From 2.2.53
  + Start exthandler with the same python interpreter (#2007)
  + Verify that the extension status is an array (#2010)
  + Remove enum _UpdateType and retry fetching goal state (#2018)
  + use dd for ext4 as well as xfs (#2042)
  + Fix path for error.json (#2044)
  + Switch to run command changes, + provisioning changes that need to be
    reverted. (#2050)
  + Fix timestamp for goal state archive (#2051)
  + Case insensitive parsing or Plugins and PluginSettings (#2054)
  + Revert "Fixed delays for HTTP retries rather than exponential
    delays (#1967)" (#2065)
  + Fixed bug causing "MAC verified OK" message (#2069)
  + Revert unicode fix manually (#1937) (#2070)
  + Recreate handler environment file on service startup (#1960)
  + Add log collection tool and thread (#1987)
  + Thread interface (#1990)
  + Verify that the CPU and Memory cgroups for the agent are properly
    initialized; disabled cgroups if they are not active. (#2015)
  + SUSE config: use Btrfs LZO compression for ResourceDisk (#2055)
  + Extension telemetry pipeline (#1918)
  + Reformatted the heartbeat event (#2009)
  + Add LIS version to OSInfo.message (#2011)
  + One thread for telemetry (#2019)
  + Limit description character length sent for health report (#2020)
  + Remove Serial Console Logging (#2028)
  + Echo log to /dev/console during provisioning (#2043)
  + Adding telemetry for logrotate (#2045)
  + Report placeholder extension status as an array (#2068)
  + Fix broken link in readme (#2014)
  + Add log collector flags to README (#2029)
- From 2.2.52
  + Do not retrieve users in each goal state (#1935)
  + Fix check for systemd-run failure when invoking extensions (#1943)
  + Fix telemetry unicode errors (#1937)
  + Uninstall unregistered extensions (#1970)
  + Use run_command to execute iptables (#1944)
  + Use run_command for ip route (#1958)
  + Fix handling of gen2 disks with udev rules (#1954)
  + Add API for uploading logs via host plugin (#1902)
  + Fixed delays for HTTP retries rather than exponential delays (#1967)
  + Resolve undefined variable (#1950)
  + Convert owner uid to string (#1949)
  + Fix Travis special checks for distro and remove useless cgroup tests (#1959)
  + Use tmp_dir instead of data_dir (#1968)</changelog>
  <changelog author="schubi@suse.com" date="1662033600">- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.</changelog>
  <changelog author="rjschwei@suse.com" date="1664452800">- Update to version 2.8.0.11 (bsc#1203164)
  + Enabled support for Fast Track (faster processing of extensions)
  + Add telemetry for VM Size
  + Add telemetry for environment variables passed to extensions
  + Enforce CPU quota on the Agent on Red Hat and CentOS 7.4+
  + Restore all firewall rules needed for communication with the WireServer
  + Fix false positives reporting processes in the Agent's cgroup
  + Fix false errors when collecting debug logs
  + Don't report incorrect CPU usage data
  + Fetching a goal state with empty certificates property
  + Silence goal state fetch errors after 3 logs
  + Change fast track timestamp default from None to datetime.min
  + Retry HGAP's extensionsArtifact requests on BAD_REQUEST status
  + Support for Rocky Linux
  + RHEL 8
  + RHEL 9
  + Preliminary work to enforce CPU quota on extensions
  + Preliminary work for management of agent self-updates [GA Versioning]
  + Add CentOS 7.9 to end-to-end-tests
  + Add Mariner to end-to-end-tests
- 2.8.0.11 followed 2.7.3.0, no intermediate releases</changelog>
  <changelog author="rjschwei@suse.com" date="1664452801">- Add paa_12_sp5_rdma_no_ext_driver.patch (bsc#1203181)</changelog>
</package>
<package pkgid="868398598fb9a4803d988e7cebbb2d11be08132f33f3e52909faa23a46565712" name="python-botocore" arch="src">
  <version epoch="0" ver="1.26.4" rel="150200.37.9.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Enable python2 builds for SLE-15</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Version update to 1.20.112
  * api-change:``dms``: Release of feature needed for ECA-Endpoint settings. This allows
    customer to delete a field in endpoint settings by using --exact-settings flag in modify-
    endpoint api. This also displays default values for certain required fields of endpoint
    settings in describe-endpoint-settings api.
  * api-change:``glue``: Add support for Event Driven Workflows
  * api-change:``acm``: Added support for RSA 3072 SSL certificate import
  * api-change:``healthlake``: General availability for Amazon HealthLake. StartFHIRImportJob
    and StartFHIRExportJob APIs now require AWS KMS parameter. For more information, see the
    Amazon HealthLake Documentation https://docs.aws.amazon.com/healthlake/index.html.
  * api-change:``wellarchitected``: This update provides support for Well-Architected API users
    to mark answer choices as not applicable.
  * api-change:``lightsail``: This release adds support for the Amazon Lightsail object storage
    service, which allows you to create buckets and store objects.
- from version 1.20.111
  * api-change:``amplifybackend``: Added Sign in with Apple OAuth provider.
  * api-change:``redshift``: Release new APIs to support new Redshift feature - Authentication Profile
  * api-change:``ssm``: Changes to OpsCenter APIs to support a new feature, operational insights.
  * api-change:``lex-models``: Customers can now migrate bots built with Lex V1 APIs to V2 APIs.
    This release adds APIs to initiate and manage the migration of a bot.
  * api-change:``directconnect``: This release adds a new filed named awsLogicalDeviceId that it
    displays the AWS Direct Connect endpoint which terminates a physical connection's BGP Sessions.
  * api-change:``pricing``: Documentation updates for api.pricing
- from version 1.20.110
  * api-change:``eks``: Documentation updates for Wesley to support the parallel node upgrade feature.
  * api-change:``kendra``: Amazon Kendra now supports Principal Store
- from version 1.20.109
  * api-change:``sagemaker``: Releasing new APIs related to Tuning steps in model building pipelines.
  * api-change:``frauddetector``: This release adds support for ML Explainability to display model
    variable importance value in Amazon Fraud Detector.
  * api-change:``mediaconvert``: MediaConvert now supports color, style and position information
    passthrough from 608 and Teletext to SRT and WebVTT subtitles. MediaConvert now also supports
    Automatic QVBR quality levels for QVBR RateControlMode.
- from version 1.20.108
  * api-change:``eks``: Added waiters for EKS FargateProfiles.
  * api-change:``outposts``: Added property filters for listOutposts
  * api-change:``fms``: AWS Firewall Manager now supports route table monitoring, and provides
    remediation action recommendations to security administrators for AWS Network Firewall policies
    with misconfigured routes.
  * api-change:``mediatailor``: Add ListAlerts for Channel, Program, Source Location, and VOD Source to
    return alerts for resources.
  * api-change:``devops-guru``: Add AnomalyReportedTimeRange field to include open and close
    time of anomalies.
  * api-change:``ssm-contacts``: Updated description for CreateContactChannel contactId.
- from version 1.20.107
  * api-change:``iam``: Documentation updates for AWS Identity and Access Management (IAM).
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``mq``: adds support for modifying the maintenance window for brokers.
  * api-change:``cloudfront``: Amazon CloudFront now provides two new APIs, ListConflictingAliases and
    AssociateAlias, that help locate and move Alternate Domain Names (CNAMEs) if you encounter the
    CNAMEAlreadyExists error code.
  * api-change:``chime``: Releasing new APIs for AWS Chime MediaCapturePipeline
  * api-change:``iotsitewise``: This release add storage configuration APIs for AWS IoT SiteWise.
  * api-change:``storagegateway``: Adding support for oplocks for SMB file shares,  S3 Access Point and
    S3 Private Link for all file shares and IP address support for file system associations
  * api-change:``ec2``: This release adds resource ids and tagging support for VPC security group rules.
- from version 1.20.106
  * api-change:``lambda``: Added support for AmazonMQRabbitMQ as an event source. Added support for
    VIRTUAL_HOST as SourceAccessType for streams event source mappings.
  * api-change:``imagebuilder``: Adds support for specifying parameters to customize components for recipes.
    Expands configuration of the Amazon EC2 instances that are used for building and testing images,
    including the ability to specify commands to run on launch, and more control over installation and
    removal of the SSM agent.
  * api-change:``mgn``: Bug fix: Remove not supported EBS encryption type "NONE"
  * api-change:``eks``: Adding new error code UnsupportedAddonModification for Addons in EKS
  * api-change:``macie2``: Sensitive data findings in Amazon Macie now include enhanced location
    data for JSON and JSON Lines files
  * api-change:``sns``: Documentation updates for Amazon SNS.
- from version 1.20.105
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``ec2``: This release removes network-insights-boundary
- from version 1.20.104
  * api-change:``sagemaker``: SageMaker model registry now supports up to 5 containers
    and associated environment variables.
  * api-change:``sqs``: Documentation updates for Amazon SQS.
  * api-change:``ec2``: Adding a new reserved field to support future infrastructure
    improvements for Amazon EC2 Fleet.
- from version 1.20.103
  * api-change:``autoscaling``: Amazon EC2 Auto Scaling infrastructure improvements and optimizations.
  * api-change:``kendra``: Amazon Kendra Enterprise Edition now offered in smaller more granular units
    to enable customers with smaller workloads. Virtual Storage Capacity units now offer scaling in
    increments of 100,000 documents (up to 30GB) per unit and Virtual Query Units offer scaling increments
    of 8,000 queries per day.
  * api-change:``mediapackage-vod``: Add support for Widevine DRM on CMAF packaging configurations.
    Both Widevine and FairPlay DRMs can now be used simultaneously, with CBCS encryption.
  * api-change:``ssm-contacts``: Fixes the tag key length range to 128 chars,  tag value length to 256
    chars; Adds support for UTF-8 chars for contact and channel names, Allows users to unset name in
    UpdateContact API; Adds throttling exception to StopEngagement API, validation exception to APIs
    UntagResource, ListTagsForResource
  * api-change:``databrew``: Adds support for the output of job results to the AWS Glue Data Catalog.
  * api-change:``servicediscovery``: AWS Cloud Map now allows configuring the TTL of the SOA record for a
    hosted zone to control the negative caching for new services.
- from version 1.20.102
  * api-change:``sagemaker``: Sagemaker Neo now supports running compilation jobs using customer's Amazon VPC
  * api-change:``glue``: Add JSON Support for Glue Schema Registry
  * api-change:``redshift``: Added InvalidClusterStateFault to the DisableLogging API, thrown when calling the
    API on a non available cluster.
  * api-change:``mediaconvert``: MediaConvert adds support for HDR10+, ProRes 4444,  and XAVC outputs, ADM/DAMF
    support for Dolby Atmos ingest, and alternative audio and WebVTT caption ingest via HLS inputs. MediaConvert
    also now supports creating trickplay outputs for Roku devices for HLS, CMAF, and DASH output groups.
- from version 1.20.101
  * api-change:``proton``: Added waiters for template registration, service operations, and environment deployments.
  * api-change:``amplifybackend``: Imports an existing backend authentication resource.
  * api-change:``snowball``: AWS Snow Family customers can remotely monitor and operate their connected AWS Snowcone
    devices. AWS Snowball Edge Storage Optimized customers can now import and export their data using NFS.
- from version 1.20.100
  * api-change:``chime``: Adds EventIngestionUrl field to MediaPlacement
  * api-change:``cloud9``: Minor update to AWS Cloud9 documentation to allow correct parsing of outputted text
  * api-change:``connect``: Released Amazon Connect quick connects management API for general availability (GA).
    For more information, see https://docs.aws.amazon.com/connect/latest/APIReference/Welcome.html
  * api-change:``dax``: Add support for encryption in transit to DAX clusters.
  * api-change:``wafv2``: Added support for 15 new text transformation.
  * api-change:``kendra``: Amazon Kendra now supports SharePoint 2013 and SharePoint 2016 when
    using a SharePoint data source.
  * api-change:``securityhub``: Added new resource details for ECS clusters and ECS task definitions. Added
    additional information for S3 buckets, Elasticsearch domains, and API Gateway V2 stages.
  * api-change:``transfer``: Customers can successfully use legacy clients with Transfer Family endpoints enabled
    for FTPS and FTP behind routers, firewalls, and load balancers by providing a Custom IP address used for data
    channel communication.
  * api-change:``codebuild``: BucketOwnerAccess is currently not supported
- from version 1.20.99
  * api-change:``docdb``: DocumentDB documentation-only edits
  * api-change:``cloud9``: Updated documentation for CreateEnvironmentEC2 to explain that because Amazon Linux AMI
    has ended standard support as of December 31, 2020, we recommend you choose Amazon Linux 2--which includes long
    term support through 2023--for new AWS Cloud9 environments.
  * api-change:``quicksight``: Releasing new APIs for AWS QuickSight Folders
  * api-change:``mediatailor``: Update GetChannelSchedule to return information on ad breaks.
  * api-change:``cloudfront``: Amazon CloudFront adds support for a new security policy, TLSv1.2_2021.
  * api-change:``license-manager``: AWS License Manager now allows license administrators and end users to communicate
    to each other by setting custom status reasons when updating the status on a granted license.
  * api-change:``ec2``: This release adds support for provisioning your own IP (BYOIP) range in multiple regions.
    This feature is in limited Preview for this release. Contact your account manager if you are interested in
    this feature.
  * api-change:``events``: Added the following parameters to ECS targets: CapacityProviderStrategy, EnableECSManagedTags,
    EnableExecuteCommand, PlacementConstraints, PlacementStrategy, PropagateTags, ReferenceId, and Tags
  * api-change:``cloudsearch``: This release replaces previous generation CloudSearch instances with equivalent new
    instances that provide better stability at the same price.
  * api-change:``codeguru-reviewer``: Adds support for S3 based full repository analysis and changed lines scan.
- from version 1.20.98
  * api-change:``cloudformation``: CloudFormation registry service now supports 3rd party public type sharing
- from version 1.20.97
  * api-change:``kendra``: Amazon Kendra now supports the indexing of web documents for search through the web crawler.
  * api-change:``sagemaker``: Enable ml.g4dn instance types for SageMaker Batch Transform and SageMaker Processing
  * api-change:``rds``: This release enables Database Activity Streams for RDS Oracle
  * api-change:``chime``: This release adds a new API UpdateSipMediaApplicationCall, to update an in-progress
    call for SipMediaApplication.
- from version 1.20.96
  * api-change:``kms``: Adds support for multi-Region keys
  * api-change:``ec2``: This release adds support for VLAN-tagged network traffic over an Elastic Network Interface
    (ENI). This feature is in limited Preview for this release. Contact your account manager if you are interested
    in this feature.
  * api-change:``rds``: This release enables fast cloning in Aurora Serverless. You can now clone between Aurora
    Serverless clusters and Aurora Provisioned clusters.
  * api-change:``mediatailor``: Adds AWS Secrets Manager Access Token Authentication for Source Locations
- from version 1.20.95
  * api-change:``redshift-data``: Redshift Data API service now supports SQL parameterization.
  * api-change:``connect``: This release adds new sets of APIs: AssociateBot, DisassociateBot, and ListBots. You can
    use it to programmatically add an Amazon Lex bot or Amazon Lex V2 bot on the specified Amazon Connect instance
  * api-change:``ec2``: EC2 M5n, M5dn, R5n, R5dn metal instances with 100 Gbps network performance and Elastic Fabric
    Adapter (EFA) for ultra low latency
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
- from version 1.20.94
  * api-change:``lookoutmetrics``: Added "LEARNING" status for anomaly detector and updated description for "Offset"
    parameter in MetricSet APIs.
  * api-change:``iotanalytics``: Adds support for data store partitions.
  * api-change:``greengrassv2``: We have verified the APIs being released here and are ready to release
- from version 1.20.93
  * api-change:``ec2``: Amazon EC2 adds new AMI property to flag outdated AMIs
  * api-change:``medialive``: AWS MediaLive now supports OCR-based conversion of DVB-Sub and SCTE-27 image-based
    source captions to WebVTT, and supports ingest of ad avail decorations in HLS input manifests.
  * api-change:``mediaconnect``: When you enable source failover, you can now designate one of two sources as the
    primary source. You can choose between two failover modes to prevent any disruption to the video stream. Merge
    combines the sources into a single stream. Failover allows switching between a primary and a backup stream.
- from version 1.20.92
  * api-change:``sagemaker``: Using SageMaker Edge Manager with AWS IoT Greengrass v2 simplifies accessing, maintaining,
    and deploying models to your devices. You can now create deployable IoT Greengrass components during edge packaging
    jobs. You can choose to create a device fleet with or without creating an AWS IoT role alias.
  * api-change:``appmesh``: AppMesh now supports additional routing capabilities in match and rewrites for Gateway Routes
    and Routes. Additionally, App Mesh also supports specifying DNS Response Types in Virtual Nodes.
  * api-change:``redshift``: Added InvalidClusterStateFault to the ModifyAquaConfiguration API, thrown when calling the
    API on a non available cluster.
  * api-change:``chime``: This SDK release adds support for UpdateAccount API to allow users to update their default
    license on Chime account.
  * api-change:``ec2``: This release adds a new optional parameter connectivityType (public, private) for the
    CreateNatGateway API. Private NatGateway does not require customers to attach an InternetGateway to the VPC
    and can be used for communication with other VPCs and on-premise networks.
  * api-change:``ram``: AWS Resource Access Manager (RAM) is releasing new field isResourceTypeDefault in ListPermissions
    and GetPermission response, and adding permissionArn parameter to GetResourceShare request to filter by permission
    attached
  * api-change:``sagemaker-featurestore-runtime``: Release BatchGetRecord API for AWS SageMaker Feature Store Runtime.
  * api-change:``cognito-idp``: Amazon Cognito now supports targeted sign out through refresh token revocation
  * api-change:``appflow``: Adding MAP_ALL task type support.
  * api-change:``managedblockchain``: This release supports KMS customer-managed Customer Master Keys (CMKs) on
    member-specific Hyperledger Fabric resources.
- from version 1.20.91
  * api-change:``transfer``: Documentation updates for the AWS Transfer Family service.
  * api-change:``personalize-events``: Support for unstructured text inputs in the items dataset to to automatically
    extract key information from product/content description as an input when creating solution versions.
  * api-change:``proton``: This is the initial SDK release for AWS Proton
  * api-change:``kendra``: AWS Kendra now supports checking document status.
- from version 1.20.90
  * api-change:``fsx``: This release adds support for auditing end-user access to files, folders, and file shares
    using Windows event logs, enabling customers to meet their security and compliance needs.
  * api-change:``servicecatalog``: increase max pagesize for List/Search apis
  * api-change:``macie2``: This release of the Amazon Macie API introduces stricter validation of S3 object
    criteria for classification jobs.
  * api-change:``cognito-idp``: Documentation updates for cognito-idp
- from version 1.20.89
  * api-change:``sagemaker``: AWS SageMaker - Releasing new APIs related to Callback steps in model building pipelines.
    Adds experiment integration to model building pipelines.
  * api-change:``glue``: Add SampleSize variable to S3Target to enable s3-sampling feature through API.
  * api-change:``personalize``: Update regex validation in kmsKeyArn and s3 path API parameters for AWS Personalize APIs
  * api-change:``eks``: Added updateConfig option that allows customers to control upgrade velocity in Managed Node Group.
- from version 1.20.88
  * api-change:``rds``: Documentation updates for RDS: fixing an outdated link to the RDS documentation
    in DBInstance$DBInstanceStatus
  * api-change:``pi``: The new GetDimensionKeyDetails action retrieves the attributes of the specified dimension group
    for a DB instance or data source.
  * api-change:``cloudtrail``: AWS CloudTrail supports data events on new service resources, including Amazon DynamoDB
    tables and S3 Object Lambda access points.
  * api-change:``medialive``: Add support for automatically setting the H.264 adaptive quantization and GOP B-frame fields.
  * api-change:``autoscaling``: Documentation updates for Amazon EC2 Auto Scaling
  * api-change:``qldb``: Documentation updates for Amazon QLDB
- from version 1.20.87
  * api-change:``s3``: S3 Inventory now supports Bucket Key Status
  * api-change:``s3control``: Amazon S3 Batch Operations now supports S3 Bucket Keys.
  * api-change:``route53resolver``: Documentation updates for Route 53 Resolver
  * api-change:``ssm``: Documentation updates for ssm to fix customer reported issue
  * api-change:``forecast``: Added optional field AutoMLOverrideStrategy to CreatePredictor API that allows users to
    customize AutoML strategy. If provided in CreatePredictor request, this field is visible in DescribePredictor and
    GetAccuracyMetrics responses.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627387200">- Version update to 1.21.7 (bsc#1189649)
  * api-change:``s3control``: S3 Access Point aliases can be used anywhere you
    use S3 bucket names to access data in S3
  * api-change:``textract``: Adds support for AnalyzeExpense, a new API to extract
    relevant data such as contact information, items purchased, and vendor name,
    from almost any invoice or receipt without the need for any templates or
    configuration.
  * api-change:``proton``: Documentation-only update links
  * api-change:``identitystore``: Documentation updates for SSO API Ref.
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``synthetics``: CloudWatch Synthetics now supports visual
    testing in its canaries.
- from version 1.21.6
  * api-change:``securityhub``: Added product name, company name, and Region fields for
    security findings. Added details objects for RDS event subscriptions and AWS ECS
    services. Added fields to the details for AWS Elasticsearch domains.
  * api-change:``imagebuilder``: Update to documentation to reapply missing change to
    SSM uninstall switch default value and improve description.
  * api-change:``s3outposts``: Add on-premise access type support for endpoints
- from version 1.21.5
  * api-change:``medialive``: MediaLive now supports passing through style data
    on WebVTT caption outputs.
  * api-change:``databrew``: This SDK release adds two new features: 1) Output to
    Native JDBC destinations and 2) Adding configurations to profile jobs
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``s3control``: Documentation updates for Amazon S3-control
  * api-change:``ec2``: This release allows customers to assign prefixes to their
    elastic network interface and to reserve IP blocks in their subnet CIDRs. These
    reserved blocks can be used to assign prefixes to elastic network interfaces or
    be excluded from auto-assignment.
  * api-change:``qldb``: Amazon QLDB now supports ledgers encrypted with customer
    managed KMS keys. Changes in CreateLedger, UpdateLedger and DescribeLedger APIs
    to support the changes.
- from version 1.21.4
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for
    Amazon WorkDocs. For more information, see
    https://docs.aws.amazon.com/kendra/latest/dg/data-source-workdocs.html
  * api-change:``proton``: Documentation updates for AWS Proton
  * api-change:``iam``: Documentation updates for AWS Identity and Access Management (IAM).
  * api-change:``rds``: Adds the OriginalSnapshotCreateTime field to the DBSnapshot response
    object. This field timestamps the underlying data of a snapshot and doesn't change when
    the snapshot is copied.
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``lambda``: New ResourceConflictException error code for PutFunctionEventInvokeConfig,
    UpdateFunctionEventInvokeConfig, and DeleteFunctionEventInvokeConfig operations.
  * api-change:``codebuild``: AWS CodeBuild now allows you to set the access permissions for build
    artifacts, project artifacts, and log files that are uploaded to an Amazon S3 bucket that is
    owned by another account.
  * api-change:``personalize``: My AWS Service (placeholder) - Making minProvisionedTPS an optional
    parameter when creating a campaign. If not provided, it defaults to 1.
  * api-change:``emr``: Update emr client to latest version
- from version 1.21.3
  * api-change:``compute-optimizer``: Documentation updates for Compute Optimizer
  * api-change:``ec2``: Added idempotency to the CreateVolume API using the ClientToken
    request parameter
- from version 1.21.2
  * api-change:``imagebuilder``: Documentation updates for reversal of default value for additional
    instance configuration SSM switch, plus improved descriptions for semantic versioning.
  * api-change:``directconnect``: Documentation updates for directconnect
  * api-change:``health``: In the Health API, the maximum number of entities for the EventFilter and
    EntityFilter data types has changed from 100 to 99. This change is related to an internal
    optimization of the AWS Health service.
  * api-change:``robomaker``: This release allows customers to create a new version of WorldTemplates
    with support for Doors.
  * api-change:``location``: Add five new API operations: UpdateGeofenceCollection, UpdateMap,
    UpdatePlaceIndex, UpdateRouteCalculator, UpdateTracker.
  * api-change:``emr-containers``: Updated DescribeManagedEndpoint and ListManagedEndpoints to return
    failureReason and stateDetails in API response.
- from version 1.21.1
  * api-change:``appintegrations``: Documentation update for AppIntegrations Service
  * api-change:``chime``: This SDK release adds Account Status as one of the attributes in Account API response
  * api-change:``auditmanager``: This release relaxes the S3 URL character restrictions in AWS Audit Manager.
    Regex patterns have been updated for the following attributes: s3RelativePath, destination, and s3ResourcePath.
    'AWS' terms have also been replaced with entities to align with China Rebrand documentation efforts.
- from version 1.21.0
  * api-change:``ec2``: This feature enables customers  to specify weekly recurring time window(s) for scheduled
    events that reboot, stop or terminate EC2 instances.
  * api-change:``cognito-idp``: Documentation updates for cognito-idp
  * api-change:``ecs``: Documentation updates for support of awsvpc mode on Windows.
  * api-change:``lex-models``: Lex now supports the en-IN locale
  * api-change:``iotsitewise``: Update the default endpoint for the APIs used to manage asset models, assets, gateways,
    tags, and account configurations. If you have firewalls with strict egress rules, configure the rules to grant
    you access to api.iotsitewise.[region].amazonaws.com or api.iotsitewise.[cn-region].amazonaws.com.cn.
  * feature:Python: Dropped support for Python 2.7
- Disable Python2 builds for all SUSE distributions
- Remove Python2 build dependencies from spec file</changelog>
  <changelog author="rjschwei@suse.com" date="1629806400">- Disables Py 2 build for SLE 15
  + Py 2 is considered legacy with limited support. Should not have been
    built or released for Py 2. This was a mistake.</changelog>
  <changelog author="mvyskocil@opensuse.org" date="1630497600">- Version update to 1.21.33
  * api-change:iot: Added Create/Update/Delete/Describe/List APIs for a new
    IoT resource named FleetMetric. Added a new Fleet Indexing query API named
    GetBucketsAggregation. Added a new field named DisconnectedReason in Fleet
    Indexing query response. Updated their related documentations.
  * api-change:polly: Amazon Polly adds new South African English voice -
    Ayanda. Ayanda is available as Neural voice only.
  * api-change:compute-optimizer: Documentation updates for Compute Optimizer
  * api-change:sqs: Amazon SQS adds a new queue attribute, RedriveAllowPolicy,
    which includes the dead-letter queue redrive permission parameters. It defines
    which source queues can specify dead-letter queues as a JSON object.
  * api-change:memorydb: Documentation updates for MemoryDB
- from version 1.21.32
  * api-change:codebuild: Documentation updates for CodeBuild
  * api-change:firehose: This release adds the Dynamic Partitioning feature to
    Kinesis Data Firehose service for S3 destinations.
  * api-change:kms: This release has changes to KMS nomenclature to remove the
    word master from both the "Customer master key" and "CMK" abbreviation and
    replace those naming conventions with "KMS key".
  * api-change:cloudformation: AWS CloudFormation allows you to iteratively
    develop your applications when failures are encountered without rolling back
    successfully provisioned resources. By specifying stack failure options, you
    can troubleshoot resources in a CREATE_FAILED or UPDATE_FAILED status.
- from version 1.21.31
  * api-change:s3: Documentation updates for Amazon S3.
  * api-change:emr: Update emr client to latest version
  * api-change:ec2: This release adds the BootMode flag to the ImportImage API
    and showing the detected BootMode of an ImportImage task.
- from version 1.21.30
  * api-change:transcribe: This release adds support for batch transcription
    in six new languages - Afrikaans, Danish, Mandarin Chinese (Taiwan), New
    Zealand English, South African English, and Thai.
  * api-change:rekognition: This release added new attributes to Rekognition
    RecognizeCelebities and GetCelebrityInfo API operations.
  * api-change:ec2: Support added for resizing VPC prefix lists
  * api-change:compute-optimizer: Adds support for 1) the AWS Graviton
    (AWS_ARM64) recommendation preference for Amazon EC2 instance and Auto Scaling
    group recommendations, and 2) the ability to get the enrollment statuses for
    all member accounts of an organization.
- from version 1.21.29
  * api-change:fms: AWS Firewall Manager now supports triggering resource
    cleanup workflow when account or resource goes out of policy scope for AWS WAF,
    Security group, AWS Network Firewall, and Amazon Route 53 Resolver DNS Firewall
    policies.
  * api-change:ec2: Support added for IMDS IPv6 endpoint
  * api-change:datasync: Added include filters to CreateTask and UpdateTask,
    and added exclude filters to StartTaskExecution, giving customers more granular
    control over how DataSync transfers files, folders, and objects.  *
    api-change:events: AWS CWEvents adds an enum of EXTERNAL for EcsParameters
    LaunchType for PutTargets API
- from version 1.21.28
  * api-change:mediaconvert: AWS Elemental MediaConvert SDK has added MBAFF
    encoding support for AVC video and the ability to pass encryption context from
    the job settings to S3.
  * api-change:polly: Amazon Polly adds new New Zealand English voice - Aria.
    Aria is available as Neural voice only.  * api-change:transcribe: This release
    adds support for feature tagging with Amazon Transcribe batch jobs.
  * api-change:ssm: Updated Parameter Store property for logging improvements.
  * api-change:iot-data: Updated Publish with support for new Retain flag and
    added two new API operations: GetRetainedMessage, ListRetainedMessages.
- from version 1.21.27
  * api-change:dms: Amazon AWS DMS service now support Redis target endpoint
    migration. Now S3 endpoint setting is capable to setup features which are used
    to be configurable only in extract connection attributes.
  * api-change:frauddetector: Updated an element of the DescribeModelVersion
    API response (LogitMetrics -&gt; logOddsMetrics) for clarity. Added new exceptions
    to several APIs to protect against unlikely scenarios.
  * api-change:iotsitewise: Documentation updates for AWS IoT SiteWise
  * api-change:dlm: Added AMI deprecation support for Amazon Data Lifecycle
    Manager EBS-backed AMI policies.
  * api-change:glue: Add support for Custom Blueprints
  * api-change:apigateway: Adding some of the pending releases (1) Adding WAF
    Filter to GatewayResponseType enum (2) Ensuring consistent error model for all
    operations (3) Add missing BRE to GetVpcLink operation
  * api-change:backup: AWS Backup - Features: Evaluate your backup activity
    and generate audit reports.
- from version 1.21.26
  * api-change:eks: Adds support for EKS add-ons "preserve" flag, which allows
    customers to maintain software on their EKS clusters after removing it from EKS
    add-ons management.
  * api-change:comprehend: Add tagging support for Comprehend async inference job.
  * api-change:robomaker: Documentation updates for RoboMaker
  * api-change:ec2: encryptionInTransitSupported added to DescribeInstanceTypes API
- from version 1.21.25
  * api-change:ec2: The ImportImage API now supports the ability to create
    AMIs with AWS-managed licenses for Microsoft SQL Server for both Windows and
    Linux.
  * api-change:memorydb: AWS MemoryDB SDK now supports all APIs for newly launched MemoryDB service.
  * api-change:application-autoscaling: This release extends Application Auto
    Scaling support for replication group of Amazon ElastiCache Redis clusters.
    Auto Scaling monitors and automatically expands node group count and number of
    replicas per node group when a critical usage threshold is met or according to
    customer-defined schedule.
  * api-change:appflow: This release adds support for SAPOData connector and
    extends Veeva connector for document extraction.
- from version 1.21.24
  * api-change:codebuild: CodeBuild now allows you to make the build results
    for your build projects available to the public without requiring access to an
    AWS account.
  * api-change:route53: Documentation updates for route53
  * api-change:sagemaker-runtime: Update sagemaker-runtime client to latest version
  * api-change:route53resolver: Documentation updates for Route 53 Resolver
  * api-change:sagemaker: Amazon SageMaker now supports Asynchronous Inference
    endpoints. Adds PlatformIdentifier field that allows Notebook Instance creation
    with different platform selections. Increases the maximum number of containers
    in multi-container endpoints to 15. Adds more instance types to InstanceType
    field.
- from version 1.21.23
  * api-change:cloud9: Added DryRun parameter to CreateEnvironmentEC2 API.
    Added ManagedCredentialsActions parameter to UpdateEnvironment API
  * api-change:ec2: This release adds support for EC2 ED25519 key pairs for authentication
  * api-change:clouddirectory: Documentation updates for clouddirectory
  * api-change:ce: This release is a new feature for Cost Categories: Split
    charge rules. Split charge rules enable you to allocate shared costs between
    your cost category values.
  * api-change:logs: Documentation-only update for CloudWatch Logs
- from version 1.21.22
  * api-change:iotsitewise: AWS IoT SiteWise added query window for the
    interpolation interval. AWS IoT SiteWise computes each interpolated value by
    using data points from the timestamp of each interval minus the window to the
    timestamp of each interval plus the window.
  * api-change:s3: Documentation updates for Amazon S3
  * api-change:codebuild: CodeBuild now allows you to select how batch build
    statuses are sent to the source provider for a project.
  * api-change:ds: This release adds support for describing client authentication settings.
  * api-change:config: Update ResourceType enum with values for Backup Plan,
    Selection, Vault, RecoveryPoint; ECS Cluster, Service, TaskDefinition; EFS
    AccessPoint, FileSystem; EKS Cluster; ECR Repository resources
  * api-change:license-manager: AWS License Manager now allows end users to
    call CheckoutLicense API using new CheckoutType PERPETUAL. Perpetual checkouts
    allow sellers to check out a quantity of entitlements to be drawn down for
    consumption.
- from version 1.21.21
  * api-change:quicksight: Documentation updates for QuickSight.
  * api-change:emr: Update emr client to latest version
  * api-change:customer-profiles: This release introduces Standard Profile
    Objects, namely Asset and Case which contain values populated by data from
    third party systems and belong to a specific profile. This release adds an
    optional parameter, ObjectFilter to the ListProfileObjects API in order to
    search for these Standard Objects.
  * api-change:elasticache: This release adds ReplicationGroupCreateTime field
    to ReplicationGroup which indicates the UTC time when ElastiCache
    ReplicationGroup is created
- from version 1.21.20
  * api-change:sagemaker: Amazon SageMaker Autopilot adds new metrics for all
    candidate models generated by Autopilot experiments.
  * api-change:apigatewayv2: Adding support for ACM imported or private CA
    certificates for mTLS enabled domain names
  * api-change:apigateway: Adding support for ACM imported or private CA
    certificates for mTLS enabled domain names
  * api-change:databrew: This SDK release adds support for the output of a
    recipe job results to Tableau Hyper format.
  * api-change:lambda: Lambda Python 3.9 runtime launch
- from version 1.21.19
  * api-change:snow-device-management: AWS Snow Family customers can remotely
    monitor and operate their connected AWS Snowcone devices.
  * api-change:ecs: Documentation updates for ECS.
  * api-change:nimble: Add new attribute 'ownedBy' in Streaming Session APIs.
    'ownedBy' represents the AWS SSO Identity Store User ID of the owner of the
    Streaming Session resource.
  * api-change:codebuild: CodeBuild now allows you to make the build results
    for your build projects available to the public without requiring access to an
    AWS account.
  * api-change:ebs: Documentation updates for Amazon EBS direct APIs.
  * api-change:route53: Documentation updates for route53
- from version 1.21.18
  * api-change:chime: Add support for "auto" in Region field of StartMeetingTranscription API request.
  * enchancement:Client: Improve client performance by caching _alias_event_name on EventAliaser
- from version 1.21.17
  * api-change:wafv2: This release adds APIs to support versioning
    feature of AWS WAF Managed rule groups
  * api-change:rekognition: This release adds support for four new types of
    segments (opening credits, content segments, slates, and studio logos),
    improved accuracy for credits and shot detection and new filters to control
    black frame detection.
  * api-change:ssm: Documentation updates for AWS Systems Manager.
  - from version 1.21.16
  * api-change:synthetics: Documentation updates for Visual Monitoring feature
    and other doc ticket fixes.
  * api-change:chime-sdk-identity: The Amazon Chime SDK Identity APIs allow
    software developers to create and manage unique instances of their messaging
    applications.
  * api-change:chime-sdk-messaging: The Amazon Chime SDK Messaging APIs allow
    software developers to send and receive messages in custom messaging
    applications.
  * api-change:connect: This release adds support for agent status and hours
    of operation. For details, see the Release Notes in the Amazon Connect
    Administrator Guide.
  * api-change:lightsail: This release adds support to track when a bucket
    access key was last used.
  * api-change:athena: Documentation updates for Athena.
- from version 1.21.15
  * api-change:lexv2-models: Update lexv2-models client to latest version
  * api-change:autoscaling: EC2 Auto Scaling adds configuration checks and
    Launch Template validation to Instance Refresh.
- from version 1.21.14
  * api-change:rds: This release adds AutomaticRestartTime to the
    DescribeDBInstances and DescribeDBClusters operations. AutomaticRestartTime
    indicates the time when a stopped DB instance or DB cluster is restarted
    automatically.
  * api-change:imagebuilder: Updated list actions to include a list of valid
    filters that can be used in the request.
  * api-change:transcribe: This release adds support for call analytics
    (batch) within Amazon Transcribe.
  * api-change:events: Update events client to latest version
  * api-change:ssm-incidents: Documentation updates for Incident Manager.
- from version 1.21.13
  * api-change:redshift: API support for Redshift Data Sharing feature.
  * api-change:iotsitewise: My AWS Service (placeholder) - This release
    introduces custom Intervals and offset for tumbling window in metric for AWS
    IoT SiteWise.
  * api-change:glue: Add ConcurrentModificationException to create-table,
    delete-table, create-database, update-database, delete-database
  * api-change:mediaconvert: AWS Elemental MediaConvert SDK has added control
    over the passthrough of XDS captions metadata to outputs.
  * api-change:proton: Docs only add idempotent create apis
- from version 1.21.12
  * api-change:ssm-contacts: Added new attribute in AcceptCode API.
    AcceptCodeValidation takes in two values - ENFORCE, IGNORE. ENFORCE forces
    validation of accept code and IGNORE ignores it which is also the default
    behavior; Corrected TagKeyList length from 200 to 50
  * api-change:greengrassv2: This release adds support for component system
    resource limits and idempotent Create operations. You can now specify the
    maximum amount of CPU and memory resources that each component can use.
- from version 1.21.11
  * api-change:appsync: AWS AppSync now supports a new authorization mode
    allowing you to define your own authorization logic using an AWS Lambda
    function.
  * api-change:elbv2: Update elbv2 client to latest version
  * api-change:secretsmanager: Add support for KmsKeyIds in the
    ListSecretVersionIds API response
  * api-change:sagemaker: API changes with respect to Lambda steps in model
    building pipelines. Adds several waiters to async Sagemaker Image APIs. Add
    more instance types to AppInstanceType field
- from version 1.21.10
  * api-change:savingsplans: Documentation update for valid Savings Plans offering ID pattern
  * api-change:ec2: This release adds support for G4ad xlarge and 2xlarge
    instances powered by AMD Radeon Pro V520 GPUs and AMD 2nd Generation EPYC
    processors
  * api-change:chime: Adds support for live transcription of meetings with
    Amazon Transcribe and Amazon Transcribe Medical. The new APIs,
    StartMeetingTranscription and StopMeetingTranscription, control the generation
    of user-attributed transcriptions sent to meeting clients via Amazon Chime SDK
    data messages.
  * api-change:iotsitewise: Added support for AWS IoT SiteWise Edge. You can
    now create an AWS IoT SiteWise gateway that runs on AWS IoT Greengrass V2. With
    the gateway, you can collect local server and equipment data, process the data,
    and export the selected data from the edge to the AWS Cloud.
  * api-change:iot: Increase maximum credential duration of role alias to 12 hours.
- from version 1.21.9
  * api-change:sso-admin: Documentation updates for
    arn:aws:trebuchet:::service:v1:03a2216d-1cda-4696-9ece-1387cb6f6952
  * api-change:cloudformation: SDK update to support Importing existing Stacks
    to new/existing Self Managed StackSet - Stack Import feature.
- from version 1.21.8
  * api-change:route53: This release adds support for the RECOVERY_CONTROL
    health check type to be used in conjunction with Route53 Application Recovery
    Controller.
  * api-change:iotwireless: Add SidewalkManufacturingSn as an identifier to
    allow Customer to query WirelessDevice, in the response, AmazonId is added in
    the case that Sidewalk device is return.
  * api-change:route53-recovery-control-config: Amazon Route 53 Application
    Recovery Controller's routing control - Routing Control Configuration APIs help
    you create and delete clusters, control panels, routing controls and safety
    rules. State changes (On/Off) of routing controls are not part of configuration
    APIs.
  * api-change:route53-recovery-readiness: Amazon Route 53 Application
    Recovery Controller's readiness check capability continually monitors resource
    quotas, capacity, and network routing policies to ensure that the recovery
    environment is scaled and configured to take over when needed.
  * api-change:quicksight: Add support to use row-level security with tags
    when embedding dashboards for users not provisioned in QuickSight
  * api-change:iotanalytics: IoT Analytics now supports creating a dataset
    resource with IoT SiteWise MultiLayerStorage data stores, enabling customers to
    query industrial data within the service. This release includes adding JOIN
    functionality for customers to query multiple data sources in a dataset.
  * api-change:shield: Change name of DDoS Response Team (DRT) to Shield Response Team (SRT)
  * api-change:lexv2-models: Update lexv2-models client to latest version
  * api-change:redshift-data: Added structures to support new Data API
    operation BatchExecuteStatement, used to execute multiple SQL statements within
    a single transaction.
  * api-change:route53-recovery-cluster: Amazon Route 53 Application Recovery
    Controller's routing control - Routing Control Data Plane APIs help you update
    the state (On/Off) of the routing controls to reroute traffic across
    application replicas in a 100% available manner.
  * api-change:batch: Add support for ListJob filters</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1633435200">- Version update to 1.21.54
  * api-change:``codebuild``: CodeBuild now allows you to select how batch
    build statuses are sent to the source provider for a project.
  * api-change:``efs``: Update efs client to latest version
  * api-change:``kms``: Added SDK examples for ConnectCustomKeyStore, CreateCustomKeyStore,
    CreateKey, DeleteCustomKeyStore, DescribeCustomKeyStores, DisconnectCustomKeyStore,
    GenerateDataKeyPair, GenerateDataKeyPairWithoutPlaintext, GetPublicKey, ReplicateKey,
    Sign, UpdateCustomKeyStore and Verify APIs
- from version 1.21.53
  * api-change:``synthetics``: CloudWatch Synthetics now enables customers to choose a customer
    managed AWS KMS key or an Amazon S3-managed key instead of an AWS managed key (default)
    for the encryption of artifacts that the canary stores in Amazon S3. CloudWatch Synthetics
    also supports artifact S3 location updation now.
  * api-change:``ssm``: When "AutoApprovable" is true for a Change Template, then specifying
  - -auto-approve (boolean) in Start-Change-Request-Execution will create a change request
    that bypasses approver review. (except for change calendar restrictions)
  * api-change:``apprunner``: This release contains several minor bug fixes.
- from version 1.21.52
  * api-change:``network-firewall``: This release adds support for strict ordering for stateful
    rule groups. Using strict ordering, stateful rules are evaluated in the exact order in which
    you provide them.
  * api-change:``dataexchange``: This release enables subscribers to set up automatic exports of
    newly published revisions using the new EventAction API.
  * api-change:``workmail``: This release adds support for mobile device access overrides management
    in Amazon WorkMail.
  * api-change:``account``: This release of the Account Management API enables customers to manage
    the alternate contacts for their AWS accounts.
    For more information, see https://docs.aws.amazon.com/accounts/latest/reference/accounts-welcome.html
  * api-change:``workspaces``: Added CreateUpdatedWorkspaceImage API to update WorkSpace images with
    latest software and drivers. Updated DescribeWorkspaceImages API to display if there are updates
    available for WorkSpace images.
  * api-change:``cloudcontrol``: Initial release of the SDK for AWS Cloud Control API
  * api-change:``macie2``: Amazon S3 bucket metadata now indicates whether an error or a bucket's
    permissions settings prevented Amazon Macie from retrieving data about the bucket or the bucket's
    objects.
- from version 1.21.51
  * api-change:``lambda``: Adds support for Lambda functions powered by AWS Graviton2 processors.
    Customers can now select the CPU architecture for their functions.
  * api-change:``sesv2``: This release includes the ability to use 2048 bits RSA key pairs for DKIM
    in SES, either with Easy DKIM or Bring Your Own DKIM.
  * api-change:``amp``: This release adds alert manager and rule group namespace APIs
- from version 1.21.50
  * api-change:``transfer``: Added changes for managed workflows feature APIs.
  * api-change:``imagebuilder``: Fix description for AmiDistributionConfiguration Name property,
    which actually refers to the output AMI name. Also updated for consistent terminology to use
    "base" image, and another update to fix description text.
- from version 1.21.49
  * api-change:``appintegrations``: The Amazon AppIntegrations service enables you to configure
    and reuse connections to external applications.
  * api-change:``wisdom``: Released Amazon Connect Wisdom, a feature of Amazon Connect, which provides
    real-time recommendations and search functionality in general availability (GA).
    For more information, see https://docs.aws.amazon.com/wisdom/latest/APIReference/Welcome.html.
  * api-change:``pinpoint``: Added support for journey with contact center activity
  * api-change:``voice-id``: Released the Amazon Voice ID SDK, for usage with the Amazon Connect
    Voice ID feature released for Amazon Connect.
  * api-change:``connect``: This release updates a set of APIs: CreateIntegrationAssociation,
    ListIntegrationAssociations, CreateUseCase, and StartOutboundVoiceContact. You can use it to
    create integrations with Amazon Pinpoint for the Amazon Connect Campaigns use case, Amazon
    Connect Voice ID, and Amazon Connect Wisdom.
  * api-change:``elbv2``: Update elbv2 client to latest version
- from version 1.21.48
  * api-change:``license-manager``: AWS License Manager now allows customers to get the LicenseArn
    in the Checkout API Response.
  * api-change:``ec2``: DescribeInstances now returns Platform Details, Usage Operation, and Usage
    Operation Update Time.
- from version 1.21.47
  * api-change:``mediaconvert``: This release adds style and positioning support for caption or
    subtitle burn-in from rich text sources such as TTML. This release also introduces configurable
    image-based trick play track generation.
  * api-change:``appsync``: Documented the new OpenSearchServiceDataSourceConfig data type. Added
    deprecation notes to the ElasticsearchDataSourceConfig data type.
  * api-change:``ssm``: Added cutoff behavior support for preventing new task invocations from
    starting when the maintenance window cutoff time is reached.
- from version 1.21.46
  * api-change:``imagebuilder``: This feature adds support for specifying GP3 volume throughput and
    configuring instance metadata options for instances launched by EC2 Image Builder.
  * api-change:``wafv2``: Added the regex match rule statement, for matching web requests against
    a single regular expression.
  * api-change:``mediatailor``: This release adds support to configure logs for playback configuration.
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``iam``: Added changes to OIDC API about not using port numbers in the URL.
  * api-change:``license-manager``: AWS License Manager now allows customers to change their Windows
    Server or SQL license types from Bring-Your-Own-License (BYOL) to License Included or vice-versa
    (using the customer's media).
  * api-change:``mediapackage-vod``: MediaPackage VOD will now return the current processing statuses
    of an asset's endpoints. The status can be QUEUED, PROCESSING, PLAYABLE, or FAILED.
- from version 1.21.45
  * api-change:``comprehend``: Amazon Comprehend now supports versioning of custom models, improved
    training with ONE_DOC_PER_FILE text documents for custom entity recognition, ability to provide
    specific test sets during training, and live migration to new model endpoints.
  * api-change:``iot``: This release adds support for verifying, viewing and filtering AWS IoT Device
    Defender detect violations with four verification states.
  * api-change:``ecr``: This release adds additional support for repository replication
  * api-change:``ec2``: This update adds support for downloading configuration templates using new
    APIs (GetVpnConnectionDeviceTypes and GetVpnConnectionDeviceSampleConfiguration) and Internet
    Key Exchange version 2 (IKEv2) parameters for many popular CGW devices.
- from version 1.21.44
  * api-change:``opensearch``: This release adds an optional parameter in the ListDomainNames API to
    filter domains based on the engine type (OpenSearch/Elasticsearch).
  * api-change:``es``: This release adds an optional parameter in the ListDomainNames API to filter
    domains based on the engine type (OpenSearch/Elasticsearch).
  * api-change:``dms``: Optional flag force-planned-failover added to reboot-replication-instance
    API call. This flag can be used to test a planned failover scenario used during some maintenance
    operations.
- from version 1.21.43
  * api-change:``kafkaconnect``: This is the initial SDK release for Amazon Managed Streaming for
    Apache Kafka Connect (MSK Connect).
  * api-change:``macie2``: This release adds support for specifying which managed data identifiers
    are used by a classification job, and retrieving a list of managed data identifiers that are
    available.
  * api-change:``robomaker``: Adding support to create container based Robot and Simulation
    applications by introducing an environment field
  * api-change:``s3``: Add support for access point arn filtering in S3 CW Request Metrics
  * api-change:``transcribe``: This release adds support for subtitling with Amazon
    Transcribe batch jobs.
  * api-change:``sagemaker``: Add API for users to retry a failed pipeline execution
    or resume a stopped one.
  * api-change:``pinpoint``: This SDK release adds a new feature for Pinpoint campaigns,
    in-app messaging.
- from version 1.21.42
  * api-change:``sagemaker``: This release adds support for "Project Search"
  * api-change:``ec2``: This release adds support for vt1 3xlarge, 6xlarge and 24xlarge instances
    powered by Xilinx Alveo U30 Media Accelerators for video transcoding workloads
  * api-change:``wafv2``: This release adds support for including rate based rules in a rule group.
  * api-change:``chime``: Adds support for SipHeaders parameter for CreateSipMediaApplicationCall.
  * api-change:``comprehend``: Amazon Comprehend now allows you to train and run PDF and Word
    documents for custom entity recognition. With PDF and Word formats, you can extract information
    from documents containing headers, lists and tables.
- from version 1.21.41
  * api-change:``iot``: AWS IoT Rules Engine adds OpenSearch action. The OpenSearch rule action
    lets you stream data from IoT sensors and applications to Amazon OpenSearch Service which
    is a successor to Amazon Elasticsearch Service.
  * api-change:``ec2``: Adds support for T3 instances on Amazon EC2 Dedicated Hosts.
  * enhancement:Tagged Unions: Introducing support for the `union` trait on structures in request
    and response objects.
- from version 1.21.40
  * api-change:``cloudformation``: Doc only update for CloudFormation that fixes several
    customer-reported issues.
  * api-change:``rds``: This release adds support for providing a custom timeout value for
    finding a scaling point during autoscaling in Aurora Serverless v1.
  * api-change:``ecr``: This release updates terminology around KMS keys.
  * api-change:``sagemaker``: This release adds support for "Lifecycle Configurations" to
    SageMaker Studio
  * api-change:``transcribe``: This release adds an API option for startTranscriptionJob and
    startMedicalTranscriptionJob that allows the user to specify encryption context key value
    pairs for batch jobs.
  * api-change:``quicksight``: Add new data source type for Amazon OpenSearch
    (successor to Amazon ElasticSearch).
- from version 1.21.39
  * api-change:``emr``: Update emr client to latest version
  * api-change:``codeguru-reviewer``: The Amazon CodeGuru Reviewer API now includes the
    RuleMetadata data object and a Severity attribute on a RecommendationSummary object.
    A RuleMetadata object contains information about a rule that generates a recommendation.
    Severity indicates how severe the issue associated with a recommendation is.
  * api-change:``lookoutequipment``: Added OffCondition parameter to CreateModel API
- from version 1.21.38
  * api-change:``opensearch``: Updated Configuration APIs for Amazon OpenSearch Service
    (successor to Amazon Elasticsearch Service)
  * api-change:``ram``: A minor text-only update that fixes several customer issues.
  * api-change:``kafka``: Amazon MSK has added a new API that allows you to update the
    encrypting and authentication settings for an existing cluster.
- from version 1.21.37
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``amp``: This release adds tagging support for Amazon Managed Service
    for Prometheus workspace.
  * api-change:``forecast``: Predictor creation now supports selecting an accuracy metric
    to optimize in AutoML and hyperparameter optimization. This release adds additional
    accuracy metrics for predictors - AverageWeightedQuantileLoss, MAPE and MASE.
  * api-change:``xray``: Updated references to AWS KMS keys and customer managed
    keys to reflect current terminology.
  * api-change:``ssm-contacts``: Added SDK examples for SSM-Contacts.
  * api-change:``mediapackage``: SPEKE v2 support for live CMAF packaging type. SPEKE v2
    is an upgrade to the existing SPEKE API to support multiple encryption keys, it supports
    live DASH currently.
  * api-change:``eks``: Adding RegisterCluster and DeregisterCluster operations, to support
    connecting external clusters to EKS.
- from version 1.21.36
  * api-change:``chime-sdk-identity``: Documentation updates for Chime
  * api-change:``chime-sdk-messaging``: Documentation updates for Chime
  * api-change:``outposts``: This release adds a new API CreateOrder.
  * api-change:``frauddetector``: Enhanced GetEventPrediction API response to include
    risk scores from imported SageMaker models
  * api-change:``codeguru-reviewer``: Added support for CodeInconsistencies detectors
- from version 1.21.35
  * api-change:``acm-pca``: Private Certificate Authority Service now allows customers
    to enable an online certificate status protocol (OCSP) responder service on their
    private certificate authorities. Customers can also optionally configure a custom
    CNAME for their OCSP responder.
  * api-change:``s3control``: S3 Multi-Region Access Points provide a single global
    endpoint to access a data set that spans multiple S3 buckets in different AWS Regions.
  * api-change:``accessanalyzer``: Updates service API, documentation, and paginators to
    support multi-region access points from Amazon S3.
  * api-change:``schemas``: This update include the support for Schema Discoverer to
    discover the events sent to the bus from another account. The feature will be enabled
    by default when discoverer is created or updated but can also be opt-in or opt-out
    by specifying the value for crossAccount.
  * api-change:``securityhub``: New ASFF Resources: AwsAutoScalingLaunchConfiguration,
    AwsEc2VpnConnection, AwsEcrContainerImage. Added KeyRotationStatus to AwsKmsKey.
    Added AccessControlList, BucketLoggingConfiguration,BucketNotificationConfiguration
    and BucketNotificationConfiguration to AwsS3Bucket.
  * enhancement:s3: Added support for S3 Multi-Region Access Points
  * api-change:``efs``: Update efs client to latest version
  * api-change:``transfer``: AWS Transfer Family introduces Managed Workflows for creating,
    executing, monitoring, and standardizing post file transfer processing
  * api-change:``ebs``: Documentation updates for Amazon EBS direct APIs.
  * api-change:``quicksight``: This release adds support for referencing parent
    datasets as sources in a child dataset.
  * api-change:``fsx``: Announcing Amazon FSx for NetApp ONTAP, a new service that provides
    fully managed shared storage in the AWS Cloud with the data access and management
    capabilities of ONTAP.
  * enhancement:Signers: Added support for Sigv4a Signing Algorithm
  * api-change:``lex-models``: Lex now supports Korean (ko-KR) locale.
- from version 1.21.34
  * api-change:``ec2``: Added LaunchTemplate support for the IMDS IPv6 endpoint
  * api-change:``cloudtrail``: Documentation updates for CloudTrail
  * api-change:``mediatailor``: This release adds support for wall clock
    programs in LINEAR channels.
  * api-change:``config``: Documentation updates for config
  * api-change:``servicecatalog-appregistry``: Introduction of GetAssociatedResource
    API and GetApplication response extension for Resource Groups support.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635508800">- Version update to 1.22.6
  * api-change:``gamelift``: Added support for Arm-based AWS Graviton2 instances,
    such as M6g, C6g, and R6g.
  * api-change:``ecs``: Amazon ECS now supports running Fargate tasks on Windows
    Operating Systems Families which includes Windows Server 2019 Core and Windows
    Server 2019 Full.
  * api-change:``sagemaker``: This release adds support for RStudio on SageMaker.
  * api-change:``connectparticipant``: This release adds a new boolean attribute
  - Connect Participant - to the CreateParticipantConnection API, which can be
    used to mark the participant as connected.
  * api-change:``ec2``: Added new read-only DenyAllIGWTraffic network interface
    attribute. Added support for DL1 24xlarge instances powered by Habana Gaudi
    Accelerators for deep learning model training workloads
  * api-change:``ssm-incidents``: Updating documentation, adding new field to
    ConflictException to indicate earliest retry timestamp for some operations,
    increase maximum length of nextToken fields
- from version 1.22.5
  * api-change:``autoscaling``: This release adds support for attribute-based
    instance type selection, a new EC2 Auto Scaling feature that lets customers
    express their instance requirements as a set of attributes, such as vCPU,
    memory, and storage.
  * api-change:``ec2``: This release adds: attribute-based instance type selection
    for EC2 Fleet, Spot Fleet, a feature that lets customers express instance
    requirements as attributes like vCPU, memory, and storage; and Spot placement
    score, a feature that helps customers identify an optimal location to run
    Spot workloads.
  * api-change:``eks``: EKS managed node groups now support BOTTLEROCKET_x86_64
    and BOTTLEROCKET_ARM_64 AMI types.
  * api-change:``sagemaker``: This release allows customers to describe one or
    more versioned model packages through BatchDescribeModelPackage, update
    project via UpdateProject, modify and read customer metadata properties
    using Create, Update and Describe ModelPackage and enables cross account
    registration of model packages.
  * enhancement:Session: Added `get_partition_for_region` allowing partition
    lookup by region name.
  * api-change:``textract``: This release adds support for asynchronously analyzing
    invoice and receipt documents through two new APIs: StartExpenseAnalysis and
    GetExpenseAnalysis
- from version 1.22.4
  * api-change:``emr-containers``: This feature enables auto-generation of certificate
    to secure the managed-endpoint and removes the need for customer provided
    certificate-arn during managed-endpoint setup.
  * api-change:``chime-sdk-messaging``: The Amazon Chime SDK now supports push
    notifications through Amazon Pinpoint
  * api-change:``chime-sdk-identity``: The Amazon Chime SDK now supports push
    notifications through Amazon Pinpoint
- from version 1.22.3
  * api-change:``rds``: This release adds support for Amazon RDS Custom, which
    is a new RDS management type that gives you full access to your database
    and operating system.
    For more information, see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-custom.html
  * api-change:``auditmanager``: This release introduces a new feature for Audit
    Manager: Custom framework sharing. You can now share your custom frameworks
    with another AWS account, or replicate them into another AWS Region under
    your own account.
  * api-change:``ec2``: This release adds support to create a VPN Connection
    that is not attached to a Gateway at the time of creation. Use this to
    create VPNs associated with Core Networks, or modify your VPN and attach
    a gateway using the modify API after creation.
  * api-change:``route53resolver``: New API for ResolverConfig, which allows
    autodefined rules for reverse DNS resolution to be disabled for a VPC
- from version 1.22.2
  * api-change:``quicksight``: Added QSearchBar option for GenerateEmbedUrlForRegisteredUser
    ExperienceConfiguration to support Q search bar embedding
  * api-change:``auditmanager``: This release introduces character restrictions for
    ControlSet names. We updated regex patterns for the following attributes:
    ControlSet, CreateAssessmentFrameworkControlSet, and UpdateAssessmentFrameworkControlSet.
  * api-change:``chime``: Chime VoiceConnector and VoiceConnectorGroup APIs
    will now return an ARN.
- from version 1.22.1
  * api-change:``connect``: Released Amazon Connect hours of operation API for
    general availability (GA). This API also supports AWS CloudFormation. For
    more information, see Amazon Connect Resource Type Reference in the AWS
    CloudFormation User Guide.
- from version 1.22.0
  * api-change:``appflow``: Feature to add support for  JSON-L format
    for S3 as a source.
  * api-change:``mediapackage-vod``: MediaPackage passes through digital
    video broadcasting (DVB) subtitles into the output.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added
    support for specifying caption time delta in milliseconds and the ability
    to apply color range legalization to source content other than AVC video.
  * api-change:``mediapackage``: When enabled, MediaPackage passes through
    digital video broadcasting (DVB) subtitles into the output.
  * api-change:``panorama``: General availability for AWS Panorama. AWS SDK
    for Panorama includes APIs to manage your devices and nodes, and deploy
    computer vision applications to the edge. For more information, see the
    AWS Panorama documentation at http://docs.aws.amazon.com/panorama
  * feature:Serialization: rest-json serialization defaults aligned across AWS SDKs
  * api-change:``directconnect``: This release adds 4 new APIS, which needs to be public able
  * api-change:``securityhub``: Added support for cross-Region finding aggregation,
    which replicates findings from linked Regions to a single aggregation Region.
    Added operations to view, enable, update, and delete the finding aggregation.
- from version 1.21.65
  * api-change:``dataexchange``: This release adds support for our public preview
    of AWS Data Exchange for Amazon Redshift. This enables data providers to list
    products including AWS Data Exchange datashares for Amazon Redshift, giving
    subscribers read-only access to provider data in Amazon Redshift.
  * api-change:``chime-sdk-messaging``: The Amazon Chime SDK now allows developers
    to execute business logic on in-flight messages before they are delivered to
    members of a messaging channel with channel flows.
- from version 1.21.64
  * api-change:``quicksight``: AWS QuickSight Service  Features - Add IP Restriction
    UI and public APIs support.
  * enchancement:AWSCRT: Upgrade awscrt extra to 0.12.5
  * api-change:``ivs``: Bug fix: remove unsupported maxResults and nextToken
    pagination parameters from ListTagsForResource
- from version 1.21.63
  * api-change:``efs``: Update efs client to latest version
  * api-change:``glue``: Enable S3 event base crawler API.
- from version 1.21.62
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``autoscaling``: Amazon EC2 Auto Scaling now supports filtering
    describe Auto Scaling groups API using tags
  * api-change:``sagemaker``: This release updates the provisioning artifact ID
    to an optional parameter in CreateProject API. The provisioning artifact ID
    defaults to the latest provisioning artifact ID of the product if you don't
    provide one.
  * api-change:``robomaker``: Adding support to GPU simulation jobs as well
    as non-ROS simulation jobs.
- from version 1.21.61
  * api-change:``config``: Adding Config support for AWS::OpenSearch::Domain
  * api-change:``ec2``: This release adds support for additional VPC Flow Logs
    delivery options to S3, such as Apache Parquet formatted files, Hourly
    partitions and Hive-compatible S3 prefixes
  * api-change:``storagegateway``: Adding support for Audit Logs on NFS shares
    and Force Closing Files on SMB shares.
  * api-change:``workmail``: This release adds APIs for adding, removing and
    retrieving details of mail domains
  * api-change:``kinesisanalyticsv2``: Support for Apache Flink 1.13 in Kinesis
    Data Analytics. Changed the required status of some Update properties to better
    fit the corresponding Create properties.
- from version 1.21.60
  * api-change:``cloudsearch``: Adds an additional validation exception for
    Amazon CloudSearch configuration APIs for better error handling.
  * api-change:``ecs``: Documentation only update to address tickets.
  * api-change:``mediatailor``: MediaTailor now supports ad prefetching.
  * api-change:``ec2``: EncryptionSupport for InstanceStorageInfo added
    to DescribeInstanceTypes API
- from version 1.21.59
  * api-change:``elbv2``: Update elbv2 client to latest version
  * bugfix:Signing: SigV4QueryAuth and CrtSigV4QueryAuth now properly respect
    AWSRequest.params while signing boto/botocore (#2521)
  * api-change:``medialive``: This release adds support for Transport Stream
    files as an input type to MediaLive encoders.
  * api-change:``ec2``: Documentation update for Amazon EC2.
  * api-change:``frauddetector``: New model type: Transaction Fraud Insights,
    which is optimized for online transaction fraud. Stored Events, which allows
    customers to send and store data directly within Amazon Fraud Detector.
    Batch Import, which allows customers to upload a CSV file of historic
    event data for processing and storage
- from version 1.21.58
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager
  * api-change:``securityhub``: Added new resource details objects to ASFF,
    including resources for WAF rate-based rules, EC2 VPC endpoints, ECR
    repositories, EKS clusters, X-Ray encryption, and OpenSearch domains.
    Added additional details for CloudFront distributions, CodeBuild projects,
    ELB V2 load balancers, and S3 buckets.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert has added the ability
    to set account policies which control access restrictions for HTTP, HTTPS,
    and S3 content sources.
  * api-change:``ec2``: This release removes a requirement for filters on
    SearchLocalGatewayRoutes operations.
- from version 1.21.57
  * api-change:``kendra``: Amazon Kendra now supports indexing and querying
    documents in different languages.
  * api-change:``grafana``: Initial release of the SDK for Amazon Managed Grafana API.
  * api-change:``firehose``: Allow support for Amazon Opensearch Service(successor
    to Amazon Elasticsearch Service) as a Kinesis Data Firehose delivery destination.
  * api-change:``backup``: Launch of AWS Backup Vault Lock, which protects your
    backups from malicious and accidental actions, works with existing backup policies,
    and helps you meet compliance requirements.
  * api-change:``schemas``: Removing unused request/response objects.
  * api-change:``chime``: This release enables customers to configure Chime
    MediaCapturePipeline via API.
- from version 1.21.56
  * api-change:``sagemaker``: This release adds a new TrainingInputMode FastFile
    for SageMaker Training APIs.
  * api-change:``amplifybackend``: Adding a new field 'AmplifyFeatureFlags' to the
    response of the GetBackend operation. It will return a stringified version of
    the cli.json file for the given Amplify project.
  * api-change:``fsx``: This release adds support for Lustre 2.12 to FSx for Lustre.
  * api-change:``kendra``: Amazon Kendra now supports integration with AWS SSO
- from version 1.21.55
  * api-change:``workmail``: This release allows customers to change their inbound
    DMARC settings in Amazon WorkMail.
  * api-change:``location``: Add support for PositionFiltering.
  * api-change:``application-autoscaling``: With this release, Application Auto
    Scaling adds support for Amazon Neptune. Customers can now automatically add
    or remove Read Replicas of their Neptune clusters to keep the average CPU
    Utilization at the target value specified by the customers.
  * api-change:``ec2``: Released Capacity Reservation Fleet, a feature of Amazon
    EC2 Capacity Reservations, which provides a way to manage reserved capacity
    across instance types.
    For more information: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cr-fleets.html
  * api-change:``glue``: This release adds tag as an input of CreateConnection
  * api-change:``backup``: AWS Backup Audit Manager framework report.
- Remove unnecessary dependencies from BuildRequires
- Skip integration tests as these require an internet connection
- Switch package to multibuild and split tests into separate package
- Switch tests from nose to pytest</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1639656000">- Version update to 1.23.24
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager
- from version 1.23.23
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``network-firewall``: This release adds support for managed rule groups.
  * api-change:``route53-recovery-control-config``: This release adds tagging supports to Route53
    Recovery Control Configuration. New APIs: TagResource, UntagResource and ListTagsForResource.
    Updates: add optional field `tags` to support tagging while calling CreateCluster,
    CreateControlPanel and CreateSafetyRule.
  * api-change:``ec2``: Adds waiters support for internet gateways.
  * api-change:``sms``: This release adds SMS discontinuation information to the API and CLI
    references.
  * api-change:``route53domains``: Amazon Route 53 domain registration APIs now support filtering and
    sorting in the ListDomains API, deleting a domain by using the DeleteDomain API and getting domain
    pricing information by using the ListPrices API.
  * api-change:``savingsplans``: Adds the ability to specify Savings Plans hourly commitments using
    five digits after the decimal point.
- from version 1.23.22
  * api-change:``lookoutvision``: This release adds new APIs for packaging an Amazon Lookout for
    Vision model as an AWS IoT Greengrass component.
  * api-change:``sagemaker``: This release added a new Ambarella device(amba_cv2) compilation support
    for Sagemaker Neo.
  * api-change:``comprehendmedical``: This release adds a new set of APIs (synchronous and batch) to
    support the SNOMED-CT ontology.
  * api-change:``health``: Documentation updates for AWS Health
  * api-change:``logs``: This release adds AWS Organizations support as condition key in destination
    policy for cross account Subscriptions in CloudWatch Logs.
  * api-change:``outposts``: This release adds the UpdateOutpost API.
  * api-change:``support``: Documentation updates for AWS Support.
  * api-change:``iot``: This release allows customer to enable caching of custom authorizer on HTTP
    protocol for clients that use persistent or Keep-Alive connection in order to reduce the number of
    Lambda invocations.
- from version 1.23.21
  * api-change:``location``: This release adds support for Accuracy position filtering, position
    metadata and autocomplete for addresses and points of interest based on partial or misspelled
    free-form text.
  * api-change:``appsync``: AWS AppSync now supports custom domain names, allowing you to associate a
    domain name that you own with an AppSync API in your account.
  * api-change:``route53``: Add PriorRequestNotComplete exception to UpdateHostedZoneComment API
- from version 1.23.20
  * api-change:``rekognition``: This release added new KnownGender types for Celebrity Recognition.
- from version 1.23.19
  * api-change:``ram``: This release adds the ability to use the new ResourceRegionScope parameter on
    List operations that return lists of resources or resource types. This new parameter filters the
    results by letting you differentiate between global or regional resource types.
  * api-change:``networkmanager``: This release adds API support for AWS Cloud WAN.
  * api-change:``amplifyuibuilder``: This release introduces the actions and data types for the new
    Amplify UI Builder API. The Amplify UI Builder API provides a programmatic interface for creating
    and configuring user interface (UI) component libraries and themes for use in Amplify applications.
- from version 1.23.18
  * api-change:``sagemaker``: This release enables - 1/ Inference endpoint configuration
    recommendations and ability to run custom load tests to meet performance needs. 2/ Deploy
    serverless inference endpoints. 3/ Query, filter and retrieve end-to-end ML lineage graph, and
    incorporate model quality/bias detection in ML workflow.
  * api-change:``kendra``: Experience Builder allows customers to build search applications without
    writing code. Analytics Dashboard provides quality and usability metrics for Kendra indexes. Custom
    Document Enrichment allows customers to build a custom ingestion pipeline to pre-process documents
    and generate metadata.
  * api-change:``directconnect``: Adds SiteLink support to private and transit virtual interfaces.
    SiteLink is a new Direct Connect feature that allows routing between Direct Connect points of
    presence.
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``ec2``: This release adds support for Amazon VPC IP Address Manager (IPAM), which
    enables you to plan, track, and monitor IP addresses for your workloads. This release also adds
    support for VPC Network Access Analyzer, which enables you to analyze network access to resources
    in your Virtual Private Clouds.
  * api-change:``shield``: This release adds API support for Automatic Application Layer DDoS
    Mitigation for AWS Shield Advanced. Customers can now enable automatic DDoS mitigation in count or
    block mode for layer 7 protected resources.
  * api-change:``sagemaker-runtime``: Update sagemaker-runtime client to latest version
  * api-change:``devops-guru``: DevOps Guru now provides detailed, database-specific analyses of
    performance issues and recommends corrective actions for Amazon Aurora database instances with
    Performance Insights turned on. You can also use AWS tags to choose which resources to analyze and
    define your applications.
  * api-change:``dynamodb``: Add support for Table Classes and introduce the Standard Infrequent
    Access table class.
- from version 1.23.17
  * api-change:``s3``: Introduce Amazon S3 Glacier Instant Retrieval storage class and a new setting
    in S3 Object Ownership to disable ACLs for bucket and the objects in it.
  * api-change:``backup-gateway``: Initial release of AWS Backup gateway which enables you to
    centralize and automate protection of on-premises VMware and VMware Cloud on AWS workloads using
    AWS Backup.
  * api-change:``iot``: Added the ability to enable/disable IoT Fleet Indexing for Device Defender
    and Named Shadow information, and search them through IoT Fleet Indexing APIs.
  * api-change:``ec2``: This release adds support for Is4gen and Im4gn instances. This release also
    adds a new subnet attribute, enableLniAtDeviceIndex, to support local network interfaces, which are
    logical networking components that connect an EC2 instance to your on-premises network.
  * api-change:``outposts``: This release adds the SupportedHardwareType parameter to CreateOutpost.
  * api-change:``storagegateway``: Added gateway type VTL_SNOW. Added new SNOWBALL HostEnvironment
    for gateways running on a Snowball device. Added new field HostEnvironmentId to serve as an
    identifier for the HostEnvironment on which the gateway is running.
  * api-change:``kinesis``: Amazon Kinesis Data Streams now supports on demand streams.
  * api-change:``glue``: Support for DataLake transactions
  * api-change:``accessanalyzer``: AWS IAM Access Analyzer now supports policy validation for
    resource policies attached to S3 buckets and access points. You can run additional policy checks by
    specifying the S3 resource type you want to attach to your resource policy.
  * api-change:``lakeformation``: This release adds support for row and cell-based access control in
    Lake Formation. It also adds support for Lake Formation Governed Tables, which support ACID
    transactions and automatic storage optimizations.
  * api-change:``kafka``: This release adds three new V2 APIs. CreateClusterV2 for creating both
    provisioned and serverless clusters. DescribeClusterV2 for getting information about provisioned
    and serverless clusters and ListClustersV2 for listing all clusters (both provisioned and
    serverless) in your account.
  * api-change:``redshift-data``: Data API now supports serverless queries.
  * api-change:``snowball``: Tapeball is to integrate tape gateway onto snowball, it enables customer
    to transfer local data on the tape to snowball,and then ingest the data into tape gateway on the
    cloud.
  * api-change:``workspaces-web``: This is the initial SDK release for Amazon WorkSpaces Web. Amazon
    WorkSpaces Web is a low-cost, fully managed WorkSpace built to deliver secure web-based workloads
    and software-as-a-service (SaaS) application access to users within existing web browsers.
  * api-change:``iottwinmaker``: AWS IoT TwinMaker makes it faster and easier to create, visualize
    and monitor digital twins of real-world systems like buildings, factories and industrial equipment
    to optimize operations. Learn more:
    https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/Welcome.html (New Service) (Preview)
  * api-change:``fsx``: This release adds support for the FSx for OpenZFS file system type, FSx for
    Lustre file systems with the Persistent_2 deployment type, and FSx for Lustre file systems with
    Amazon S3 data repository associations and automatic export policies.
- from version 1.23.16
  * api-change:``s3``: Amazon S3 Event Notifications adds Amazon EventBridge as a destination and
    supports additional event types. The PutBucketNotificationConfiguration API can now skip validation
    of Amazon SQS, Amazon SNS and AWS Lambda destinations.
  * api-change:``wellarchitected``: This update provides support for Well-Architected API users to
    use custom lens features.
  * api-change:``rum``: This is the first public release of CloudWatch RUM
  * api-change:``rbin``: This release adds support for Recycle Bin.
  * api-change:``iotsitewise``: AWS IoT SiteWise now supports retention configuration for the hot
    tier storage.
  * api-change:``compute-optimizer``: Adds support for the enhanced infrastructure metrics paid
    feature. Also adds support for two new sets of resource efficiency metrics, including savings
    opportunity metrics and performance improvement opportunity metrics.
  * api-change:``ecr``: This release adds supports for pull through cache rules and enhanced scanning.
  * api-change:``evidently``: Introducing Amazon CloudWatch Evidently. This is the first public
    release of Amazon CloudWatch Evidently.
  * api-change:``inspector2``: This release adds support for the new Amazon Inspector API. The new
    Amazon Inspector can automatically discover and scan Amazon EC2 instances and Amazon ECR container
    images for software vulnerabilities and unintended network exposure, and report centralized
    findings across multiple AWS accounts.
  * api-change:``ssm``: Added two new attributes to DescribeInstanceInformation called SourceId and
    SourceType along with new string filters SourceIds and SourceTypes to filter instance records.
  * api-change:``ec2``: This release adds support for G5g and M6a instances. This release also adds
    support for Amazon EBS Snapshots Archive, a feature that enables you to archive your EBS snapshots;
    and Recycle Bin, a feature that enables you to protect your EBS snapshots against accidental
    deletion.
  * api-change:``dataexchange``: This release enables providers and subscribers to use Data Set, Job,
    and Asset operations to work with API assets from Amazon API Gateway. In addition, this release
    enables subscribers to use the SendApiAsset operation to invoke a provider's Amazon API Gateway API
    that they are entitled to.
- from version 1.23.15
  * api-change:``migration-hub-refactor-spaces``: This is the initial SDK release for AWS Migration
    Hub Refactor Spaces
  * api-change:``textract``: This release adds support for synchronously analyzing identity documents
    through a new API: AnalyzeID
  * api-change:``personalize-runtime``: This release adds inference support for Recommenders.
  * api-change:``personalize``: This release adds API support for Recommenders and BatchSegmentJobs.
- from version 1.23.14
  * api-change:``autoscaling``: Documentation updates for Amazon EC2 Auto Scaling.
  * api-change:``mgn``: Application Migration Service now supports an additional replication method
    that does not require agent installation on each source server. This option is available for source
    servers running on VMware vCenter versions 6.7 and 7.0.
  * api-change:``ec2``: Documentation updates for EC2.
  * api-change:``iotdeviceadvisor``: Documentation update for Device Advisor GetEndpoint API
  * api-change:``pinpoint``: Added a One-Time Password (OTP) management feature. You can use the
    Amazon Pinpoint API to generate OTP codes and send them to your users as SMS messages. Your apps
    can then call the API to verify the OTP codes that your users input
  * api-change:``outposts``: This release adds new APIs for working with Outpost sites and orders.
- from version 1.23.13
  * api-change:``timestream-query``: Releasing Amazon Timestream Scheduled Queries. It makes
    real-time analytics more performant and cost-effective for customers by calculating and storing
    frequently accessed aggregates, and other computations, typically used in operational dashboards,
    business reports, and other analytics applications
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``proton``: This release adds APIs for getting the outputs and provisioned stacks for
    Environments, Pipelines, and ServiceInstances.  You can now add tags to
    EnvironmentAccountConnections.  It also adds APIs for working with PR-based provisioning.  Also, it
    adds APIs for syncing templates with a git repository.
  * api-change:``translate``: This release enables customers to use translation settings to mask
    profane words and phrases in their translation output.
  * api-change:``lambda``: Remove Lambda function url apis
  * api-change:``imagebuilder``: This release adds support for sharing AMIs with Organizations within
    an EC2 Image Builder Distribution Configuration.
  * api-change:``customer-profiles``: This release introduces a new auto-merging feature for profile
    matching. The auto-merging configurations can be set via CreateDomain API or UpdateDomain API. You
    can use GetIdentityResolutionJob API and ListIdentityResolutionJobs API to fetch job status.
  * api-change:``autoscaling``: Customers can now configure predictive scaling policies to
    proactively scale EC2 Auto Scaling groups based on any CloudWatch metrics that more accurately
    represent the load on the group than the four predefined metrics. They can also use math
    expressions to further customize the metrics.
  * api-change:``timestream-write``: This release adds support for multi-measure records and magnetic
    store writes. Multi-measure records allow customers to store multiple measures in a single table
    row. Magnetic store writes enable customers to write late arrival data (data with timestamp in the
    past) directly into the magnetic store.
  * api-change:``iotsitewise``: AWS IoT SiteWise now accepts data streams that aren't associated with
    any asset properties. You can organize data by updating data stream associations.
- from version 1.23.12
  * api-change:``redshift``: This release adds support for reserved node exchange with restore/resize
  * api-change:``elasticache``: Adding support for r6gd instances for Redis with data tiering. In a
    cluster with data tiering enabled, when available memory capacity is exhausted, the least recently
    used data is automatically tiered to solid state drives for cost-effective capacity scaling with
    minimal performance impact.
  * api-change:``opensearch``: This release adds an optional parameter dry-run for the
    UpdateDomainConfig API to perform basic validation checks, and detect the deployment type that will
    be required for the configuration change, without actually applying the change.
  * api-change:``backup``: This release adds new opt-in settings for advanced features for DynamoDB
    backups
  * api-change:``iot``: This release introduces a new feature, Managed Job Template, for AWS IoT Jobs
    Service. Customers can now use service provided managed job templates to easily create jobs for
    supported standard job actions.
  * api-change:``iotwireless``: Two new APIs, GetNetworkAnalyzerConfiguration and
    UpdateNetworkAnalyzerConfiguration, are added for the newly released Network Analyzer feature which
    enables customers to view real-time frame information and logs from LoRaWAN devices and gateways.
  * api-change:``workspaces``: Documentation updates for Amazon WorkSpaces
  * api-change:``s3``: Introduce two new Filters to S3 Lifecycle configurations -
    ObjectSizeGreaterThan and ObjectSizeLessThan. Introduce a new way to trigger actions on noncurrent
    versions by providing the number of newer noncurrent versions along with noncurrent days.
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``macie2``: Documentation updates for Amazon Macie
  * api-change:``ec2``: This release adds a new parameter ipv6Native to the allow creation of
    IPv6-only subnets using the CreateSubnet operation, and the operation ModifySubnetAttribute
    includes new parameters to modify subnet attributes to use resource-based naming and enable DNS
    resolutions for Private DNS name.
  * api-change:``sqs``: Amazon SQS adds a new queue attribute, SqsManagedSseEnabled, which enables
    server-side queue encryption using SQS owned encryption keys.
  * api-change:``ecs``: Documentation update for ARM support on Amazon ECS.
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``finspace-data``: Update documentation for createChangeset API.
  * api-change:``dynamodb``: DynamoDB PartiQL now supports ReturnConsumedCapacity, which returns
    capacity units consumed by PartiQL APIs if the request specified returnConsumedCapacity parameter.
    PartiQL APIs include ExecuteStatement, BatchExecuteStatement, and ExecuteTransaction.
  * api-change:``lambda``: Release Lambda event source filtering for SQS, Kinesis Streams, and
    DynamoDB Streams.
  * api-change:``iotdeviceadvisor``: This release introduces a new feature for Device Advisor:
    ability to execute multiple test suites in parallel for given customer account. You can use
    GetEndpoint API to get the device-level test endpoint and call StartSuiteRun with
    "parallelRun=true" to run suites in parallel.
  * api-change:``rds``: Adds support for Multi-AZ DB clusters for RDS for MySQL and RDS for
    PostgreSQL.
- from version 1.23.11
  * api-change:``connect``: This release adds support for UpdateContactFlowMetadata,
    DeleteContactFlow and module APIs. For details, see the Release Notes in the Amazon Connect
    Administrator Guide.
  * api-change:``dms``: Added new S3 endpoint settings to allow to convert the current UTC time into
    a specified time zone when a date partition folder is created. Using with 'DatePartitionedEnabled'.
  * api-change:``es``: This release adds an optional parameter dry-run for the
    UpdateElasticsearchDomainConfig API to perform basic validation checks, and detect the deployment
    type that will be required for the configuration change, without actually applying the change.
  * api-change:``ssm``: Adds new parameter to CreateActivation API . This parameter is for "internal
    use only".
  * api-change:``chime-sdk-meetings``: Added new APIs for enabling Echo Reduction with Voice Focus.
  * api-change:``eks``: Adding missing exceptions to RegisterCluster operation
  * api-change:``quicksight``: Add support for Exasol data source, 1 click enterprise embedding and
    email customization.
  * api-change:``cloudformation``: This release include SDK changes for the feature launch of Stack
    Import to Service Managed StackSet.
  * api-change:``rds``: Adds local backup support to Amazon RDS on AWS Outposts.
  * api-change:``braket``: This release adds support for Amazon Braket Hybrid Jobs.
  * api-change:``s3control``: Added Amazon CloudWatch publishing option for S3 Storage Lens metrics.
  * api-change:``finspace-data``: Add new APIs for managing Datasets, Changesets, and Dataviews.
- from version 1.23.10
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``cloudformation``: The StackSets ManagedExecution feature will allow concurrency for
    non-conflicting StackSet operations and queuing the StackSet operations that conflict at a given
    time for later execution.
  * api-change:``redshift``: Added support of default IAM role for CreateCluster,
    RestoreFromClusterSnapshot and ModifyClusterIamRoles APIs
  * api-change:``lambda``: Add support for Lambda Function URLs. Customers can use Function URLs to
    create built-in HTTPS endpoints on their functions.
  * api-change:``appstream``: Includes APIs for managing resources for Elastic fleets: applications,
    app blocks, and application-fleet associations.
  * api-change:``medialive``: This release adds support for specifying a SCTE-35 PID on input.
    MediaLive now supports SCTE-35 PID selection on inputs containing one or more active SCTE-35 PIDs.
  * api-change:``batch``: Documentation updates for AWS Batch.
  * api-change:``application-insights``: Application Insights now supports monitoring for HANA
- from version 1.23.9
  * api-change:``ivs``: Add APIs for retrieving stream session information and support for filtering
    live streams by health.  For more information, see
    https://docs.aws.amazon.com/ivs/latest/userguide/stream-health.html
  * api-change:``lambda``: Added support for CLIENT_CERTIFICATE_TLS_AUTH and
    SERVER_ROOT_CA_CERTIFICATE as SourceAccessType for MSK and Kafka event source mappings.
  * api-change:``chime``: Adds new Transcribe API parameters to StartMeetingTranscription, including
    support for content identification and redaction (PII &amp; PHI), partial results stabilization, and
    custom language models.
  * api-change:``chime-sdk-meetings``: Adds new Transcribe API parameters to
    StartMeetingTranscription, including support for content identification and redaction (PII &amp; PHI),
    partial results stabilization, and custom language models.
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``auditmanager``: This release introduces a new feature for Audit Manager: Dashboard
    views. You can now view insights data for your active assessments, and quickly identify
    non-compliant evidence that needs to be remediated.
  * api-change:``databrew``: This SDK release adds the following new features: 1) PII detection in
    profile jobs, 2) Data quality rules, enabling validation of data quality in profile jobs, 3) SQL
    query-based datasets for Amazon Redshift and Snowflake data sources, and 4) Connecting DataBrew
    datasets with Amazon AppFlow flows.
  * api-change:``redshift-data``: Rolling back Data API serverless features until dependencies are
    live.
  * api-change:``kafka``: Amazon MSK has added a new API that allows you to update the connectivity
    settings for an existing cluster to enable public accessibility.
  * api-change:``forecast``: NEW CreateExplanability API that helps you understand how attributes
    such as price, promotion, etc. contributes to your forecasted values; NEW CreateAutoPredictor API
    that trains up to 40% more accurate forecasting model, saves up to 50% of retraining time, and
    provides model level explainability.
  * api-change:``appconfig``: Add Type to support feature flag configuration profiles
- from version 1.23.8
  * api-change:``appconfigdata``: AWS AppConfig Data is a new service that allows you to retrieve
    configuration deployed by AWS AppConfig. See the AppConfig user guide for more details on getting
    started. https://docs.aws.amazon.com/appconfig/latest/userguide/what-is-appconfig.html
  * api-change:``drs``: Introducing AWS Elastic Disaster Recovery (AWS DRS), a new service that
    minimizes downtime and data loss with fast, reliable recovery of on-premises and cloud-based
    applications using affordable storage, minimal compute, and point-in-time recovery.
  * api-change:``apigateway``: Documentation updates for Amazon API Gateway.
  * api-change:``sns``: Amazon SNS introduces the PublishBatch API, which enables customers to
    publish up to 10 messages per API request. The new API is valid for Standard and FIFO topics.
  * api-change:``redshift-data``: Data API now supports serverless requests.
  * api-change:``amplifybackend``: New APIs to support the Amplify Storage category. Add and manage
    file storage in your Amplify app backend.
- from version 1.23.7
  * api-change:``location``: This release adds the support for Relevance, Distance, Time Zone,
    Language and Interpolated Address for Geocoding and Reverse Geocoding.
  * api-change:``cloudtrail``: CloudTrail Insights now supports ApiErrorRateInsight, which enables
    customers to identify unusual activity in their AWS account based on API error codes and their rate.
- from version 1.23.6
  * api-change:``migrationhubstrategy``: AWS SDK for Migration Hub Strategy Recommendations. It
    includes APIs to start the portfolio assessment, import portfolio data for assessment, and to
    retrieve recommendations. For more information, see the AWS Migration Hub documentation at
    https://docs.aws.amazon.com/migrationhub/index.html
  * api-change:``ec2``: Adds a new VPC Subnet attribute "EnableDns64." When enabled on IPv6 Subnets,
    the Amazon-Provided DNS Resolver returns synthetic IPv6 addresses for IPv4-only destinations.
  * api-change:``wafv2``: Your options for logging web ACL traffic now include Amazon CloudWatch Logs
    log groups and Amazon S3 buckets.
  * api-change:``dms``: Add Settings in JSON format for the source GCP MySQL endpoint
  * api-change:``ssm``: Adds support for Session Reason and Max Session Duration for Systems Manager
    Session Manager.
  * api-change:``appstream``: This release includes support for images of AmazonLinux2 platform type.
  * api-change:``eks``: Adding Tags support to Cluster Registrations.
  * api-change:``transfer``: AWS Transfer Family now supports integrating a custom identity provider
    using AWS Lambda
- from version 1.23.5
  * api-change:``ec2``: C6i instances are powered by a third-generation Intel Xeon Scalable processor
    (Ice Lake) delivering all-core turbo frequency of 3.5 GHz. G5 instances feature up to 8 NVIDIA A10G
    Tensor Core GPUs and second generation AMD EPYC processors.
  * api-change:``ssm``: This Patch Manager release supports creating Patch Baselines for RaspberryPi
    OS (formerly Raspbian)
  * api-change:``devops-guru``: Add support for cross account APIs.
  * api-change:``connect``: This release adds APIs for creating and managing scheduled tasks.
    Additionally, adds APIs to describe and update a contact and list associated references.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added automatic modes for GOP
    configuration and added the ability to ingest screen recordings generated by Safari on MacOS 12
    Monterey.
- from version 1.23.4
  * api-change:``dynamodb``: Updated Help section for "dynamodb update-contributor-insights" API
  * api-change:``ec2``: This release provides an additional route target for the VPC route table.
  * api-change:``translate``: This release enables customers to import Multi-Directional Custom
    Terminology and use Multi-Directional Custom Terminology in both real-time translation and
    asynchronous batch translation.
- from version 1.23.3
  * api-change:``backup``: AWS Backup SDK provides new options when scheduling backups: select
    supported services and resources that are assigned to a particular tag, linked to a combination of
    tags, or can be identified by a partial tag value, and exclude resources from their assignments.
  * api-change:``ecs``: This release adds support for container instance health.
  * api-change:``resiliencehub``: Initial release of AWS Resilience Hub, a managed service that
    enables you to define, validate, and track the resilience of your applications on AWS
- from version 1.23.2
  * api-change:``batch``: Adds support for scheduling policy APIs.
  * api-change:``health``: Documentation updates for AWS Health.
  * api-change:``greengrassv2``: This release adds support for Greengrass core devices running
    Windows. You can now specify name of a Windows user to run a component.
- from version 1.23.1
  * bugfix:urllib3: Fix NO_OP_TICKET import bug in older versions of urllib3
- from version 1.23.0
  * feature:EndpointResolver: Adding support for resolving modeled FIPS and Dualstack endpoints.
  * feature:``six``: Updated vendored version of ``six`` from 1.10.0 to 1.16.0
  * api-change:``sagemaker``: SageMaker CreateEndpoint and UpdateEndpoint APIs now support additional
    deployment configuration to manage traffic shifting options and automatic rollback monitoring.
    DescribeEndpoint now shows new in-progress deployment details with stage status.
  * api-change:``chime-sdk-meetings``: Updated format validation for ids and regions.
  * api-change:``wafv2``: You can now configure rules to run a CAPTCHA check against web requests
    and, as needed, send a CAPTCHA challenge to the client.
  * api-change:``ec2``: This release adds internal validation on the GatewayAssociationState field
- from version 1.22.12
  * api-change:``ec2``: DescribeInstances now returns customer-owned IP addresses for instances
    running on an AWS Outpost.
  * api-change:``translate``: This release enable customers to use their own KMS keys to encrypt
    output files when they submit a batch transform job.
  * api-change:``resourcegroupstaggingapi``: Documentation updates and improvements.
- from version 1.22.11
  * api-change:``chime-sdk-meetings``: The Amazon Chime SDK Meetings APIs allow software developers
    to create meetings and attendees for interactive audio, video, screen and content sharing in custom
    meeting applications which use the Amazon Chime SDK.
  * api-change:``sagemaker``: ListDevices and DescribeDevice now show Edge Manager agent version.
  * api-change:``connect``: This release adds CRUD operation support for Security profile resource in
    Amazon Connect
  * api-change:``iotwireless``: Adding APIs for the FUOTA (firmware update over the air) and
    multicast for LoRaWAN devices and APIs to support event notification opt-in feature for Sidewalk
    related events. A few existing APIs need to be modified for this new feature.
  * api-change:``ec2``: This release adds a new instance replacement strategy for EC2 Fleet, Spot
    Fleet. Now you can select an action to perform when your instance gets a rebalance notification.
    EC2 Fleet, Spot Fleet can launch a replacement then terminate the instance that received
    notification after a termination delay
- from version 1.22.10
  * api-change:``finspace``: Adds superuser and data-bundle parameters to CreateEnvironment API
  * api-change:``connectparticipant``: This release adds a new boolean attribute - Connect
    Participant - to the CreateParticipantConnection API, which can be used to mark the participant as
    connected.
  * api-change:``datasync``: AWS DataSync now supports Hadoop Distributed File System (HDFS) Locations
  * api-change:``macie2``: This release adds support for specifying the severity of findings that a
    custom data identifier produces, based on the number of occurrences of text that matches the
    detection criteria.
- from version 1.22.9
  * api-change:``cloudfront``: CloudFront now supports response headers policies to add HTTP headers
    to the responses that CloudFront sends to viewers. You can use these policies to add CORS headers,
    control browser caching, and more, without modifying your origin or writing any code.
  * api-change:``connect``: Amazon Connect Chat now supports real-time message streaming.
  * api-change:``nimble``: Amazon Nimble Studio adds support for users to stop and start streaming
    sessions.
- from version 1.22.8
  * api-change:``rekognition``: This Amazon Rekognition Custom Labels release introduces the
    management of datasets with  projects
  * api-change:``networkmanager``: This release adds API support to aggregate resources, routes, and
    telemetry data across a Global Network.
  * api-change:``lightsail``: This release adds support to enable access logging for buckets in the
    Lightsail object storage service.
  * api-change:``neptune``: Adds support for major version upgrades to ModifyDbCluster API
- from version 1.22.7
  * api-change:``transcribe``: Transcribe and Transcribe Call Analytics now support automatic
    language identification along with custom vocabulary, vocabulary filter, custom language model and
    PII redaction.
  * api-change:``application-insights``: Added Monitoring support for SQL Server Failover Cluster
    Instance. Additionally, added a new API to allow one-click monitoring of containers resources.
  * api-change:``rekognition``: This release added new attributes to Rekognition Video
    GetCelebrityRecognition API operations.
  * api-change:``connect``: Amazon Connect Chat now supports real-time message streaming.
  * api-change:``ec2``: Support added for AMI sharing with organizations and organizational units in
    ModifyImageAttribute API</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1641384000">- Version update to 1.23.28
  * api-change:``rekognition``: This release introduces a new field IndexFacesModelVersion, which is
    the version of the face detect and storage model that was used when indexing the face vector.
  * api-change:``s3``: Minor doc-based updates based on feedback bugs received.
  * enhancement:JSONFileCache: Add support for __delitem__ in JSONFileCache
  * api-change:``s3control``: Documentation updates for the renaming of Glacier to Glacier Flexible
    Retrieval.
- from version 1.23.27
  * api-change:``sagemaker``: The release allows users to pass pipeline definitions as Amazon S3
    locations and control the pipeline execution concurrency using ParallelismConfiguration. It also
    adds support of EMR jobs as pipeline steps.
  * api-change:``rds``: Multiple doc-only updates for Relational Database Service (RDS)
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added strength levels to the
    Sharpness Filter and now permits OGG files to be specified as sidecar audio inputs.
  * api-change:``greengrassv2``: This release adds the API operations to manage the Greengrass role
    associated with your account and to manage the core device connectivity information. Greengrass V2
    customers can now depend solely on Greengrass V2 SDK for all the API operations needed to manage
    their fleets.
  * api-change:``detective``: Added and updated API operations to support the Detective integration
    with AWS Organizations. New actions are used to manage the delegated administrator account and the
    integration configuration.
- from version 1.23.26
  * api-change:``nimble``: Amazon Nimble Studio adds support for users to upload files during a
    streaming session using NICE DCV native client or browser.
  * api-change:``chime-sdk-messaging``: The Amazon Chime SDK now supports updating message attributes
    via channel flows
  * api-change:``imagebuilder``: Added a note to infrastructure configuration actions and data types
    concerning delivery of Image Builder event messages to encrypted SNS topics. The key that's used to
    encrypt the SNS topic must reside in the account that Image Builder runs under.
  * api-change:``workmail``: This release allows customers to change their email monitoring
    configuration in Amazon WorkMail.
  * api-change:``transfer``: Property for Transfer Family used with the FTPS protocol. TLS Session
    Resumption provides a mechanism to resume or share a negotiated secret key between the control and
    data connection for an FTPS session.
  * api-change:``lookoutmetrics``: This release adds support for Causal Relationships. Added new
    ListAnomalyGroupRelatedMetrics API operation and InterMetricImpactDetails API data type
  * api-change:``mediaconnect``: You can now use the Fujitsu-QoS protocol for your MediaConnect
    sources and outputs to transport content to and from Fujitsu devices.
  * api-change:``qldb``: Amazon QLDB now supports journal exports in JSON and Ion Binary formats.
    This release adds an optional OutputFormat parameter to the ExportJournalToS3 API.
- from version 1.23.25
  * api-change:``customer-profiles``: This release adds an optional parameter, ObjectTypeNames to the
    PutIntegration API to support multiple object types per integration option. Besides, this release
    introduces Standard Order Objects which contain data from third party systems and each order object
    belongs to a specific profile.
  * api-change:``sagemaker``: This release adds a new ContentType field in AutoMLChannel for
    SageMaker CreateAutoMLJob InputDataConfig.
  * api-change:``forecast``: Adds ForecastDimensions field to the DescribeAutoPredictorResponse
  * api-change:``securityhub``: Added new resource details objects to ASFF, including resources for
    Firewall, and RuleGroup, FirewallPolicy Added additional details for AutoScalingGroup,
    LaunchConfiguration, and S3 buckets.
  * api-change:``location``: Making PricingPlan optional as part of create resource API.
  * api-change:``redshift``: This release adds API support for managed Redshift datashares. Customers
    can now interact with a Redshift datashare that is managed by a different service, such as AWS Data
    Exchange.
  * api-change:``apigateway``: Documentation updates for Amazon API Gateway
  * api-change:``devops-guru``: Adds Tags support to DescribeOrganizationResourceCollectionHealth
  * api-change:``imagebuilder``: This release adds support for importing and exporting VM Images as
    part of the Image Creation workflow via EC2 VM Import/Export.
  * api-change:``datasync``: AWS DataSync now supports FSx Lustre Locations.
  * api-change:``finspace-data``: Make dataset description optional and allow s3 export for dataviews</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642161600">- Version update to 1.23.35
  * api-change:``pinpoint``: Adds JourneyChannelSettings to WriteJourneyRequest
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``nimble``: Amazon Nimble Studio now supports validation for Launch Profiles. Launch
    Profiles now report static validation results after create/update to detect errors in network or
    active directory configuration.
  * api-change:``glue``: This SDK release adds support to pass run properties when starting a
    workflow run
  * api-change:``ssm``: AWS Systems Manager adds category support for DescribeDocument API
  * api-change:``elasticache``: AWS ElastiCache for Redis has added a new Engine Log LogType in
    LogDelivery feature. You can now publish the Engine Log from your Amazon ElastiCache for Redis
    clusters to Amazon CloudWatch Logs and Amazon Kinesis Data Firehose.
- from version 1.23.34
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``honeycode``: Honeycode is releasing new APIs to allow user to create, delete and
    list tags on resources.
  * api-change:``ec2``: Hpc6a instances are powered by a third-generation AMD EPYC processors (Milan)
    delivering all-core turbo frequency of 3.4 GHz
  * api-change:``fms``: Shield Advanced policies for Amazon CloudFront resources now support
    automatic application layer DDoS mitigation. The max length for SecurityServicePolicyData
    ManagedServiceData is now 8192 characters, instead of 4096.
  * api-change:``pi``: This release adds three Performance Insights APIs. Use
    ListAvailableResourceMetrics to get available metrics, GetResourceMetadata to get feature metadata,
    and ListAvailableResourceDimensions to list available dimensions. The AdditionalMetrics field in
    DescribeDimensionKeys retrieves per-SQL metrics.
- from version 1.23.33
  * api-change:``finspace-data``: Documentation updates for FinSpace.
  * api-change:``rds``: This release adds the db-proxy event type to support subscribing to RDS Proxy
    events.
  * api-change:``ce``: Doc only update for Cost Explorer API that fixes missing clarifications for
    MatchOptions definitions
  * api-change:``kendra``: Amazon Kendra now supports advanced query language and query-less search.
  * api-change:``workspaces``: Introducing new APIs for Workspaces audio optimization with Amazon
    Connect: CreateConnectClientAddIn, DescribeConnectClientAddIns, UpdateConnectClientAddIn and
    DeleteConnectClientAddIn.
  * api-change:``iotevents-data``: This release provides documentation updates for Timer.timestamp in
    the IoT Events API Reference Guide.
  * api-change:``ec2``: EC2 Capacity Reservations now supports RHEL instance platforms (RHEL with SQL
    Server Standard, RHEL with SQL Server Enterprise, RHEL with SQL Server Web, RHEL with HA, RHEL with
    HA and SQL Server Standard, RHEL with HA and SQL Server Enterprise)
- from version 1.23.32
  * api-change:``ec2``: New feature: Updated EC2 API to support faster launching for Windows images.
    Optimized images are pre-provisioned, using snapshots to launch instances up to 65% faster.
  * api-change:``compute-optimizer``: Adds support for new Compute Optimizer capability that makes it
    easier for customers to optimize their EC2 instances by leveraging multiple CPU architectures.
  * api-change:``lookoutmetrics``: This release adds FailureType in the response of
    DescribeAnomalyDetector.
  * api-change:``databrew``: This SDK release adds support for specifying a Bucket Owner for an S3
    location.
  * api-change:``transcribe``: Documentation updates for Amazon Transcribe.
- from version 1.23.31
  * api-change:``medialive``: This release adds support for selecting the Program Date Time (PDT)
    Clock source algorithm for HLS outputs.
- from version 1.23.30
  * api-change:``ec2``: This release introduces On-Demand Capacity Reservation support for Cluster
    Placement Groups, adds Tags on instance Metadata, and includes documentation updates for Amazon EC2.
  * api-change:``mediatailor``: This release adds support for filler slate when updating MediaTailor
    channels that use the linear playback mode.
  * api-change:``opensearch``: Amazon OpenSearch Service adds support for Fine Grained Access Control
    for existing domains running Elasticsearch version 6.7 and above
  * api-change:``iotwireless``: Downlink Queue Management feature provides APIs for customers to
    manage the queued messages destined to device inside AWS IoT Core for LoRaWAN. Customer can view,
    delete or purge the queued message(s). It allows customer to preempt the queued messages and let
    more urgent messages go through.
  * api-change:``es``: Amazon OpenSearch Service adds support for Fine Grained Access Control for
    existing domains running Elasticsearch version 6.7 and above
  * api-change:``mwaa``: This release adds a "Source" field that provides the initiator of an update,
    such as due to an automated patch from AWS or due to modification via Console or API.
  * api-change:``appsync``: AppSync: AWS AppSync now supports configurable batching sizes for AWS
    Lambda resolvers, Direct AWS Lambda resolvers and pipeline functions
- from version 1.23.29
  * api-change:``cloudtrail``: This release adds support for CloudTrail Lake, a new feature that lets
    you run SQL-based queries on events that you have aggregated into event data stores. New APIs have
    been added for creating and managing event data stores, and creating, running, and managing queries
    in CloudTrail Lake.
  * api-change:``iot``: This release adds an automatic retry mechanism for AWS IoT Jobs. You can now
    define a maximum number of retries for each Job rollout, along with the criteria to trigger the
    retry for FAILED/TIMED_OUT/ALL(both FAILED an TIMED_OUT) job.
  * api-change:``ec2``: This release adds a new API called
    ModifyVpcEndpointServicePayerResponsibility which allows VPC endpoint service owners to take payer
    responsibility of their VPC Endpoint connections.
  * api-change:``snowball``: Updating validation rules for interfaces used in the Snowball API to
    tighten security of service.
  * api-change:``lakeformation``: Add new APIs for 3rd Party Support for Lake Formation
  * api-change:``appstream``: Includes APIs for App Entitlement management regarding entitlement and
    entitled application association.
  * api-change:``eks``: Amazon EKS now supports running applications using IPv6 address space
  * api-change:``quicksight``: Multiple Doc-only updates for Amazon QuickSight.
  * api-change:``ecs``: Documentation update for ticket fixes.
  * api-change:``sagemaker``: Amazon SageMaker now supports running training jobs on ml.g5 instance
    types.
  * api-change:``glue``: Add Delta Lake target support for Glue Crawler and 3rd Party Support for
    Lake Formation</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642766400">- Version update to 1.23.40
  * api-change:``guardduty``: Amazon GuardDuty findings now include remoteAccountDetails under
    AwsApiCallAction section if instance credential is exfiltrated.
  * api-change:``connect``: This release adds tagging support for UserHierarchyGroups resource.
  * api-change:``mediatailor``: This release adds support for multiple Segment Delivery
    Configurations. Users can provide a list of names and URLs when creating or editing a source
    location. When retrieving content, users can send a header to choose which URL should be used to
    serve content.
  * api-change:``fis``: Added action startTime and action endTime timestamp fields to the
    ExperimentAction object
  * api-change:``ec2``: C6i, M6i and R6i instances are powered by a third-generation Intel Xeon
    Scalable processor (Ice Lake) delivering all-core turbo frequency of 3.5 GHz
- from version 1.23.39
  * api-change:``macie2``: This release of the Amazon Macie API introduces stricter validation of
    requests to create custom data identifiers.
  * api-change:``ec2-instance-connect``: Adds support for ED25519 keys. PushSSHPublicKey Availability
    Zone parameter is now optional. Adds EC2InstanceStateInvalidException for instances that are not
    running. This was previously a service exception, so this may require updating your code to handle
    this new exception.
- from version 1.23.38
  * api-change:``ivs``: This release adds support for the new Thumbnail Configuration property for
    Recording Configurations. For more information see
    https://docs.aws.amazon.com/ivs/latest/userguide/record-to-s3.html
  * api-change:``storagegateway``: Documentation update for adding bandwidth throttling support for
    S3 File Gateways.
  * api-change:``location``: This release adds the CalculateRouteMatrix API which calculates routes
    for the provided departure and destination positions. The release also deprecates the use of
    pricing plan across all verticals.
  * api-change:``cloudtrail``: This release fixes a documentation bug in the description for the
    readOnly field selector in advanced event selectors. The description now clarifies that users omit
    the readOnly field selector to select both Read and Write management events.
  * api-change:``ec2``: Add support for AWS Client VPN client login banner and session timeout.
- from version 1.23.37
  * enhancement:Configuration: Adding support for `defaults_mode` configuration. The `defaults_mode`
    will be used to determine how certain default configuration options are resolved in the SDK.
- from version 1.23.36
  * api-change:``config``: Update ResourceType enum with values for CodeDeploy, EC2 and Kinesis
    resources
  * api-change:``application-insights``: Application Insights support for Active Directory and
    SharePoint
  * api-change:``honeycode``: Added read and write api support for multi-select picklist. And added
    errorcode field to DescribeTableDataImportJob API output, when import job fails.
  * api-change:``ram``: This release adds the ListPermissionVersions API which lists the versions for
    a given permission.
  * api-change:``lookoutmetrics``: This release adds a new DeactivateAnomalyDetector API operation.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1643716800">- Version update to 1.23.46
  * api-change:``appconfigdata``: Documentation updates for AWS AppConfig Data.
  * api-change:``athena``: This release adds a field, AthenaError, to the GetQueryExecution response
    object when a query fails.
  * api-change:``appconfig``: Documentation updates for AWS AppConfig
  * api-change:``cognito-idp``: Doc updates for Cognito user pools API Reference.
  * api-change:``secretsmanager``: Feature are ready to release on Jan 28th
  * api-change:``sagemaker``: This release added a new NNA accelerator compilation support for
    Sagemaker Neo.
- from version 1.23.45
  * api-change:``ec2``: X2ezn instances are powered by Intel Cascade Lake CPUs that deliver turbo all
    core frequency of up to 4.5 GHz and up to 100 Gbps of networking bandwidth
  * api-change:``kafka``: Amazon MSK has updated the CreateCluster and UpdateBrokerStorage API that
    allows you to specify volume throughput during cluster creation and broker volume updates.
  * api-change:``connect``: This release adds support for configuring a custom chat duration when
    starting a new chat session via the StartChatContact API. The default value for chat duration is 25
    hours, minimum configurable value is 1 hour (60 minutes) and maximum configurable value is 7 days
    (10,080 minutes).
  * api-change:``amplify``: Doc only update to the description of basicauthcredentials to describe
    the required encoding and format.
  * api-change:``opensearch``: Allows customers to get progress updates for blue/green deployments
- from version 1.23.44
  * api-change:``frauddetector``: Added new APIs for viewing past predictions and obtaining
    prediction metadata including prediction explanations: ListEventPredictions and
    GetEventPredictionMetadata
  * api-change:``ebs``: Documentation updates for Amazon EBS Direct APIs.
  * api-change:``codeguru-reviewer``: Added failure state and adjusted timeout in waiter
  * api-change:``securityhub``: Adding top level Sample boolean field
  * api-change:``sagemaker``: API changes relating to Fail steps in model building pipeline and add
    PipelineExecutionFailureReason in PipelineExecutionSummary.
- from version 1.23.43
  * api-change:``fsx``: This release adds support for growing SSD storage capacity and
    growing/shrinking SSD IOPS for FSx for ONTAP file systems.
  * api-change:``efs``: Update efs client to latest version
  * api-change:``connect``: This release adds support for custom vocabularies to be used with Contact
    Lens. Custom vocabularies improve transcription accuracy for one or more specific words.
  * api-change:``guardduty``: Amazon GuardDuty expands threat detection coverage to protect Amazon
    Elastic Kubernetes Service (EKS) workloads.
- from version 1.23.42
  * api-change:``route53-recovery-readiness``: Updated documentation for Route53 Recovery Readiness
    APIs.
- from version 1.23.41
  * enhancement:Exceptions: ProxyConnectionError previously provided the full proxy URL. User info
    will now be appropriately masked if needed.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added support for 4K AV1 output
    resolutions &amp; 10-bit AV1 color, the ability to ingest sidecar Dolby Vision XML metadata files, and
    the ability to flag WebVTT and IMSC tracks for accessibility in HLS.
  * api-change:``transcribe``: Add support for granular PIIEntityTypes when using Batch
    ContentRedaction.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1645012800">- Version update to 1.24.0
  * api-change:``appflow``: Launching Amazon AppFlow SAP as a destination connector SDK.
  * feature:Parser: Adding support for parsing int/long types in rest-json response headers.
  * api-change:``rds``: Adds support for determining which Aurora PostgreSQL versions support
    Babelfish.
  * api-change:``athena``: This release adds a subfield, ErrorType, to the AthenaError response
    object in the GetQueryExecution API when a query fails.
- from version 1.23.54
  * api-change:``ssm``: Documentation updates for AWS Systems Manager.
- from version 1.23.53
  * api-change:``cloudformation``: This SDK release adds AWS CloudFormation Hooks HandlerErrorCodes
  * api-change:``lookoutvision``: This release makes CompilerOptions in Lookout for Vision's
    StartModelPackagingJob's Configuration object optional.
  * api-change:``pinpoint``: This SDK release adds a new paramater creation date for GetApp and
    GetApps Api call
  * api-change:``sns``: Customer requested typo fix in API documentation.
  * api-change:``wafv2``: Adds support for AWS WAF Fraud Control account takeover prevention (ATP),
    with configuration options for the new managed rule group AWSManagedRulesATPRuleSet and support for
    application integration SDKs for Android and iOS mobile apps.
- from version 1.23.52
  * api-change:``cloudformation``: This SDK release is for the feature launch of AWS CloudFormation
    Hooks.
- from version 1.23.51
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Amazon FSx. For
    more information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-fsx.html
  * api-change:``apprunner``: This release adds support for App Runner to route outbound network
    traffic of a service through an Amazon VPC. New API: CreateVpcConnector, DescribeVpcConnector,
    ListVpcConnectors, and DeleteVpcConnector. Updated API: CreateService, DescribeService, and
    UpdateService.
  * api-change:``s3control``: This release adds support for S3 Batch Replication. Batch Replication
    lets you replicate existing objects, already replicated objects to new destinations, and objects
    that previously failed to replicate. Customers will receive object-level visibility of progress and
    a detailed completion report.
  * api-change:``sagemaker``: Autopilot now generates an additional report with information on the
    performance of the best model, such as a Confusion matrix and  Area under the receiver operating
    characteristic (AUC-ROC). The path to the report can be found in CandidateArtifactLocations.
- from version 1.23.50
  * api-change:``auditmanager``: This release updates 3 API parameters.
    UpdateAssessmentFrameworkControlSet now requires the controls attribute, and
    CreateAssessmentFrameworkControl requires the id attribute. Additionally, UpdateAssessmentFramework
    now has a minimum length constraint for the controlSets attribute.
  * api-change:``synthetics``: Adding names parameters to the Describe APIs.
  * api-change:``ssm-incidents``: Update RelatedItem enum to support SSM Automation
  * api-change:``events``: Update events client to latest version
  * enhancement:Lambda Request Header: Adding request header for Lambda recursion detection.
- from version 1.23.49
  * api-change:``athena``: You can now optionally specify the account ID that you expect to be the
    owner of your query results output location bucket in Athena. If the account ID of the query
    results bucket owner does not match the specified account ID, attempts to output to the bucket will
    fail with an S3 permissions error.
  * api-change:``rds``: updates for RDS Custom for Oracle 12.1 support
  * api-change:``lakeformation``: Add support for calling Update Table Objects without a
    TransactionId.
- from version 1.23.48
  * api-change:``ec2``: adds support for AMIs in Recycle Bin
  * api-change:``robomaker``: The release deprecates the use various APIs of RoboMaker Deployment
    Service in favor of AWS IoT GreenGrass v2.0.
  * api-change:``meteringmarketplace``: Add CustomerAWSAccountId to ResolveCustomer API response and
    increase UsageAllocation limit to 2500.
  * api-change:``rbin``: Add EC2 Image recycle bin support.
- from version 1.23.47
  * api-change:``emr``: Update emr client to latest version
  * api-change:``personalize``: Adding minRecommendationRequestsPerSecond attribute to recommender
    APIs.
  * enhancement:Request headers: Adding request headers with retry information.
  * api-change:``appflow``: Launching Amazon AppFlow Custom Connector SDK.
  * api-change:``dynamodb``: Documentation update for DynamoDB Java SDK.
  * api-change:``iot``: This release adds support for configuring AWS IoT logging level per client
    ID, source IP, or principal ID.
  * api-change:``comprehend``: Amazon Comprehend now supports sharing and importing custom trained
    models from one AWS account to another within the same region.
  * api-change:``ce``: Doc-only update for Cost Explorer API that adds INVOICING_ENTITY dimensions
  * api-change:``fis``: Added GetTargetResourceType and ListTargetResourceTypesAPI actions. These
    actions return additional details about resource types and parameters that can be targeted by FIS
    actions. Added a parameters field for the targets that can be specified in experiment templates.
  * api-change:``es``: Allows customers to get progress updates for blue/green deployments
  * api-change:``glue``: Launch Protobuf support for AWS Glue Schema Registry
  * api-change:``elasticache``: Documentation update for AWS ElastiCache</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646222400">- Version update to 1.24.10
  * api-change:``mediapackage``: This release adds Hybridcast as an available profile option for Dash
    Origin Endpoints.
  * api-change:``rds``: Documentation updates for Multi-AZ DB clusters.
  * api-change:``mgn``: Add support for GP3 and IO2 volume types. Add bootMode to LaunchConfiguration
    object (and as a parameter to UpdateLaunchConfigurationRequest).
  * api-change:``kafkaconnect``: Adds operation for custom plugin deletion (DeleteCustomPlugin) and
    adds new StateDescription field to DescribeCustomPlugin and DescribeConnector responses to return
    errors from asynchronous resource creation.
- from version 1.24.9
  * api-change:``finspace-data``: Add new APIs for managing Users and Permission Groups.
  * api-change:``amplify``: Add repositoryCloneMethod field for hosting an Amplify app. This field
    shows what authorization method is used to clone the repo: SSH, TOKEN, or SIGV4.
  * api-change:``fsx``: This release adds support for the following FSx for OpenZFS features:
    snapshot lifecycle transition messages, force flag for deleting file systems with child resources,
    LZ4 data compression, custom record sizes, and unsetting volume quotas and reservations.
  * api-change:``fis``: This release adds logging support for AWS Fault Injection Simulator
    experiments. Experiment templates can now be configured to send experiment activity logs to Amazon
    CloudWatch Logs or to an S3 bucket.
  * api-change:``route53-recovery-cluster``: This release adds a new API option to enable overriding
    safety rules to allow routing control state updates.
  * api-change:``amplifyuibuilder``: We are adding the ability to configure workflows and actions for
    components.
  * api-change:``athena``: This release adds support for updating an existing named query.
  * api-change:``ec2``: This release adds support for new AMI property 'lastLaunchedTime'
  * api-change:``servicecatalog-appregistry``: AppRegistry is deprecating Application and
    Attribute-Group Name update feature. In this release, we are marking the name attributes for Update
    APIs as deprecated to give a heads up to our customers.
- from version 1.24.8
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``panorama``: Added NTP server configuration parameter to ProvisionDevice operation.
    Added alternate software fields to DescribeDevice response
- from version 1.24.7
  * api-change:``route53``: SDK doc update for Route 53 to update some parameters with new
    information.
  * api-change:``databrew``: This AWS Glue Databrew release adds feature to merge job outputs into a
    max number of files for S3 File output type.
  * api-change:``transfer``: Support automatic pagination when listing AWS Transfer Family resources.
  * api-change:``s3control``: Amazon S3 Batch Operations adds support for new integrity checking
    capabilities in Amazon S3.
  * api-change:``s3``: This release adds support for new integrity checking capabilities in Amazon
    S3. You can choose from four supported checksum algorithms for data integrity checking on your
    upload and download requests. In addition, AWS SDK can automatically calculate a checksum as it
    streams data into S3
  * api-change:``fms``: AWS Firewall Manager now supports the configuration of AWS Network Firewall
    policies with either centralized or distributed deployment models. This release also adds support
    for custom endpoint configuration, where you can choose which Availability Zones to create firewall
    endpoints in.
  * api-change:``lightsail``: This release adds support to delete and create Lightsail default key
    pairs that you can use with Lightsail instances.
  * api-change:``autoscaling``: You can now hibernate instances in a warm pool to stop instances
    without deleting their RAM contents. You can now also return instances to the warm pool on scale
    in, instead of always terminating capacity that you will need later.
- from version 1.24.6
  * api-change:``transfer``: The file input selection feature provides the ability to use either the
    originally uploaded file or the output file from the previous workflow step, enabling customers to
    make multiple copies of the original file while keeping the source file intact for file archival.
  * api-change:``lambda``: Lambda releases .NET 6 managed runtime to be available in all commercial
    regions.
  * api-change:``textract``: Added support for merged cells and column header for table response.
- from version 1.24.5
  * api-change:``translate``: This release enables customers to use translation settings for
    formality customization in their synchronous translation output.
  * api-change:``wafv2``: Updated descriptions for logging configuration.
  * api-change:``apprunner``: AWS App Runner adds a Java platform (Corretto 8, Corretto 11 runtimes)
    and a Node.js 14 runtime.
- from version 1.24.4
  * api-change:``imagebuilder``: This release adds support to enable faster launching for Windows
    AMIs created by EC2 Image Builder.
  * api-change:``customer-profiles``: This release introduces apis CreateIntegrationWorkflow,
    DeleteWorkflow, ListWorkflows, GetWorkflow and GetWorkflowSteps. These apis are used to manage and
    view integration workflows.
  * api-change:``dynamodb``: DynamoDB ExecuteStatement API now supports Limit as a request parameter
    to specify the maximum number of items to evaluate. If specified, the service will process up to
    the Limit and the results will include a LastEvaluatedKey value to continue the read in a
    subsequent operation.
- from version 1.24.3
  * api-change:``transfer``: Properties for Transfer Family used with SFTP, FTP, and FTPS protocols.
    Display Banners are bodies of text that can be displayed before and/or after a user authenticates
    onto a server using one of the previously mentioned protocols.
  * api-change:``gamelift``: Increase string list limit from 10 to 100.
  * api-change:``budgets``: This change introduces DescribeBudgetNotificationsForAccount API which
    returns budget notifications for the specified account
- from version 1.24.2
  * api-change:``iam``: Documentation updates for AWS Identity and Access Management (IAM).
  * api-change:``redshift``: SDK release for Cross region datasharing and cost-control for cross
    region datasharing
  * api-change:``evidently``: Add support for filtering list of experiments and launches by status
  * api-change:``backup``: AWS Backup add new S3_BACKUP_OBJECT_FAILED and S3_RESTORE_OBJECT_FAILED
    event types in BackupVaultNotifications events list.
- from version 1.24.1
  * api-change:``ec2``: Documentation updates for EC2.
  * api-change:``budgets``: Adds support for auto-adjusting budgets, a new budget method alongside
    fixed and planned. Auto-adjusting budgets introduces new metadata to configure a budget limit
    baseline using a historical lookback average or current period forecast.
  * api-change:``ce``: AWS Cost Anomaly Detection now supports SNS FIFO topic subscribers.
  * api-change:``glue``: Support for optimistic locking in UpdateTable
  * api-change:``ssm``: Assorted ticket fixes and updates for AWS Systems Manager.</changelog>
  <changelog author="dmueller@suse.com" date="1647864000">- Update to 1.24.22
  * enhancement:jmespath: Add env markers to get working version of jmespath for python 3.6
  * api-change:``glue``: Added 9 new APIs for AWS Glue Interactive Sessions: ListSessions,
    StopSession, CreateSession, GetSession, DeleteSession, RunStatement, GetStatement, ListStatements,
    CancelStatement
- from version 1.24.21
  * enhancement:Dependency: Added support for jmespath 1.0
  * api-change:``amplifybackend``: Adding the ability to customize Cognito verification messages for
    email and SMS in CreateBackendAuth and UpdateBackendAuth. Adding deprecation documentation for
    ForgotPassword in CreateBackendAuth and UpdateBackendAuth
  * api-change:``acm-pca``: AWS Certificate Manager (ACM) Private Certificate Authority (CA) now
    supports customizable certificate subject names and extensions.
  * api-change:``ssm-incidents``: Removed incorrect validation pattern for
    IncidentRecordSource.invokedBy
  * api-change:``billingconductor``: This is the initial SDK release for AWS Billing Conductor. The
    AWS Billing Conductor is a customizable billing service, allowing you to customize your billing
    data to match your desired business structure.
  * api-change:``s3outposts``: S3 on Outposts is releasing a new API, ListSharedEndpoints, that lists
    all endpoints associated with S3 on Outpost, that has been shared by Resource Access Manager (RAM).
- from version 1.24.20
  * api-change:``robomaker``: This release deprecates ROS, Ubuntu and Gazbeo from RoboMaker
    Simulation Service Software Suites in favor of user-supplied containers and Relaxed Software Suites.
  * api-change:``dataexchange``: This feature enables data providers to use the RevokeRevision
    operation to revoke subscriber access to a given revision. Subscribers are unable to interact with
    assets within a revoked revision.
  * api-change:``ec2``: Adds the Cascade parameter to the DeleteIpam API. Customers can use this
    parameter to automatically delete their IPAM, including non-default scopes, pools, cidrs, and
    allocations. There mustn't be any pools provisioned in the default public scope to use this
    parameter.
  * api-change:``cognito-idp``: Updated EmailConfigurationType and SmsConfigurationType to reflect
    that you can now choose Amazon SES and Amazon SNS resources in the same Region.
  * enhancement:AWSCRT: Upgrade awscrt extra to 0.13.5
  * api-change:``location``: New HERE style "VectorHereExplore" and "VectorHereExploreTruck".
  * api-change:``ecs``: Documentation only update to address tickets
  * api-change:``keyspaces``: Fixing formatting issues in CLI and SDK documentation
  * api-change:``rds``: Various documentation improvements
- from version 1.24.19
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Slack. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-slack.html
  * api-change:``timestream-query``: Amazon Timestream Scheduled Queries now support Timestamp
    datatype in a multi-measure record.
  * enhancement:Stubber: Added support for modeled exception fields when adding errors to a client
    stub. Implements boto/boto3`#3178 &lt;https://github.com/boto/botocore/issues/3178&gt;`__.
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``config``: Add resourceType enums for AWS::ECR::PublicRepository and
    AWS::EC2::LaunchTemplate
- from version 1.24.18
  * api-change:``outposts``: This release adds address filters for listSites
  * api-change:``lambda``: Adds PrincipalOrgID support to AddPermission API. Customers can use it to
    manage permissions to lambda functions at AWS Organizations level.
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager.
  * api-change:``connect``: This release adds support for enabling Rich Messaging when starting a new
    chat session via the StartChatContact API. Rich Messaging enables the following formatting options:
    bold, italics, hyperlinks, bulleted lists, and numbered lists.
  * api-change:``chime``: Chime VoiceConnector Logging APIs will now support MediaMetricLogs. Also
    CreateMeetingDialOut now returns AccessDeniedException.
- from version 1.24.17
  * api-change:``transcribe``: Documentation fix for API `StartMedicalTranscriptionJobRequest`, now
    showing min sample rate as 16khz
  * api-change:``transfer``: Adding more descriptive error types for managed workflows
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
- from version 1.24.16
  * api-change:``comprehend``: Amazon Comprehend now supports extracting the sentiment associated
    with entities such as brands, products and services from text documents.
- from version 1.24.15
  * api-change:``eks``: Introducing a new enum for NodeGroup error code:
    Ec2SubnetMissingIpv6Assignment
  * api-change:``keyspaces``: Adding link to CloudTrail section in Amazon Keyspaces Developer Guide
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added support for reading
    timecode from AVCHD sources and now provides the ability to segment WebVTT at the same interval as
    the video and audio in HLS packages.
- from version 1.24.14
  * api-change:``chime-sdk-meetings``: Adds support for Transcribe language identification feature to
    the StartMeetingTranscription API.
  * api-change:``ecs``: Amazon ECS UpdateService API now supports additional parameters:
    loadBalancers, propagateTags, enableECSManagedTags, and serviceRegistries
  * api-change:``migration-hub-refactor-spaces``: AWS Migration Hub Refactor Spaces documentation
    update.
- from version 1.24.13
  * api-change:``synthetics``: Allow custom handler function.
  * api-change:``transfer``: Add waiters for server online and offline.
  * api-change:``devops-guru``: Amazon DevOps Guru now integrates with Amazon CodeGuru Profiler. You
    can view CodeGuru Profiler recommendations for your AWS Lambda function in DevOps Guru. This
    feature is enabled by default for new customers as of 3/4/2022. Existing customers can enable this
    feature with UpdateEventSourcesConfig.
  * api-change:``macie``: Amazon Macie Classic (macie) has been discontinued and is no longer
    available. A new Amazon Macie (macie2) is now available with significant design improvements and
    additional features.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``connect``: This release updates the *InstanceStorageConfig APIs so they support a
    new ResourceType: REAL_TIME_CONTACT_ANALYSIS_SEGMENTS. Use this resource type to enable streaming
    for real-time contact analysis and to associate the Kinesis stream where real-time contact analysis
    segments will be published.
- from version 1.24.12
  * api-change:``greengrassv2``: Doc only update that clarifies Create Deployment section.
  * api-change:``fsx``: This release adds support for data repository associations to use root ("/")
    as the file system path
  * api-change:``kendra``: Amazon Kendra now suggests spell corrections for a query. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/query-spell-check.html
  * api-change:``appflow``: Launching Amazon AppFlow Marketo as a destination connector SDK.
  * api-change:``timestream-query``: Documentation only update for SDK and CLI
- from version 1.24.11
  * api-change:``gamelift``: Minor updates to address errors.
  * api-change:``cloudtrail``: Add bytesScanned field into responses of DescribeQuery and
    GetQueryResults.
  * api-change:``athena``: This release adds support for S3 Object Ownership by allowing the S3
    bucket owner full control canned ACL to be set when Athena writes query results to S3 buckets.
  * api-change:``keyspaces``: This release adds support for data definition language (DDL) operations
  * api-change:``ecr``: This release adds support for tracking images lastRecordedPullTime.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1649073600">- Update to 1.24.32
  * api-change:``connect``: This release updates these APIs: UpdateInstanceAttribute,
    DescribeInstanceAttribute and ListInstanceAttributes. You can use it to programmatically
    enable/disable multi-party conferencing using attribute type MULTI_PARTY_CONFERENCING on the
    specified Amazon Connect instance.
- from version 1.24.31
  * api-change:``cloudcontrol``: SDK release for Cloud Control API in Amazon Web Services China
    (Beijing) Region, operated by Sinnet, and Amazon Web Services China (Ningxia) Region, operated by
    NWCD
  * api-change:``pinpoint-sms-voice-v2``: Amazon Pinpoint now offers a version 2.0 suite of SMS and
    voice APIs, providing increased control over sending and configuration. This release is a new SDK
    for sending SMS and voice messages called PinpointSMSVoiceV2.
  * api-change:``workspaces``: Added APIs that allow you to customize the logo, login message, and
    help links in the WorkSpaces client login page. To learn more, visit
    https://docs.aws.amazon.com/workspaces/latest/adminguide/customize-branding.html
  * api-change:``route53-recovery-cluster``: This release adds a new API "ListRoutingControls" to
    list routing control states using the highly reliable Route 53 ARC data plane endpoints.
  * api-change:``databrew``: This AWS Glue Databrew release adds feature to support ORC as an input
    format.
  * api-change:``auditmanager``: This release adds documentation updates for Audit Manager. The
    updates provide data deletion guidance when a customer deregisters Audit Manager or deregisters a
    delegated administrator.
  * api-change:``grafana``: This release adds tagging support to the Managed Grafana service. New
    APIs: TagResource, UntagResource and ListTagsForResource. Updates: add optional field tags to
    support tagging while calling CreateWorkspace.
- from version 1.24.30
  * api-change:``iot-data``: Update the default AWS IoT Core Data Plane endpoint from VeriSign signed
    to ATS signed. If you have firewalls with strict egress rules, configure the rules to grant you
    access to data-ats.iot.[region].amazonaws.com or data-ats.iot.[region].amazonaws.com.cn.
  * api-change:``ec2``: This release simplifies the auto-recovery configuration process enabling
    customers to set the recovery behavior to disabled or default
  * api-change:``fms``: AWS Firewall Manager now supports the configuration of third-party policies
    that can use either the centralized or distributed deployment models.
  * api-change:``fsx``: This release adds support for modifying throughput capacity for FSx for ONTAP
    file systems.
  * api-change:``iot``: Doc only update for IoT that fixes customer-reported issues.
- from version 1.24.29
  * api-change:``organizations``: This release provides the new CloseAccount API that enables
    principals in the management account to close any member account within an organization.
- from version 1.24.28
  * api-change:``medialive``: This release adds support for selecting a maintenance window.
  * api-change:``acm-pca``: Updating service name entities
- from version 1.24.27
  * api-change:``ec2``: This is release adds support for Amazon VPC Reachability Analyzer to analyze
    path through a Transit Gateway.
  * api-change:``ssm``: This Patch Manager release supports creating, updating, and deleting Patch
    Baselines for Rocky Linux OS.
  * api-change:``batch``: Bug Fix: Fixed a bug where shapes were marked as unboxed and were not
    serialized and sent over the wire, causing an API error from the service.
- from version 1.24.26
  * api-change:``lambda``: Adds support for increased ephemeral storage (/tmp) up to 10GB for Lambda
    functions. Customers can now provision up to 10 GB of ephemeral storage per function instance, a
    20x increase over the previous limit of 512 MB.
  * api-change:``config``: Added new APIs GetCustomRulePolicy and GetOrganizationCustomRulePolicy,
    and updated existing APIs PutConfigRule, DescribeConfigRule, DescribeConfigRuleEvaluationStatus,
    PutOrganizationConfigRule, DescribeConfigRule to support a new feature for building AWS Config
    rules with AWS CloudFormation Guard
  * api-change:``transcribe``: This release adds an additional parameter for subtitling with Amazon
    Transcribe batch jobs: outputStartIndex.
- from version 1.24.25
  * api-change:``redshift``: This release adds a new [--encrypted | --no-encrypted] field in
    restore-from-cluster-snapshot API. Customers can now restore an unencrypted snapshot to a cluster
    encrypted with AWS Managed Key or their own KMS key.
  * api-change:``ebs``: Increased the maximum supported value for the Timeout parameter of the
    StartSnapshot API from 60 minutes to 4320 minutes.  Changed the HTTP error code for
    ConflictException from 503 to 409.
  * api-change:``gamesparks``: Released the preview of Amazon GameSparks, a fully managed AWS service
    that provides a multi-service backend for game developers.
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``transfer``: Documentation updates for AWS Transfer Family to describe how to remove
    an associated workflow from a server.
  * api-change:``auditmanager``: This release updates 1 API parameter, the SnsArn attribute. The
    character length and regex pattern for the SnsArn attribute have been updated, which enables you to
    deselect an SNS topic when using the UpdateSettings operation.
  * api-change:``ssm``: Update AddTagsToResource, ListTagsForResource, and RemoveTagsFromResource
    APIs to reflect the support for tagging Automation resources. Includes other minor documentation
    updates.
- from version 1.24.24
  * api-change:``location``: Amazon Location Service now includes a MaxResults parameter for
    GetDevicePositionHistory requests.
  * api-change:``polly``: Amazon Polly adds new Catalan voice - Arlet. Arlet is available as Neural
    voice only.
  * api-change:``lakeformation``: The release fixes the incorrect permissions called out in the
    documentation - DESCRIBE_TAG, ASSOCIATE_TAG, DELETE_TAG, ALTER_TAG. This trebuchet release fixes
    the corresponding SDK and documentation.
  * api-change:``ecs``: Documentation only update to address tickets
  * api-change:``ce``: Added three new APIs to support tagging and resource-level authorization on
    Cost Explorer resources: TagResource, UntagResource, ListTagsForResource.  Added optional
    parameters to CreateCostCategoryDefinition, CreateAnomalySubscription and CreateAnomalyMonitor APIs
    to support Tag On Create.
- from version 1.24.23
  * api-change:``ram``: Document improvements to the RAM API operations and parameter descriptions.
  * api-change:``ecr``: This release includes a fix in the DescribeImageScanFindings paginated output.
  * api-change:``quicksight``: AWS QuickSight Service Features - Expand public API support for group
    management.
  * api-change:``chime-sdk-meetings``: Add support for media replication to link multiple WebRTC
    media sessions together to reach larger and global audiences. Participants connected to a replica
    session can be granted access to join the primary session and can switch sessions with their
    existing WebRTC connection
  * api-change:``mediaconnect``: This release adds support for selecting a maintenance window.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1651060800">- Update to 1.25.1
  * api-change:``lightsail``: This release adds support for Lightsail load balancer HTTP to HTTPS
    redirect and TLS policy configuration.
  * api-change:``sagemaker``: SageMaker Inference Recommender now accepts customer KMS key ID for
    encryption of endpoints and compilation outputs created during inference recommendation.
  * api-change:``pricing``: Documentation updates for Price List API
  * api-change:``glue``: This release adds documentation for the APIs to create, read, delete, list,
    and batch read of AWS Glue custom patterns, and for Lake Formation configuration settings in the
    AWS Glue crawler.
  * api-change:``cloudfront``: CloudFront now supports the Server-Timing header in HTTP responses
    sent from CloudFront. You can use this header to view metrics that help you gain insights about the
    behavior and performance of CloudFront. To use this header, enable it in a response headers policy.
  * api-change:``ivschat``: Adds new APIs for IVS Chat, a feature for building interactive chat
    experiences alongside an IVS broadcast.
  * api-change:``network-firewall``: AWS Network Firewall now enables customers to use a customer
    managed AWS KMS key for the encryption of their firewall resources.
- from version 1.25.0
  * api-change:``gamelift``: Documentation updates for Amazon GameLift.
  * api-change:``mq``: This release adds the CRITICAL_ACTION_REQUIRED broker state and the
    ActionRequired API property. CRITICAL_ACTION_REQUIRED informs you when your broker is degraded.
    ActionRequired provides you with a code which you can use to find instructions in the Developer
    Guide on how to resolve the issue.
  * feature:IMDS: Added resiliency mechanisms to IMDS Credential Fetcher
  * api-change:``securityhub``: Security Hub now lets you opt-out of auto-enabling the defaults
    standards (CIS and FSBP) in accounts that are auto-enabled with Security Hub via Security Hub's
    integration with AWS Organizations.
  * api-change:``connect``: This release adds SearchUsers API which can be used to search for users
    with a Connect Instance
  * api-change:``rds-data``: Support to receive SQL query results in the form of a simplified JSON
    string. This enables developers using the new JSON string format to more easily convert it to an
    object using popular JSON string parsing libraries.
- from version 1.24.46
  * api-change:``chime-sdk-meetings``: Include additional exceptions types.
  * api-change:``ec2``: Adds support for waiters that automatically poll for a deleted NAT Gateway
    until it reaches the deleted state.
- from version 1.24.45
  * api-change:``wisdom``: This release updates the GetRecommendations API to include a trigger event
    list for classifying and grouping recommendations.
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``iottwinmaker``: General availability (GA) for AWS IoT TwinMaker. For more
    information, see https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/Welcome.html
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager
  * api-change:``mediatailor``: This release introduces tiered channels and adds support for live
    sources. Customers using a STANDARD channel can now create programs using live sources.
  * api-change:``storagegateway``: This release adds support for minimum of 5 character length
    virtual tape barcodes.
  * api-change:``lookoutmetrics``: Added DetectMetricSetConfig API for detecting configuration
    required for creating metric set from provided S3 data source.
  * api-change:``iotsitewise``: This release adds 3 new batch data query APIs :
    BatchGetAssetPropertyValue, BatchGetAssetPropertyValueHistory and BatchGetAssetPropertyAggregates
  * api-change:``glue``: This release adds APIs to create, read, delete, list, and batch read of Glue
    custom entity types
- from version 1.24.44
  * api-change:``macie2``: Sensitive data findings in Amazon Macie now indicate how Macie found the
    sensitive data that produced a finding (originType).
  * api-change:``rds``: Added a new cluster-level attribute to set the capacity range for Aurora
    Serverless v2 instances.
  * api-change:``mgn``: Removed required annotation from input fields in Describe operations
    requests. Added quotaValue to ServiceQuotaExceededException
  * api-change:``connect``: This release adds APIs to search, claim, release, list, update, and
    describe phone numbers. You can also use them to associate and disassociate contact flows to phone
    numbers.
- from version 1.24.43
  * api-change:``textract``: This release adds support for specifying and extracting information from
    documents using the Queries feature within Analyze Document API
  * api-change:``worklink``: Amazon WorkLink is no longer supported. This will be removed in a future
    version of the SDK.
  * api-change:``ssm``: Added offset support for specifying the number of days to wait after the date
    and time specified by a CRON expression when creating SSM association.
  * api-change:``autoscaling``: EC2 Auto Scaling now adds default instance warm-up times for all
    scaling activities, health check replacements, and other replacement events in the Auto Scaling
    instance lifecycle.
  * api-change:``personalize``: Adding StartRecommender and StopRecommender APIs for Personalize.
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Quip. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-quip.html
  * api-change:``polly``: Amazon Polly adds new Austrian German voice - Hannah. Hannah is available
    as Neural voice only.
  * api-change:``transfer``: This release contains corrected HomeDirectoryMappings examples for
    several API functions: CreateAccess, UpdateAccess, CreateUser, and UpdateUser,.
  * api-change:``kms``: Adds support for KMS keys and APIs that generate and verify HMAC codes
  * api-change:``redshift``: Introduces new fields for LogDestinationType and LogExports on
    EnableLogging requests and Enable/Disable/DescribeLogging responses. Customers can now select
    CloudWatch Logs as a destination for their Audit Logs.
- from version 1.24.42
  * api-change:``lightsail``: This release adds support to describe the synchronization status of the
    account-level block public access feature for your Amazon Lightsail buckets.
  * api-change:``rds``: Removes Amazon RDS on VMware with the deletion of APIs related to Custom
    Availability Zones and Media installation
  * api-change:``athena``: This release adds subfields, ErrorMessage, Retryable, to the AthenaError
    response object in the GetQueryExecution API when a query fails.
- from version 1.24.41
  * api-change:``batch``: Enables configuration updates for compute environments with
    BEST_FIT_PROGRESSIVE and SPOT_CAPACITY_OPTIMIZED allocation strategies.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``appstream``: Includes updates for create and update fleet APIs to manage the session
    scripts locations for Elastic fleets.
  * api-change:``glue``: Auto Scaling for Glue version 3.0 and later jobs to dynamically scale
    compute resources. This SDK change provides customers with the auto-scaled DPU usage
  * api-change:``appflow``: Enables users to pass custom token URL parameters for Oauth2
    authentication during create connector profile
- from version 1.24.40
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``fsx``: This release adds support for deploying FSx for ONTAP file systems in a
    single Availability Zone.
- from version 1.24.39
  * api-change:``ec2``: X2idn and X2iedn instances are powered by 3rd generation Intel Xeon Scalable
    processors with an all-core turbo frequency up to 3.5 GHzAmazon EC2. C6a instances are powered by
    3rd generation AMD EPYC processors.
  * api-change:``devops-guru``: This release adds new APIs DeleteInsight to deletes the insight along
    with the associated anomalies, events and recommendations.
  * api-change:``efs``: Update efs client to latest version
  * api-change:``iottwinmaker``: This release adds the following new features: 1) ListEntities API
    now supports search using ExternalId. 2) BatchPutPropertyValue and GetPropertyValueHistory API now
    allows users to represent time in sub-second level precisions.
- from version 1.24.38
  * api-change:``amplifyuibuilder``: In this release, we have added the ability to bind events to
    component level actions.
  * api-change:``apprunner``: This release adds tracing for App Runner services with X-Ray using AWS
    Distro for OpenTelemetry. New APIs: CreateObservabilityConfiguration,
    DescribeObservabilityConfiguration, ListObservabilityConfigurations, and
    DeleteObservabilityConfiguration. Updated APIs: CreateService and UpdateService.
  * api-change:``workspaces``: Added API support that allows customers to create GPU-enabled
    WorkSpaces using EC2 G4dn instances.
- from version 1.24.37
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added support for the
    pass-through of WebVTT styling to WebVTT outputs, pass-through of KLV metadata to supported
    formats, and improved filter support for processing 444/RGB content.
  * api-change:``wafv2``: Add a new CurrentDefaultVersion field to
    ListAvailableManagedRuleGroupVersions API response; add a new VersioningSupported boolean to each
    ManagedRuleGroup returned from ListAvailableManagedRuleGroups API response.
  * api-change:``mediapackage-vod``: This release adds ScteMarkersSource as an available field for
    Dash Packaging Configurations. When set to MANIFEST, MediaPackage will source the SCTE-35 markers
    from the manifest. When set to SEGMENTS, MediaPackage will source the SCTE-35 markers from the
    segments.
- from version 1.24.36
  * api-change:``apigateway``: ApiGateway CLI command get-usage now includes usagePlanId, startDate,
    and endDate fields in the output to match documentation.
  * api-change:``personalize``: This release provides tagging support in AWS Personalize.
  * api-change:``pi``: Adds support for DocumentDB to the Performance Insights API.
  * api-change:``events``: Update events client to latest version
  * api-change:``docdb``: Added support to enable/disable performance insights when creating or
    modifying db instances
  * api-change:``sagemaker``: Amazon Sagemaker Notebook Instances now supports G5 instance types
- from version 1.24.35
  * bugfix:Proxy: Fix failure case for IP proxy addresses using TLS-in-TLS. `boto/botocore#2652
    &lt;https://github.com/boto/botocore/pull/2652&gt;`__
  * api-change:``config``: Add resourceType enums for AWS::EMR::SecurityConfiguration and
    AWS::SageMaker::CodeRepository
  * api-change:``panorama``: Added Brand field to device listings.
  * api-change:``lambda``: This release adds new APIs for creating and managing Lambda Function URLs
    and adds a new FunctionUrlAuthType parameter to the AddPermission API. Customers can use Function
    URLs to create built-in HTTPS endpoints on their functions.
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Box. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-box.html
- from version 1.24.34
  * api-change:``securityhub``: Added additional ASFF details for RdsSecurityGroup AutoScalingGroup,
    ElbLoadBalancer, CodeBuildProject and RedshiftCluster.
  * api-change:``fsx``: Provide customers more visibility into file system status by adding new
    "Misconfigured Unavailable" status for Amazon FSx for Windows File Server.
  * api-change:``s3control``: Documentation-only update for doc bug fixes for the S3 Control API docs.
  * api-change:``datasync``: AWS DataSync now supports Amazon FSx for OpenZFS locations.
- from version 1.24.33
  * api-change:``iot``: AWS IoT - AWS IoT Device Defender adds support to list metric datapoints
    collected for IoT devices through the ListMetricValues API
  * api-change:``servicecatalog``: This release adds ProvisioningArtifictOutputKeys to
    DescribeProvisioningParameters to reference the outputs of a Provisioned Product and deprecates
    ProvisioningArtifactOutputs.
  * api-change:``sms``: Revised product update notice for SMS console deprecation.
  * api-change:``proton``: SDK release to support tagging for AWS Proton Repository resource
  * enhancement:AWSCRT: Upgrade awscrt version to 0.13.8</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652270400">- Update to 1.25.11
  * api-change:``migration-hub-refactor-spaces``: AWS Migration Hub Refactor Spaces documentation
    only update to fix a formatting issue.
  * api-change:``ec2``: Added support for using NitroTPM and UEFI Secure Boot on EC2 instances.
  * api-change:``emr``: Update emr client to latest version
  * api-change:``compute-optimizer``: Documentation updates for Compute Optimizer
  * api-change:``eks``: Adds BOTTLEROCKET_ARM_64_NVIDIA and BOTTLEROCKET_x86_64_NVIDIA AMI types to
    EKS managed nodegroups
- from version 1.25.10
  * api-change:``evidently``: Add detail message inside GetExperimentResults API response to indicate
    experiment result availability
  * api-change:``ssm-contacts``: Fixed an error in the DescribeEngagement example for AWS Incident
    Manager.
  * api-change:``cloudcontrol``: SDK release for Cloud Control API to include paginators for Python
    SDK.
- from version 1.25.9
  * api-change:``rds``: Various documentation improvements.
  * api-change:``redshift``: Introduces new field 'LoadSampleData' in CreateCluster operation.
    Customers can now specify 'LoadSampleData' option during creation of a cluster, which results in
    loading of sample data in the cluster that is created.
  * api-change:``ec2``: Add new state values for IPAMs, IPAM Scopes, and IPAM Pools.
  * api-change:``mediapackage``: This release adds Dvb Dash 2014 as an available profile option for
    Dash Origin Endpoints.
  * api-change:``securityhub``: Documentation updates for Security Hub API reference
  * api-change:``location``: Amazon Location Service now includes a MaxResults parameter for
    ListGeofences requests.
- from version 1.25.8
  * api-change:``ec2``: Amazon EC2 I4i instances are powered by 3rd generation Intel Xeon Scalable
    processors and feature up to 30 TB of local AWS Nitro SSD storage
  * api-change:``kendra``: AWS Kendra now supports hierarchical facets for a query. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/filtering.html
  * api-change:``iot``: AWS IoT Jobs now allows you to create up to 100,000 active continuous and
    snapshot jobs by using concurrency control.
  * api-change:``datasync``: AWS DataSync now supports a new ObjectTags Task API option that can be
    used to control whether Object Tags are transferred.
- from version 1.25.7
  * api-change:``ssm``: This release adds the TargetMaps parameter in SSM State Manager API.
  * api-change:``backup``: Adds support to 2 new filters about job complete time for 3 list jobs APIs
    in AWS Backup
  * api-change:``lightsail``: Documentation updates for Lightsail
  * api-change:``iotsecuretunneling``: This release introduces a new API RotateTunnelAccessToken that
    allow revoking the existing tokens and generate new tokens
- from version 1.25.6
  * api-change:``ec2``: Adds support for allocating Dedicated Hosts on AWS  Outposts. The
    AllocateHosts API now accepts an OutpostArn request  parameter, and the DescribeHosts API now
    includes an OutpostArn response parameter.
  * api-change:``s3``: Documentation only update for doc bug fixes for the S3 API docs.
  * api-change:``kinesisvideo``: Add support for multiple image feature related APIs for configuring
    image generation and notification of a video stream. Add "GET_IMAGES" to the list of supported API
    names for the GetDataEndpoint API.
  * api-change:``sagemaker``: SageMaker Autopilot adds new metrics for all candidate models generated
    by Autopilot experiments; RStudio on SageMaker now allows users to bring your own development
    environment in a custom image.
  * api-change:``kinesis-video-archived-media``: Add support for GetImages API  for retrieving images
    from a video stream
- from version 1.25.5
  * api-change:``organizations``: This release adds the INVALID_PAYMENT_INSTRUMENT as a fail reason
    and an error message.
  * api-change:``synthetics``: CloudWatch Synthetics has introduced a new feature to provide
    customers with an option to delete the underlying resources that Synthetics canary creates when the
    user chooses to delete the canary.
  * api-change:``outposts``: This release adds a new API called ListAssets to the Outposts SDK, which
    lists the hardware assets in an Outpost.
- from version 1.25.4
  * api-change:``rds``: Feature - Adds support for Internet Protocol Version 6 (IPv6) on RDS database
    instances.
  * api-change:``codeguru-reviewer``: Amazon CodeGuru Reviewer now supports suppressing
    recommendations from being generated on specific files and directories.
  * api-change:``ssm``: Update the StartChangeRequestExecution, adding TargetMaps to the Runbook
    parameter
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK nows supports creation of Dolby
    Vision profile 8.1, the ability to generate black frames of video, and introduces audio-only DASH
    and CMAF support.
  * api-change:``wafv2``: You can now inspect all request headers and all cookies. You can now
    specify how to handle oversize body contents in your rules that inspect the body.
- from version 1.25.3
  * api-change:``auditmanager``: This release adds documentation updates for Audit Manager. We
    provided examples of how to use the Custom_ prefix for the keywordValue attribute. We also provided
    more details about the DeleteAssessmentReport operation.
  * api-change:``network-firewall``: AWS Network Firewall adds support for stateful threat signature
    AWS managed rule groups.
  * api-change:``ec2``: This release adds support to query the public key and creation date of EC2
    Key Pairs. Additionally, the format (pem or ppk) of a key pair can be specified when creating a new
    key pair.
  * api-change:``braket``: This release enables Braket Hybrid Jobs with Embedded Simulators to have
    multiple instances.
  * api-change:``guardduty``: Documentation update for API description.
  * api-change:``connect``: This release introduces an API for changing the current agent status of a
    user in Connect.
- from version 1.25.2
  * api-change:``rekognition``: This release adds support to configure stream-processor resources for
    label detections on streaming-videos. UpateStreamProcessor API is also launched with this release,
    which could be used to update an existing stream-processor.
  * api-change:``cloudtrail``: Increases the retention period maximum to 2557 days. Deprecates unused
    fields of the ListEventDataStores API response. Updates documentation.
  * api-change:``lookoutequipment``: This release adds the following new features: 1) Introduces an
    option for automatic schema creation 2) Now allows for Ingestion of data containing most common
    errors and allows automatic data cleaning 3) Introduces new API ListSensorStatistics that gives
    further information about the ingested data
  * api-change:``iotwireless``: Add list support for event configurations, allow to get and update
    event configurations by resource type, support LoRaWAN events; Make NetworkAnalyzerConfiguration as
    a resource, add List, Create, Delete API support; Add FCntStart attribute support for ABP
    WirelessDevice.
  * api-change:``amplify``: Documentation only update to support the Amplify GitHub App feature launch
  * api-change:``chime-sdk-media-pipelines``: For Amazon Chime SDK meetings, the Amazon Chime Media
    Pipelines SDK allows builders to capture audio, video, and content share streams. You can also
    capture meeting events, live transcripts, and data messages. The pipelines save the artifacts to an
    Amazon S3 bucket that you designate.
  * api-change:``sagemaker``: Amazon SageMaker Autopilot adds support for custom validation dataset
    and validation ratio through the CreateAutoMLJob and DescribeAutoMLJob APIs.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652788800">- Update to 1.26.1
  * api-change:``resiliencehub``: In this release, we are introducing support for Amazon Elastic
    Container Service, Amazon Route 53, AWS Elastic Disaster Recovery, AWS Backup in addition to the
    existing supported Services.  This release also supports Terraform file input from S3 and
    scheduling daily assessments
  * api-change:``servicecatalog``: Updated the descriptions for the ListAcceptedPortfolioShares API
    description and the PortfolioShareType parameters.
  * api-change:``discovery``: Add Migration Evaluator Collector details to the GetDiscoverySummary
    API response
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``workspaces-web``: Amazon WorkSpaces Web now supports Administrator timeout control
  * api-change:``rekognition``: Documentation updates for Amazon Rekognition.
  * api-change:``cloudfront``: Introduced a new error (TooLongCSPInResponseHeadersPolicy) that is
    returned when the value of the Content-Security-Policy header in a response headers policy exceeds
    the maximum allowed length.
- from version 1.26.0
  * feature:Loaders: Support for loading gzip compressed model files.
  * api-change:``grafana``: This release adds APIs for creating and deleting API keys in an Amazon
    Managed Grafana workspace.
- from version 1.25.13
  * api-change:``ivschat``: Documentation-only updates for IVS Chat API Reference.
  * api-change:``lambda``: Lambda releases NodeJs 16 managed runtime to be available in all
    commercial regions.
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Jira. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-jira.html
  * api-change:``transfer``: AWS Transfer Family now accepts ECDSA keys for server host keys
  * api-change:``iot``: Documentation update for China region ListMetricValues for IoT
  * api-change:``workspaces``: Increased the character limit of the login message from 600 to 850
    characters.
  * api-change:``finspace-data``: We've now deprecated CreateSnapshot permission for creating a data
    view, instead use CreateDataView permission.
  * api-change:``lightsail``: This release adds support to include inactive database bundles in the
    response of the GetRelationalDatabaseBundles request.
  * api-change:``outposts``: Documentation updates for AWS Outposts.
  * api-change:``ec2``: This release introduces a target type Gateway Load Balancer Endpoint for
    mirrored traffic. Customers can now specify GatewayLoadBalancerEndpoint option during the creation
    of a traffic mirror target.
  * api-change:``ssm-incidents``: Adding support for dynamic SSM Runbook parameter values. Updating
    validation pattern for engagements. Adding ConflictException to UpdateReplicationSet API contract.
- from version 1.25.12
  * api-change:``secretsmanager``: Doc only update for Secrets Manager that fixes several
    customer-reported issues.
  * api-change:``ec2``: This release updates AWS PrivateLink APIs to support IPv6 for PrivateLink
    Services and Endpoints of type 'Interface'.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1653048000">- Update to 1.26.4 (bsc#1199716)
  * api-change:``gamesparks``: This release adds an optional DeploymentResult field in the responses
    of GetStageDeploymentIntegrationTests and ListStageDeploymentIntegrationTests APIs.
  * enhancement:StreamingBody: Allow StreamingBody to be used as a context manager
  * api-change:``lookoutmetrics``: In this release we added SnsFormat to SNSConfiguration to support
    human readable alert.
- from version 1.26.3
  * api-change:``greengrassv2``: This release adds the new DeleteDeployment API operation that you
    can use to delete deployment resources. This release also adds support for discontinued
    AWS-provided components, so AWS can communicate when a component has any issues that you should
    consider before you deploy it.
  * api-change:``quicksight``: API UpdatePublicSharingSettings enables IAM admins to enable/disable
    account level setting for public access of dashboards. When enabled, owners/co-owners for
    dashboards can enable public access on their dashboards. These dashboards can only be accessed
    through share link or embedding.
  * api-change:``appmesh``: This release updates the existing Create and Update APIs for meshes and
    virtual nodes by adding a new IP preference field. This new IP preference field can be used to
    control the IP versions being used with the mesh and allows for IPv6 support within App Mesh.
  * api-change:``batch``: Documentation updates for AWS Batch.
  * api-change:``iotevents-data``: Introducing new API for deleting detectors: BatchDeleteDetector.
  * api-change:``transfer``: AWS Transfer Family now supports SetStat server configuration option,
    which provides the ability to ignore SetStat command issued by file transfer clients, enabling
    customers to upload files without any errors.
- from version 1.26.2
  * api-change:``kms``: Add HMAC best practice tip, annual rotation of AWS managed keys.
  * api-change:``glue``: This release adds a new optional parameter called codeGenNodeConfiguration
    to CRUD job APIs that allows users to manage visual jobs via APIs. The updated CreateJob and
    UpdateJob will create jobs that can be viewed in Glue Studio as a visual graph. GetJob can be used
    to get codeGenNodeConfiguration.</changelog>
</package>
<package pkgid="52eecdb1879185f28b5559d004ba6507c3bf77ac6836cc32a00707d5d3936047" name="python-certifi" arch="src">
  <version epoch="0" ver="2018.1.18" rel="150000.3.3.1"/>
  <changelog author="mcihar@suse.cz" date="1429704000">- Initial packaging</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443268800">- Update to version 2015.9.6.2:
  * Actually ship weak cert bundle.
  * Provide old cert bundle.
  * Use secure roots by default.
  * Update scripts to use mkcert.org
  * Concatenate the two roots
  * Add the needed 1024-bit roots
  * Move mkcert output to non-core file
- Fix dependencies on SLES 11
- Certifi is released under MPL-2.0; fix the license tag
- Rebase python-certifi-shipped-requests-cabundle.patch</changelog>
  <changelog author="michael@stroeder.com" date="1453464000">- Update to version 2015.11.20.1</changelog>
  <changelog author="jacobwinski@gmail.com" date="1464955200">- Update to version 2016.2.28
- Update copyright year in spec file
- Fix executable warning (fix taken from python3-certifi)</changelog>
  <changelog author="aloisio@gmx.com" date="1491652800">- Updated to version 2017.1.23
- Converted to single-spec
- Updated source URL</changelog>
  <changelog author="dmueller@suse.com" date="1497096000">- update to 2017.4.17</changelog>
  <changelog author="dmueller@suse.com" date="1497182400">- require ca-certificates-mozilla, otherwise certifi does not
  provide any ca bundle (the bundled one that openSUSE patches
  out is the mozilla bundle as well)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1499688000">- Fix wrong-script-interpreter rpmlint error.
- Fix script-without-shebang rpmlint warning.</changelog>
  <changelog author="arun@gmx.de" date="1507032000">- updated patch
- update to version 2017.7.27.1:
  * Use a more expressive API for getting the dir a path is in
  * set zip_safe=False to help out setuptools (#63)
  * Change license from ISC to MPL-2.0 in setup.py
  * Add trove classifiers for missing supported Python versions
  * Rename [wheel] section to [bdist_wheel] as the former is legacy</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1507809600">- add patch to fix version string from 2017.07.27.1 to
  2017.7.27.1 to fix the build on SLE12_SP3 and earlier
  + python-certifi-fix-version-string.patch</changelog>
  <changelog author="jmatejek@suse.com" date="1508328000">- fix macros to support not having python2</changelog>
  <changelog author="dmueller@suse.com" date="1510660800">- update to 2017.11.5:
  * Sync with bundle mozilla release
- remove  python-certifi-fix-version-string.patch: obsolete</changelog>
  <changelog author="arun@gmx.de" date="1517745600">- specfile:
  * update copyright year
- update to version 2018.1.18:
  * Remove 1024-bit root certificates
  * Include license in the list of trove classifiers
  * Include license file in the generated wheel package</changelog>
  <changelog author="dbenini@suse.com" date="1672488000">- remove all TrustCor CAs, as TrustCor issued multiple man-in-the-middle
  certs (bsc#1206212 CVE-2022-23491)
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
- Add removeTrustCor.patch</changelog>
</package>
<package pkgid="83a2eea93f7f5a6649499b9c5542e7c9d129428c5f4c088b9c106b21a10f43ed" name="python-cryptography" arch="src">
  <version epoch="0" ver="2.9.2" rel="150200.13.1"/>
  <changelog author="tchvatal@suse.com" date="1522065600">- Cleanup with spec-cleaner
- Use %setup to unpack all archives do not rely on tar calls</changelog>
  <changelog author="mimi.vx@gmail.com" date="1528804800">- update to 2.2.2
  * fix build on some systems with openssl 1.1.0h</changelog>
  <changelog author="michael@stroeder.com" date="1531915200">- update to 2.3:
  * SECURITY ISSUE: finalize_with_tag() allowed tag truncation by default
    which can allow tag forgery in some cases. The method now enforces the
    min_tag_length provided to the GCM constructor.
  * Added support for Python 3.7.
  * Added extract_timestamp() to get the authenticated timestamp of a Fernet token.
  * Support for Python 2.7.x without hmac.compare_digest has been deprecated.
    We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next
    cryptography release.
  * Fixed multiple issues preventing cryptography from compiling
    against LibreSSL 2.7.x.
  * Added get_revoked_certificate_by_serial_number for quick
    serial number searches in CRLs.
  * The RelativeDistinguishedName class now preserves the order of attributes.
    Duplicate attributes now raise an error instead of silently discarding duplicates.
  * aes_key_unwrap() and aes_key_unwrap_with_padding() now raise InvalidUnwrap
    if the wrapped key is an invalid length, instead of ValueError.</changelog>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="mcepl@suse.com" date="1536321600">- bsc#1101820 CVE-2018-10903 GCM tag forgery via truncated tag in
  finalize_with_tag API
  * add disallow_implicit_tag_truncation.patch from
    https://github.com/pyca/cryptography/commit/688e0f673bfb.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="mcepl@suse.com" date="1569326400">- Add openSSL_111d.patch to make this version of the package
  compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mcepl@suse.com" date="1606737600">- Add 5507-mitigate-Bleichenbacher-attacks.patch (bsc#1178168,
  CVE-2020-25659).</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1614168000">- Add patch CVE-2020-36242-buffer-overflow.patch (bsc#1182066, CVE-2020-36242)
  * Using the Fernet class to symmetrically encrypt multi gigabyte values
    could result in an integer overflow and buffer overflow.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623758400">- Refresh patches for new version
  + 5507-mitigate-Bleichenbacher-attacks.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)</changelog>
</package>
<package pkgid="40b14dbd192bbcbb4d3409f65ee4cc1cbf3b4fd99e10154b423ebb416101d7b8" name="python-cryptography" arch="src">
  <version epoch="0" ver="3.3.2" rel="150200.16.1"/>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="mcepl@suse.com" date="1569326400">- Add openSSL_111d.patch to make this version of the package
  compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL?s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1606737600">- Add 5507-mitigate-Bleichenbacher-attacks.patch (bsc#1178168,
  CVE-2020-25659).</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="steven.kowalik@suse.com" date="1614168000">- Add patch CVE-2020-36242-buffer-overflow.patch (bsc#1182066, CVE-2020-36242)
  * Using the Fernet class to symmetrically encrypt multi gigabyte values
    could result in an integer overflow and buffer overflow.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623758400">- Refresh patches for new version
  + 5507-mitigate-Bleichenbacher-attacks.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1658404800">- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)</changelog>
</package>
<package pkgid="8c1f1580ea91367b5c3defcc531aced843c5557429371c1e6b1a74b13d83650a" name="python-future" arch="src">
  <version epoch="0" ver="0.18.2" rel="150300.3.3.1"/>
  <changelog author="glin@suse.com" date="1450094400">- initial import: 0.15.2 (fate#320644)</changelog>
  <changelog author="glin@suse.com" date="1473422400">- Remove %ghost from %{_bindir}/futurize and %{_bindir}/pasteurize
  (fate#320644)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1473940800">- Fix update-alternatives usage.</changelog>
  <changelog author="okurz@suse.com" date="1474459200">- Fix rpm uninstall warnings by removing alternatives in postun as
  discussed in https://build.opensuse.org/request/show/427095</changelog>
  <changelog author="ms@suse.com" date="1476187200">- Tracker changelog entry to add python-future to SLE12 (bnc#999200)</changelog>
  <changelog author="mimi.vx@gmail.com" date="1480075200">- update to 0.16.0
  * Fix newbytes constructor bug.
  * Fix semantics of bool() with newobject.
  * Fix standard_library.install_aliases() on PyPy
  * Fix assertRaises for pow and compile` on Python 3.5.
  * Fix return argument of future.utils.ensure_new_type
  if conversion to new type does not exist.
  * Add missing cmp_to_key for Py2.6.
  * Allow the old_div fixer to be disabled.
  * Improve compatibility with Google App Engine.
  * Add some missing imports to the tkinter and tkinter.filedialog
  package namespaces
  * Fix raise_from on PY3 when the exception cannot be recreated from its repr.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491480000">- Implement single-spec version</changelog>
  <changelog author="toddrme2178@gmail.com" date="1542369600">- Update to version 0.17.1
  * This release address a packaging error because of an erroneous declaration that
    any built wheels are universal.
- Update to version 0.17.0
  * Fix ``from collections import ChainMap`` after install_aliases() (issue #226)
  * Fix multiple import from ``__future__`` bug in futurize (issue #113)
  * Add support for proper %s formatting of newbytes
  * Properly implement iterator protocol for newrange object
  * Fix ``past.translation`` on read-only file systems
  * Fix Tkinter import bug introduced in Python 2.7.4 (issue #262)
  * Correct TypeError to ValueError in a specific edge case for newrange
  * Support inequality tests betwen newstrs and newbytes
  * Add type check to __get__ in newsuper
  * Fix fix_divsion_safe to support better conversion of complex expressions, and
    skip obvious float division.</changelog>
  <changelog author="mcepl@suse.com" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="jayvdb@gmail.com" date="1552305600">- Activate test suite</changelog>
  <changelog author="jayvdb@gmail.com" date="1557230400">- Change License from MIT to MIT and Python-2.0</changelog>
  <changelog author="mcepl@suse.com" date="1570017600">- Add python38-compat.patch to fix compatibility with Python 3.8
  gh#PythonCharmers/python-future#447
- Add python38-pow.patch not to expect exception on new available
  parameters for Python 3.8. gh#PythonCharmers/python-future#474</changelog>
  <changelog author="steven.kowalik@suse.com" date="1571054400">- Update to 0.18.0.
- Remove python38-compat.patch, already included.
- Add future-correct-mimetype.patch, since Python 3.8 is able to detect
  the MIME type now.</changelog>
  <changelog author="mcepl@suse.com" date="1575547200">- Update to 0.18.2:
  - Fix min/max functions with generators, and 'None' default (PR #514)
  - Use BaseException in raise_() (PR #515)
  - Fix builtins.round() for Decimals (Issue #501)
  - Fix raise_from() to prevent failures with immutable classes (PR #518)
  - Make FixInput idempotent (Issue #427)
  - Fix type in newround (PR #521)
  - Support mimetype guessing in urllib2 for Py3.8+ (Issue #508)
  - fix for raise_() when passed an exception that's not an
    Exception (e.g. BaseException subclasses)
- Rebase future-correct-mimetype.patch to revert incorrect fix in
  gh#PythonCharmers/python-future#508</changelog>
  <changelog author="daniel.garcia@suse.com" date="1672920000">- Add CVE-2022-40899.patch to fix REDoS in http.cookiejar
  gh#PythonCharmers/python-future#610
  bsc#1206673</changelog>
</package>
<package pkgid="064dc3c54e98a8bef86cf89de8912ffa60e0e8807639dcbb3f6fa00f189ca43d" name="python-kiwi" arch="src">
  <version epoch="0" ver="9.24.36" rel="150100.3.53.2"/>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
</package>
<package pkgid="6aad79326d9b9d15afabacc63acf076f01c77d28a804b12b190cf69635ba2822" name="python-kiwi" arch="src">
  <version epoch="0" ver="9.24.43" rel="150100.3.56.3"/>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 ? 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 ? 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 ? 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
</package>
<package pkgid="d0de773183b894e34336e52d02a401233ccb6422814999124ed5f692827da3c6" name="python-libxml2-python" arch="src">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="mgorse@suse.com" date="1548676800">- Add libxml2-python3-string-null-check.patch: fix NULL pointer
    dereference when parsing invalid data (bsc#1065270
    glgo#libxml2!15).).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
- Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="bf5c9cdbe45d9c9a3f3eb316a9e7955d60baa5a7afa1a84741608c39c779c732" name="python-libxml2-python" arch="src">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="mgorse@suse.com" date="1548676800">- Add libxml2-python3-string-null-check.patch: fix NULL pointer
    dereference when parsing invalid data (bsc#1065270
    glgo#libxml2!15).).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
- Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="476817cda7e65a1fe3f61df542a7c95131250475f67b504a313500f284aae174" name="python-msgpack" arch="src">
  <version epoch="0" ver="0.5.6" rel="150100.3.3.1"/>
  <changelog author="alexandre@exatati.com.br" date="1356177600">- Update to 0.2.4:
  - Fix SEGV when object_hook or object_pairs_hook raise Exception. (#39)</changelog>
  <changelog author="p.drouand@gmail.com" date="1357905600">- Initial python3 support</changelog>
  <changelog author="saschpe@suse.de" date="1358164800">- Simplify macro usage</changelog>
  <changelog author="alexandre@exatati.com.br" date="1361188800">- Update to 0.3.0:
  Incompatible Changes
  - Default value of use_list is True for now. (It was False for
    0.2.x) You should pass it explicitly for compatibility to 0.2.x.
  Changes
  - Pure Python fallback module is added. (thanks to bwesterb)
  - Add .skip() method to Unpacker (thanks to jnothman)
  - Add capturing feature. You can pass the writable object to
    Unpacker.unpack() as a second parameter.
  - Add Packer.pack_array_header and Packer.pack_map_header. These
    methods only pack header of each type.
  - Add autoreset option to Packer (default: True). Packer doesn't
    return packed bytes and clear internal buffer.
  - Add Packer.pack_map_pairs. It packs sequence of pair to map type.</changelog>
  <changelog author="speilicke@suse.com" date="1367496000">- Package COPYING and README.rst
- Run testsuite</changelog>
  <changelog author="speilicke@suse.com" date="1382616000">- Require python-setuptools instead of distribute (upstreams merged)</changelog>
  <changelog author="p.drouand@gmail.com" date="1386504000">- Update to version 0.4.0
  + Raises TypeError instead of ValueError when packer receives
    unsupported type.
  + Support New msgpack spec.
- Use download Url as source
- Add python-argparse requirement for SLE11SP3 to get tests working</changelog>
  <changelog author="toddrme2178@gmail.com" date="1416312000">- Update to 0.4.2
  Bugfixes
  - Unpacker doesn't increment refcount of ExtType hook.
  - Packer raises no exception for inputs doesn't fit to msgpack format.
- Update to 0.4.1
  Changes
  - fallback.Unpacker.feed() supports bytearray.
  Bugs fixed
  - Unpacker doesn't increment refcount of hooks. Hooks may be GCed while unpacking.
  - Unpacker may read unfilled internal buffer.</changelog>
  <changelog author="hpj@urpla.net" date="1426507200">- Update to version 0.4.6
  * fallback.Unpacker: Fix Data corruption when OutOfData. This bug
    only affects "Streaming unpacking."
- Changes from version 0.4.5
  * Fix test failure on pytest 2.3.
  * Fix typos in ChangeLog.
  * Improve README.rst
- Changes from version 0.4.4
  * Fix compile error.
- Changes from version 0.4.3
  * Unpacker may unpack wrong uint32 value on 32bit or LLP64
    environment. (#101)
  * Build failed on Windows Python 2.7.</changelog>
  <changelog author="mc@suse.com" date="1445083200">- build conditionally without tests</changelog>
  <changelog author="dmueller@suse.com" date="1479211200">- update to 0.4.8</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492603200">- Implement single-spec version.</changelog>
  <changelog author="dmueller@suse.com" date="1517054400">- update to 0.5.1:
  * Package name on PyPI was changed to msgpack from 0.5.
- rename from msgpack-python</changelog>
  <changelog author="jengelh@inai.de" date="1517313600">- Strip rheotrics from descriptions.</changelog>
  <changelog author="tbechtold@suse.com" date="1517918400">- update to version 0.5.4
  * packer: Use PyUnicode_AsUTF8AndSize() for utf-8 (#272)
  * Fix encoding and unicode_errors (#277)
  * Undeprecate unicode_errors (#278)
  * Packer.pack() reset buffer on exception (#274)
  * Use cython's cast for converting encoding and errors (#279)
  * 0.5.4
  * Add raw_as_bytes option to Unpacker. (#265)
  * s/raw_as_bytes/raw/g (#276)</changelog>
  <changelog author="dmueller@suse.com" date="1518436800">- fix typo in obsoletes</changelog>
  <changelog author="alarrosa@suse.com" date="1519646400">- Provide also python-msgpack-python in the python2 package to
  be able to obsolete the python2-msgpack-python package correctly.</changelog>
  <changelog author="alarrosa@suse.com" date="1519905600">- Update to version 0.5.6 (boo#1123558)
  * Fix fallback.Unpacker.feed() dropped unused data from buffer
  * Resurrect fallback.unpack() and _unpacker.unpack(). They were
    removed at 0.5.5 but it breaks backward compatibility.
- Update to version 0.5.5
  * Fix memory leak in pure Python Unpacker.feed()
  * Fix unpack() didn't support raw option</changelog>
  <changelog author="alarrosa@suse.com" date="1548763200">- Use %license</changelog>
  <changelog author="mcepl@suse.com" date="1664280000">- Loose the filelist for the package info to avoid FTBFS on
  SLE-15-SP5 (bsc#1203743).</changelog>
</package>
<package pkgid="eac47a6a7c5b545d366d8f8745e15e2cbca03bfe3faaf4c31d55221acdf560c9" name="python-psutil" arch="src">
  <version epoch="0" ver="5.8.0" rel="150300.3.3.2"/>
  <changelog author="arun@gmx.de" date="1550318400">- update to version 5.5.1:
  * Enhancements
    + 1348: [Windows] on Windows &gt;= 8.1 if Process.cmdline() fails due
    to ERROR_ACCESS_DENIED attempt using NtQueryInformationProcess +
    ProcessCommandLineInformation. (patch by EccoTheFlintstone)
  * Bug fixes
    + 1394: [Windows] Process.exe() returns "[Error 0] The operation
    completed successfully" when Python process runs in "Virtual
    Secure Mode".
    + 1402: psutil exceptions' repr() show the internal private module
    path.
    + 1408: [AIX] psutil won't compile on AIX 7.1 due to missing
    header. (patch by Arnon Yaari)</changelog>
  <changelog author="arun@gmx.de" date="1552132800">- update to version 5.6.0:
  * Enhancements
    + 1379: [Windows] Process suspend() and resume() now use
    NtSuspendProcess and NtResumeProcess instead of
    stopping/resuming all threads of a process. This is faster and
    more reliable (aka this is what ProcessHacker does).
    + 1420: [Windows] in case of exception disk_usage() now also shows
    the path name.
    + 1422: [Windows] Windows APIs requiring to be dynamically loaded
    from DLL libraries are now loaded only once on startup (instead
    of on per function call) significantly speeding up different
    functions and methods.
    + 1426: [Windows] PAGESIZE and number of processors is now
    calculated on startup.
    + 1428: in case of error, the traceback message now shows the
    underlying C function called which failed.
    + 1433: new Process.parents() method. (idea by Ghislain Le Meur)
    + 1437: pids() are returned in sorted order.
    + 1442: python3 is now the default interpreter used by Makefile.
  * Bug fixes
    + 1353: process_iter() is now thread safe (it rarely raised
    TypeError).
    + 1394: [Windows] Process name() and exe() may erroneously return
    "Registry". QueryFullProcessImageNameW is now used instead of
    GetProcessImageFileNameW in order to prevent that.
    + 1411: [BSD] lack of Py_DECREF could cause segmentation fault on
    process instantiation.
    + 1419: [Windows] Process.environ() raises NotImplementedError
    when querying a 64-bit process in 32-bit-WoW mode. Now it raises
    AccessDenied.
    + 1427: [OSX] Process cmdline() and environ() may erroneously
    raise OSError on failed malloc().
    + 1429: [Windows] SE DEBUG was not properly set for current
    process. It is now, and it should result in less AccessDenied
    exceptions for low-pid processes.
    + 1432: [Windows] Process.memory_info_ex()'s USS memory is
    miscalculated because we're not using the actual system
    PAGESIZE.
    + 1439: [NetBSD] Process.connections() may return incomplete
    results if using oneshot().
    + 1447: original exception wasn't turned into NSP/AD exceptions
    when using Process.oneshot() ctx manager.
  * Incompatible API changes
    + 1291: [OSX] Process.memory_maps() was removed because inherently
    broken (segfault) for years.</changelog>
  <changelog author="jayvdb@gmail.com" date="1552910400">- Active test suite, using skip-test-missing-warnings.patch to
  explicitly skip 2 tests regarding warnings, skip-flaky-i586.patch
  to skip a flaky i586 test, and setting TRAVIS to skip tests which
  upstream doesnt run in their CI
- Add upstream pr_1364.patch to fix reading /sys/blocks on Linux 4.18+
- Remove tests from installed package
- Use URL https://github.com/giampaolo/psutil
- Use LANG=en_US.UTF-8 in %check to avoid failure in test_pmap
- update to version 5.6.1
  * No changes effecting Linux
  * Many checks added to tests to skip tests for missing features</changelog>
  <changelog author="tchvatal@suse.com" date="1558785600">- Update to 5.6.2:
  * 1404: [Linux] cpu_count(logical=False) uses a second method (read from /sys/devices/system/cpu/cpu[0-9]/topology/core_id) in order to determine the number of physical CPUs in case /proc/cpuinfo does not provide this info.
  * 1458: provide coloured test output. Also show failures on KeyboardInterrupt.
  * 1464: various docfixes (always point to python3 doc, fix links, etc.).
  * 1478: add make command to re-run tests failed on last run.
  * 1456: [Linux] cpu_freq() returns None instead of 0.0 when min/max not available (patch by Alex Manuskin)
  * 1462: [Linux] (tests) make tests invariant to LANG setting (patch by Benjamin Drung)
  * 1463: cpu_distribution.py script was broken.
  * 1470: [Linux] disk_partitions(): fix corner case when /etc/mtab doesn't exist. (patch by Cedric Lamoriniere)
  * 1472: [Linux] cpu_freq() does not return all CPUs on Rasbperry-pi 3.
  * 1493: [Linux] cpu_freq(): handle the case where /sys/devices/system/cpu/cpufreq/ exists but is empty.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 5.6.3:
  * 1494: [AIX] added support for Process.environ(). (patch by Arnon Yaari)
  * 1276: [AIX] can't get whole cmdline(). (patch by Arnon Yaari)
  * 1501_: [Windows] Process cmdline() and exe() raise unhandled "WinError 1168 element not found" exceptions for "Registry" and "Memory Compression" psuedo processes on Windows 10.
  * 1526_: [NetBSD] process cmdline() could raise MemoryError. (patch by Kamil Rytarowski)</changelog>
  <changelog author="tchvatal@suse.com" date="1568116800">- Add patch to skip more tests that won't work in OBS:
  * skip-obs.patch</changelog>
  <changelog author="arun@gmx.de" date="1573300800">- update to version 5.6.5:
  * Bug fixes
    + 1615: remove pyproject.toml as it was causing installation
    issues.
- changes from version 5.6.4:
  * Enhancements
    + 1527: [Linux] added Process.cpu_times().iowait counter, which is
    the time spent waiting for blocking I/O to complete.
    + 1565: add PEP 517/8 build backend and requirements specification
    for better pip integration. (patch by Bernát Gábor)
  * Bug fixes
    + 875: [Windows] Process' cmdline(), environ() or cwd() may
    occasionally fail with ERROR_PARTIAL_COPY which now gets
    translated to AccessDenied.
    + 1126: [Linux] cpu_affinity() segfaults on CentOS 5 /
    manylinux. cpu_affinity() support for CentOS 5 was removed.
    + 1528: [AIX] compilation error on AIX 7.2 due to 32 vs 64 bit
    differences. (patch by Arnon Yaari)
    + 1535: 'type' and 'family' fields returned by net_connections()
    are not always turned into enums.
    + 1536: [NetBSD] process cmdline() erroneously raise ZombieProcess
    error if cmdline has non encodable chars.
    + 1546: usage percent may be rounded to 0 on Python 2.
    + 1552: [Windows] getloadavg() math for calculating 5 and 15 mins
    values is incorrect.
    + 1568: [Linux] use CC compiler env var if defined.
    + 1570: [Windows] NtWow64* syscalls fail to raise the proper error
    code
    + 1585: [OSX] calling close() (in C) on possible negative
    integers. (patch by Athos Ribeiro)
    + 1606: [SunOS] compilation fails on SunOS 5.10. (patch by vser1)</changelog>
  <changelog author="arun@gmx.de" date="1574942400">- update to version 5.6.7:
  * Bug fixes
    + 1630: [Windows] can't compile source distribution due to C
    syntax error.
- changes from version 5.6.6:
  * Bug fixes
    + 1179: [Linux] Process cmdline() now takes into account
    misbehaving processes renaming the command line and using
    inappropriate chars to separate args.
    + 1616: use of Py_DECREF instead of Py_CLEAR will result in double
    free and segfault (CVE). (patch by Riccardo Schirone)
    + 1619: [OpenBSD] compilation fails due to C syntax error. (patch
    by Nathan Houghton)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Add pr_1665.patch: Future-proof disk_io_counters on Linux. Fixes
  tests with Linux 5.5.</changelog>
  <changelog author="tchvatal@suse.com" date="1584187200">- Update to 5.7.0:
  * Various fixes to build with updated kernel/etc.
- Remove merged patch pr_1665.patch and pr_1364.patch
- Update patch skip-obs.patch
- Remove skip-test-missing-warnings.patch as it can be fixed by
  properly calling the tests</changelog>
  <changelog author="mcepl@suse.com" date="1598011200">- Add skip_failing_tests.patch to skip tests failing because of
  incomplete emulation of the environment in osc build
  environment (gh#giampaolo/psutil#1635).</changelog>
  <changelog author="dmueller@suse.com" date="1600257600">- update to 5.7.2:
  * parallel tests on UNIX (make test-parallel). They're twice as fast!
  * 1741: "make build/install" is now run in parallel and it's about 15% faster on UNIX.
  * 1747: Process.wait() on POSIX returns an enum, showing the negative signal which was used to terminate the process
  * 1747: Process.wait() return value is cached so that the exit code can be retrieved on then next call.
  * 1747: Process provides more info about the process on str() and repr() (status and exit code):
  * 1757: memory leak tests are now stable.
  * 1768: [Windows] added support for Windows Nano Server. (contributed by Julien Lebot)
  * 1726: [Linux] cpu_freq() parsing should use spaces instead of tabs on ia64. (patch by Micha? Górny)
  * 1760: [Linux] Process.rlimit() does not handle long long type properly.
  * 1766: [macOS] NoSuchProcess may be raised instead of ZombieProcess.
  * 1781: fix signature of callback function for getloadavg(). (patch by Ammar Askar)
  - remove skip-flaky-i586.patch (obsolete)</changelog>
  <changelog author="code@bnavigator.de" date="1604404800">- Fix shebang replacement for multiple python flavors</changelog>
  <changelog author="dmueller@suse.com" date="1606824000">- update to 5.7.3:
  - 809_: [FreeBSD] add support for `Process.rlimit()`.
  - 893_: [BSD] add support for `Process.environ()` (patch by Armin Gruner)
  - 1830_: [UNIX] `net_if_stats()`'s `isup` also checks whether the NIC is
    running (meaning Wi-Fi or ethernet cable is connected).
  - 1837_: [Linux] improved battery detection and charge "secsleft" calculation
  - 1620_: [Linux] physical cpu_count() result is incorrect on systems with more
    than one CPU socket.
  - 1738_: [macOS] Process.exe() may raise FileNotFoundError if process is still
    alive but the exe file which launched it got deleted.
  - 1791_: [macOS] fix missing include for getpagesize().
  - 1823_: [Windows] Process.open_files() may cause a segfault due to a NULL
    pointer.
  - 1838_: [Linux] sensors_battery(): if `percent` can be determined but not
    the remaining values, still return a result instead of None.
- skip-obs.patch, skip_failing_tests.patch: rediff</changelog>
  <changelog author="asn@cryptomilk.org" date="1607688000">- Add missing BR for unittest2</changelog>
  <changelog author="code@bnavigator.de" date="1607688001">- Only require unittest2 for Leap.</changelog>
  <changelog author="alarrosa@suse.com" date="1611576000">- update to 5.8.0:
  * Enhancements:
  - 1863: disk_partitions() exposes 2 extra fields: maxfile and
    maxpath, which are the maximum file name and path name
    length.
  - 1872: [Windows] added support for PyPy 2.7.
  - 1879: provide pre-compiled wheels for Linux and macOS.
  - 1880: get rid of Travis and Cirrus CI services (they are no
    longer free). CI testing is now done by GitHub Actions on
    Linux, macOS and FreeBSD (yes). AppVeyor is still being used
    for Windows CI.
  * Bug fixes:
  - 1708: [Linux] get rid of sensors_temperatures() duplicates.
    (patch by Tim Schlueter).
  - 1839: [Windows] always raise AccessDenied when failing to
    query 64 processes from 32 bit ones (NtWoW64 APIs).
  - 1866: [Windows] process exe(), cmdline(), environ() may raise
    "invalid access to memory location" on Python 3.9.
  - 1874: [Solaris] wrong swap output given when encrypted column
    is present.
  - 1875: [Windows] process username() may raise
    ERROR_NONE_MAPPED if the SID has no corresponding account
    name. In this case AccessDenied is now raised.
  - 1877: [Windows] OpenProcess may fail with ERROR_SUCCESS.
    Turn it into AccessDenied or NoSuchProcess depending on
    whether the PID is alive.
  - 1886: [macOS] EIO error may be raised on cmdline() and
    environment(). Now it gets translated into AccessDenied.
  - 1891: [macOS] get rid of deprecated getpagesize().
- Rebase patch and skip three other tests that fail on obs
  * skip-obs.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Add patch to skip tests related to rlimit and zombie processes
  that fail when building for python2 on i586:
  * skip_rlimit_tests_on_python2.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1611921600">- Do not install tests (and change the way they're run since they
  were run from %{buildroot})</changelog>
  <changelog author="werner@suse.de" date="1655985600">- Add patch mem-used-bsc1181475.patch (bsc#1181475)
  * Adopt change of used memory calculation from upstream of procps</changelog>
</package>
<package pkgid="23873738c1a42e2f3ba6114c66242f862989580271689645f96f011dc5ec8e08" name="python-py" arch="src">
  <version epoch="0" ver="1.10.0" rel="150100.5.12.1"/>
  <changelog author="jmatejek@suse.com" date="1475668800">- update for singlespec</changelog>
  <changelog author="jmatejek@suse.com" date="1487851200">- update to 1.4.32
  - fix issue70: added ability to copy all stat info in py.path.local.copy.
  - make TerminalWriter.fullwidth a property.  This results in the correct
    value when the terminal gets resized.
  - update supported html tags to include recent additions.
    Thanks Denis Afonso for the PR.
  - Remove internal code in ``Source.compile`` meant to support earlier Python 3 versions that produced the side effect
    of leaving ``None`` in ``sys.modules`` when called (see pytest-dev/pytest#2103).
    Thanks Bruno Oliveira for the PR.</changelog>
  <changelog author="aloisio@gmx.com" date="1498824000">- Update to 1.4.34
  * fix issue119 / pytest issue708 where tmpdir may fail to make
    numbered directories when the filesystem is case-insensitive.
  1.4.33:
  * avoid imports in calls to py.path.local().fnmatch(). Thanks
    Andreas Pelme for the PR.
  * fix issue106: Naive unicode encoding when calling fspath() in
    python2. Thanks Tiago Nobrega for the PR.
  * fix issue110: unittest.TestCase.assertWarns fails with py
    imported.</changelog>
  <changelog author="arun@gmx.de" date="1510747200">- update to version 1.5.0:
  * python 2.6 and 3.3 are no longer supported
  * deprecate py.std and remove all internal uses
  * fix #73 turn py.error into an actual module
  * path join to / no longer produces leading double slashes
  * fix #82 - remove unsupportable aliases
  * fix python37 compatibility of path.sysfind on windows by correctly
    replacing vars
  * turn iniconfig and apipkg into vendored packages and ease
    de-vendoring for distributions
  * fix #68 remove invalid py.test.ensuretemp references
  * fix #25 - deprecate path.listdir(sort=callable)
  * add TerminalWriter.chars_on_current_line read-only property that
    tracks how many characters have been written to the current line.</changelog>
  <changelog author="arun@gmx.de" date="1511092800">- specfile:
  * updated url
- update to version 1.5.2:
  * fix #169, #170: error importing py.log on Windows: no module named
    "syslog".
- changes from version 1.5.1:
  * fix #167 - prevent pip from installing py in unsupported Python
    versions.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1527768000">- update to version 1.5.3
  * - fix #179: ensure we can support 'from py.error import ...'</changelog>
  <changelog author="mimi.vx@gmail.com" date="1533211200">- update to 1.5.4
  * don't make assumptions about fs case sensitivity in ``make_numbered_dir``.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1540555200">- update to 1.7.0
  * use ``shutil.get_terminal_size()`` in Python 3.3+ to determine the size of the
  terminal, which produces more accurate results than the previous method.
  * introduce new ``PY_IGNORE_IMPORTMISMATCH`` environment variable
  that suppresses ``ImportMismatchError`` exceptions when set to ``1``.
  * add ``TerminalWriter.width_of_current_line`` (i18n version of
  ``TerminalWriter.chars_on_current_line``), a read-only property
  that tracks how wide the current line is, attempting to take
  into account international characters in the calculation.</changelog>
  <changelog author="tchvatal@suse.com" date="1549972800">- Drop the doc subpackage, no need for it really
- Make sure the tests are realy executed</changelog>
  <changelog author="tchvatal@suse.com" date="1550232000">- Make tests really pass on pytest 3.x series
- Add patch to operate better with serparators (from upstream git):
  * separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1550232001">- Make tests never fail as they are borked on pytest-4 with
  most probably no intention of being ever fixed</changelog>
  <changelog author="tchvatal@suse.com" date="1551268800">- Update to 1.8.0:
  * add ``"importlib"`` pyimport mode for python3.5+, allowing unimportable test suites
    to contain identically named modules.
  * fix ``LocalPath.as_cwd()`` not calling ``os.chdir()`` with ``None``, when
    being invoked from a non-existing directory.
- Drop merged patch separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1560945600">- Switch to multibuild to avoid cycle bsc#1138666</changelog>
  <changelog author="tchvatal@suse.com" date="1578312000">- Update to 1.8.1:
  - Handle ``FileNotFoundError`` when trying to import pathlib in
    ``path.common`` on Python 3.4 (#207).
  - ``py.path.local.samefile`` now works correctly in Python 3 on
    Windows when dealing with symlinks.</changelog>
  <changelog author="mcalabkova@suse.com" date="1593432000">- Update to 1.9.0
  * Add type annotation stubs</changelog>
  <changelog author="jayvdb@gmail.com" date="1602936000">- Devendor apipkg and iniconfig
- Add pr_222.patch to activate test suite</changelog>
  <changelog author="code@bnavigator.de" date="1613736000">- Update to 1.10.0
  * Fix a regular expression DoS vulnerability in the py.path.svnwc
    SVN blame functionality (CVE-2020-29651)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- CVE-2020-29651.patch (bsc#1179805, CVE-2020-29651, bsc#1184505)
  * python-py: regular expression denial of service in svnwc.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)
- Drop CVE-2020-29651.patch, issue fixed upstream in 1.10.0</changelog>
  <changelog author="steven.kowalik@suse.com" date="1673956800">- Remove all traces of py._path.svn{url,wc}. (bsc#1204364, CVE-2022-42969)
- Add patch remove-svn-remants.patch to help with that goal.
- Refresh pr_222.patch as needed for above.</changelog>
</package>
<package pkgid="2be2e9cac2e70d6542faba65ea3fd18017ad2362916a4a19b379d3ae30ad25fb" name="python-rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="cthiel@suse.de" date="1223467200">- added libelf-devel to BuildRequires to fix build</changelog>
  <changelog author="ro@suse.de" date="1234440000">- adapt buildrequires</changelog>
  <changelog author="dmueller@suse.de" date="1287403200">- adapt buildrequires</changelog>
  <changelog author="coolo@novell.com" date="1287748800">- adapt second spec file to changes done to rpm.spec</changelog>
  <changelog author="mls@suse.de" date="1298462400">- drop standard python directories from filelist [bnc#229189]</changelog>
  <changelog author="coolo@suse.com" date="1323604800">- add libtool as explicit buildrequire</changelog>
  <changelog author="saschpe@suse.de" date="1326801600">- Spec file cleanup:
  * Don't rm -rf %{buildroot}
  * Removed %clean section
  * Removed authors from description</changelog>
  <changelog author="klaussfreire@gmail.com" date="1334145600">- Fix usage of deprecated AsVoidPtr Python/C API,
  replaced by Capsule API</changelog>
  <changelog author="mls@suse.de" date="1335182400">- modified capsule api diff to match rpm upstream</changelog>
  <changelog author="dmueller@suse.com" date="1357128000">- Update to 4.10.2</changelog>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="65dc3cb59cfd7af630379b7b60e6a9102d902af372c9cdf2ffc8a23cee7c9974" name="python-rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="cthiel@suse.de" date="1223467200">- added libelf-devel to BuildRequires to fix build</changelog>
  <changelog author="ro@suse.de" date="1234440000">- adapt buildrequires</changelog>
  <changelog author="dmueller@suse.de" date="1287403200">- adapt buildrequires</changelog>
  <changelog author="coolo@novell.com" date="1287748800">- adapt second spec file to changes done to rpm.spec</changelog>
  <changelog author="mls@suse.de" date="1298462400">- drop standard python directories from filelist [bnc#229189]</changelog>
  <changelog author="coolo@suse.com" date="1323604800">- add libtool as explicit buildrequire</changelog>
  <changelog author="saschpe@suse.de" date="1326801600">- Spec file cleanup:
  * Don't rm -rf %{buildroot}
  * Removed %clean section
  * Removed authors from description</changelog>
  <changelog author="klaussfreire@gmail.com" date="1334145600">- Fix usage of deprecated AsVoidPtr Python/C API,
  replaced by Capsule API</changelog>
  <changelog author="mls@suse.de" date="1335182400">- modified capsule api diff to match rpm upstream</changelog>
  <changelog author="dmueller@suse.com" date="1357128000">- Update to 4.10.2</changelog>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="b582e188b82ce71451237072fab01e2e3910dae928eb355bc5c7f6fb1bf00576" name="python-rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="cthiel@suse.de" date="1223467200">- added libelf-devel to BuildRequires to fix build</changelog>
  <changelog author="ro@suse.de" date="1234440000">- adapt buildrequires</changelog>
  <changelog author="dmueller@suse.de" date="1287403200">- adapt buildrequires</changelog>
  <changelog author="coolo@novell.com" date="1287748800">- adapt second spec file to changes done to rpm.spec</changelog>
  <changelog author="mls@suse.de" date="1298462400">- drop standard python directories from filelist [bnc#229189]</changelog>
  <changelog author="coolo@suse.com" date="1323604800">- add libtool as explicit buildrequire</changelog>
  <changelog author="saschpe@suse.de" date="1326801600">- Spec file cleanup:
  * Don't rm -rf %{buildroot}
  * Removed %clean section
  * Removed authors from description</changelog>
  <changelog author="klaussfreire@gmail.com" date="1334145600">- Fix usage of deprecated AsVoidPtr Python/C API,
  replaced by Capsule API</changelog>
  <changelog author="mls@suse.de" date="1335182400">- modified capsule api diff to match rpm upstream</changelog>
  <changelog author="dmueller@suse.com" date="1357128000">- Update to 4.10.2</changelog>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="319695dc30a9e3903cf7fd1ca8a1c273b4832890867fdc57253ae46091363125" name="python-rsa" arch="src">
  <version epoch="0" ver="3.4.2" rel="150000.3.7.1"/>
  <changelog author="jfunk@funktronics.ca" date="1337342400">- Initial release</changelog>
  <changelog author="speilicke@suse.com" date="1353672000">- Update to version 3.1.1:
  + Upstream provides no changelog</changelog>
  <changelog author="speilicke@suse.com" date="1376308800">- Add rsa-use-system-setuptools.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1381492800">- Update to version 3.1.2
  + No changelog available
- Replace python-distribute with python-setuptools BuildRequires
- Remove rsa-use-system-setuptools.patch; merged upstream
- Implement update-alternatives</changelog>
  <changelog author="ledest@gmail.com" date="1415448000">- fix bashisms in pre script</changelog>
  <changelog author="benoit.monin@gmx.fr" date="1431432000">- update to version 3.1.4:
  * no changelog available
- add test dependency python-unittest2
- fix update-alternatives
- run the tests with run_tests.py
- add README.rst to the package documentation</changelog>
  <changelog author="rjschwei@suse.com" date="1443009600">- require coreutils (bsc#935595)
  + %pre section uses rm which is part of coreutils package</changelog>
  <changelog author="p.drouand@gmail.com" date="1448020800">- Fix coreutils requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1448971200">- Include version 3.1.4 in SLE 12 (FATE#319904, bsc#954690)</changelog>
  <changelog author="rjschwei@suse.com" date="1451995200">- Fix CVE 2016-1494 (bsc#960680)
  - Add patch cve_2016-1494.diff</changelog>
  <changelog author="toddrme2178@gmail.com" date="1493640000">- Update to Version 3.4.2
  * Fixed dates in CHANGELOG.txt
- Update to Version 3.4.1
  * Included tests/private.pem in MANIFEST.in
  * Included README.md and CHANGELOG.txt in MANIFEST.in
- Update to Version 3.4
  * Moved development to Github: https://github.com/sybrenstuvel/python-rsa
  * Solved side-channel vulnerability by implementing blinding, fixes #19
  * Deprecated the VARBLOCK format and rsa.bigfile module due to security issues, see
    https://github.com/sybrenstuvel/python-rsa/issues/13
  * Integration with Travis-CI, Coveralls and Code Climate
  * Deprecated the old rsa._version133 and rsa._version200 submodules, they will be
    completely removed in version 4.0.
  * Add an 'exponent' argument to key.newkeys()
  * Switched from Solovay-Strassen to Miller-Rabin primality testing, to
    comply with NIST FIPS 186-4 as probabilistic primality test
    (Appendix C, subsection C.3):
  * Fixed bugs #12, #14, #27, #30, #49
- Update to Version 3.3
  * Thanks to Filippo Valsorda: Fix BB'06 attack in verify() by
    switching from parsing to comparison.
  * Simplified Tox configuration and dropped Python 3.2 support. The
    coverage package uses a u'' prefix, which was reintroduced in 3.3
    for ease of porting.
- Update to Version 3.2.3
  * Added character encoding markers for Python 2.x
- Update to Version 3.2.1
  * Added per-file licenses
  * Added support for wheel packages
  * Made example code more consistent and up to date with Python 3.4
- Update to Version 3.2
  * Mentioned support for Python 3 in setup.py
- Implement single-spec version.
- Fix source URL.
- Remove cve_2016-1494.diff, fixed in latest version.</changelog>
  <changelog author="rjschwei@suse.com" date="1623412800">- Add cve_2020-13757.patch (CVE-2020-13757 bsc#1172389)
  + Handle leading '\0' bytes during decryption of ciphertext</changelog>
  <changelog author="rjschwei@suse.com" date="1666008000">- Add cve_2020-25658.patch (CVE-2020-25658 bsc#1178676)
  + Reduce timing sensitivity on devryption for false ciphers</changelog>
</package>
<package pkgid="f14755094b2904f41b55d5e3b95c352f281c4f428b25afd3043eae87f4747007" name="python-setuptools" arch="src">
  <version epoch="0" ver="40.5.0" rel="150100.6.6.1"/>
  <changelog author="arun@gmx.de" date="1514721600">- update to version 38.2.5:
  * #1232: Fix trailing slash handling in pkg_resources.ZipProvider.</changelog>
  <changelog author="arun@gmx.de" date="1515240000">- specfile:
  * update copyright year
- update to version 38.4.0:
  * #1231: Removed warning when PYTHONDONTWRITEBYTECODE is enabled.
- changes from version 38.3.0:
  * #1210: Add support for PEP 345 Project-URL metadata.
  * #1207: Add support for long_description_type to setup.cfg
    declarative config as intended and documented.</changelog>
  <changelog author="arun@gmx.de" date="1517745600">- update to version 38.4.1:
  * #1257: In bdist_egg.scan_module, fix ValueError on Python 3.7.</changelog>
  <changelog author="arun@gmx.de" date="1517918400">- update to version 38.5.1:
  * #1271: Revert to Cython legacy build_ext behavior for
    compatibility.
- changes from version 38.5.0:
  * #1229: Expand imports in build_ext to refine detection of Cython
    availability.
  * #1270: When Cython is available, build_ext now uses the
    new_build_ext.</changelog>
  <changelog author="aplanas@suse.com" date="1519732800">- Recommends only for SUSE</changelog>
  <changelog author="aplanas@suse.com" date="1520424000">- Allows Recommends and Suggest in Fedora</changelog>
  <changelog author="arun@gmx.de" date="1520510400">- update to version 38.5.2:
  * #1285: Fixed RuntimeError in pkg_resources.parse_requirements on
    Python 3.7 (stemming from PEP 479).</changelog>
  <changelog author="arun@gmx.de" date="1521288000">- update to version 38.6.0:
  * #1286: Add support for Metadata 2.1 (PEP 566).</changelog>
  <changelog author="arun@gmx.de" date="1521288001">- update to version 39.0.0:
  * #1296: Setuptools now vendors its own direct dependencies, no
    longer relying on the dependencies as vendored by pkg_resources.
  * #296: Removed long-deprecated support for iteration on Version
    objects as returned by pkg_resources.parse_version. Removed the
    SetuptoolsVersion and SetuptoolsLegacyVersion names as well. They
    should not have been used, but if they were, replace with Version
    and LegacyVersion from packaging.version.
- changes from version 38.7.0:
  * #1288: Add support for maintainer in PKG-INFO.
- changes from version 38.6.1:
  * #1292: Avoid generating Provides-Extra in metadata when no extra
    is present (but environment markers are).</changelog>
  <changelog author="tchvatal@suse.com" date="1521460800">- Version update to 39.0.1:
  * Fix utf parsing with python2
  * Various other fixes</changelog>
  <changelog author="arun@gmx.de" date="1525608000">- update to version 39.1.0:
  * #1340: Update all PyPI URLs to reflect the switch to the new
    Warehouse codebase.
  * #1337: In pkg_resources, now support loading resources for modules
    loaded by the SourcelessFileLoader.
  * #1332: Silence spurious wheel related warnings on Windows.</changelog>
  <changelog author="arun@gmx.de" date="1526904000">- update to version 39.2.0:
  * #1359: Support using "file:" to load a PEP 440-compliant package
    version from a text file.
  * #1360: Fixed issue with a mismatch between the name of the package
    and the name of the .dist-info file in wheel files
  * #1364: Add __dir__() implementation to
    pkg_resources.Distribution() that includes the attributes in the
    _provider instance variable.
  * #1365: Take the package_dir option into account when loading the
    version from a module attribute.
  * #1353: Added coverage badge to README.
  * #1356: Made small fixes to the developer guide documentation.
  * #1357: Fixed warnings in documentation builds and started
    enforcing that the docs build without warnings in tox.
  * #1376: Updated release process docs.
  * #1343: The setuptools specific long_description_content_type,
    project_urls and provides_extras fields are now set consistently
    after any distutils setup_keywords calls, allowing them to
    override values.
  * #1352: Added tox environment for documentation builds.
  * #1354: Added towncrier for changelog managment.
  * #1355: Add PR template.
  * #1368: Fixed tests which failed without network connectivity.
  * #1369: Added unit tests for PEP 425 compatibility tags support.
  * #1372: Stop testing Python 3.3 in Travis CI, now that the latest
    version of wheel no longer installs on it.</changelog>
  <changelog author="arun@gmx.de" date="1531396800">- update to version 40.0.0:
  * #1342: Drop support for Python 3.3.
  * #1366: In package_index, fixed handling of encoded entities in
    URLs.
  * #1383: In pkg_resources VendorImporter, avoid removing packages
    imported from the root.
  * #1379: Minor doc fixes after actually using the new release
    process.
  * #1385: Removed section on non-package data files.
  * #1403: Fix developer's guide.
  * #1404: Fix PEP 518 configuration: set build requirements in
    pyproject.toml to ["wheel"].</changelog>
  <changelog author="arun@gmx.de" date="1534593600">- specfile:
  * removed devel for noarch package
- update to version 40.1.0:
  * #1410: Deprecated upload and register commands.
  * #1312: Introduced find_namespace_packages() to find PEP 420
    namespace packages.
  * #1420: Added find_namespace: directive to config parser.
  * #1418: Solved race in when creating egg cache directories.
  * #1450: Upgraded vendored PyParsing from 2.1.10 to 2.2.0.
  * #1451: Upgraded vendored appdirs from 1.4.0 to 1.4.3.
  * #1388: Fixed "Microsoft Visual C++ Build Tools" link in exception
    when Visual C++ not found.
  * #1389: Added support for scripts which have unicode content.
  * #1416: Moved several Python version checks over to using six.PY2
    and six.PY3.
  * #1441: Removed spurious executable permissions from files that
    don't need them.</changelog>
  <changelog author="jengelh@inai.de" date="1535198400">- Use noun phrase in summary.</changelog>
  <changelog author="arun@gmx.de" date="1535803200">- update to version 40.2.0:
  * #1466: Fix handling of Unicode arguments in PEP 517 backend
- changes from version 40.1.1:
  * #1465: Fix regression with egg_info command when tagging is used.</changelog>
  <changelog author="arun@gmx.de" date="1538308800">- update to version 40.4.3:
  * #1480: Bump vendored pyparsing in pkg_resources to 2.2.1.
- changes from version 40.4.2:
  * #1497: Updated gitignore in repo.
- changes from version 40.4.1:
  * #1480: Bump vendored pyparsing to 2.2.1.
- changes from version 40.4.0:
  * #1481: Join the sdist --dist-dir and the build_meta sdist
    directory argument to point to the same target (meaning the build
    frontend no longer needs to clean manually the dist dir to avoid
    multiple sdist presence, and setuptools no longer needs to handle
    conflicts between the two).
- changes from version 40.3.0:
  * #1402: Fixed a bug with namespace packages under Python 3.6 when
    one package in current directory hides another which is
    installed.
  * #1427: Set timestamp of .egg-info directory whenever egg_info
    command is run.
  * #1474: build_meta.get_requires_for_build_sdist now does not
    include the wheel package anymore.
  * #1486: Suppress warnings in pkg_resources.handle_ns.
  * #1479: Remove internal use of six.binary_type.</changelog>
  <changelog author="arun@gmx.de" date="1540900800">- update to version 40.5.0:
  * #1335: In pkg_resources.normalize_path, fix issue on Cygwin when
    cwd contains symlinks.
  * #1502: Deprecated support for downloads from Subversion in
    package_index/easy_install.
  * #1517: Dropped use of six.u in favor of u"" literals.
  * #1520: Added support for data_files in setup.cfg.
  * #1525: Fixed rendering of the deprecation warning in easy_install
    doc.</changelog>
  <changelog author="mcepl@suse.com" date="1605355200">- Add wheel subpackage with the generated wheel for this package
  (bsc#1176262, CVE-2019-20916).</changelog>
  <changelog author="daniel.garcia@suse.com" date="1673265600">- Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service
  (ReDoS) in package_index.py.
  bsc#1206667</changelog>
</package>
<package pkgid="de871fb33f4aabc98ffe2c0ea9ceeb0e0c460cd9d0887c2343e3f176b31bde86" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="721546f631f5231b66a2df6e98c52e2fe96f4f855d08404d2c4d290d3b054111" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="e554776bdbcf66f809e2e4c391277eda2cc3e78e8916fb6ed8d09b457d2c6ed2" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="166f548380fd0425a6b9d002a8c445df7d7fca00e293af61a6b087f2e6708665" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="5039ed12acc49c4c9d9ed034e5143ce9e87b7f40d630ce170ed59383bf5eb8c8" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="1d3f31bbbff1cea2578e38c99e6a691a9fc74cae4b4336bf62b33b2e7b0872e5" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="6bf22b6c480d3dcd665ff86560a3c0c5ff45f4c88bc609e1eadb61858222c412" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="329894139c4323fa49554ed55fca79308ffd405206e1824a1abcd3f2fe38a5a6" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="2fa7e10c64dd44f1a9dd4f6e033e5b1a0393fbbc42125a8731b87e218454a69b" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="6176cf102fed7d30d8482b71a16d8313cf844b25145dc7dea07ce1636a661a64" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="345675e9061b2d2ceeacaae871d039478cce020a4d0f0de535d853b348e09792" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="f1be5bb20099b345a8e8c3a85d82c409651c74cdf29d1951cdedfc9f7139c9b1" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="851ff39fe4766ce230fa02c1289458996458bc8e7da804d25f73b46f3e45c877" name="python3-M2Crypto" arch="aarch64">
  <version epoch="0" ver="0.35.2" rel="150000.3.11.1"/>
  <changelog author="michael@stroeder.com" date="1469188800">- update to 0.25.1
- set new dependency on package python-typing</changelog>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
</package>
<package pkgid="56b8830b0e65c64706c2058f2f761499f03ef8e64dc7dfe4f7623e4478c9c0fd" name="python3-M2Crypto" arch="x86_64">
  <version epoch="0" ver="0.35.2" rel="150000.3.11.1"/>
  <changelog author="michael@stroeder.com" date="1469188800">- update to 0.25.1
- set new dependency on package python-typing</changelog>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
</package>
<package pkgid="12a7713a400ec85c481255a1f93798ad273f1b42992d4912b167e909aeb23099" name="python3-M2Crypto" arch="aarch64">
  <version epoch="0" ver="0.35.2" rel="150000.3.14.1"/>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
  <changelog author="mcepl@suse.com" date="1657627200">- Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657,
  bsc#1178829), which mitigates the Bleichenbacher timing attacks
  in the RSA decryption API.
- Add python-M2Crypto.keyring to verify GPG signature of tarball.</changelog>
</package>
<package pkgid="ad0d5a8b9d4c2fa4cc4aa9eae830238485c45fc12fcd2272dfd7fe7a9c81330f" name="python3-M2Crypto" arch="x86_64">
  <version epoch="0" ver="0.35.2" rel="150000.3.14.1"/>
  <changelog author="dmueller@suse.com" date="1473681600">- use pypi.io as Source URL</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492516800">- Update to 0.26.0
  * No changelog provided
- Implement single-spec version.</changelog>
  <changelog author="alarrosa@suse.com" date="1493208000">- Provide python-m2crypto in the python2 package</changelog>
  <changelog author="alarrosa@suse.com" date="1493294400">- Add python-typing as a dependency</changelog>
  <changelog author="toddrme2178@gmail.com" date="1494072000">- It doesn't look like python3-m2crypto ever existed, so don't
  provide it.</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1497873600">- only require python3-typing if necessary</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- Update to 0.26.2
  * compatibility with OpenSSL 1.1.0</changelog>
  <changelog author="michael@stroeder.com" date="1506081600">- Update to 0.26.3 with fix for a syntax error</changelog>
  <changelog author="michael@stroeder.com" date="1506427200">- Update to 0.26.4 with fix for OpenSSL 1.1.0 and LibreSSL</changelog>
  <changelog author="alarrosa@suse.com" date="1508328000">- Update to 0.27.0
  * Fix licence: it is MIT, not BSD
  * At least minimal support of SNI in httpslib.
  * Small bugfixes and cleanups.
  * More effort to make build system more robust.
  * Restore m2.rsa_set_e() and m2.rsa_set_n().
  * Make sure that every exceptional return throws and exception and viceversa.
- Add patch fix-build-python3.diff to let it build with python3
- Add patch fix-openssl-include-path.diff to fix openssl include path
  (the code already includes the openssl/ part)
- Create a new package python-M2Crypto-doc for documentation since rpmlint
  was complaining around 75% of the package was documentation.</changelog>
  <changelog author="alarrosa@suse.com" date="1508500800">- Remove unnecessary fdupes call</changelog>
  <changelog author="michael@stroeder.com" date="1508932800">- License set to MIT</changelog>
  <changelog author="jmatejek@suse.com" date="1510142400">- use generic way to require python-typing now that python3 provides it</changelog>
  <changelog author="michael@stroeder.com" date="1518091200">- Removed obsolete patches fix-build-python3.diff
  and fix-openssl-include-path.diff
- Update to 0.28.1
  * compability with Python 3
  * building on Mac OS X should be now more reliable and automagic
  * Fix licence in metadata: it is MIT, not BSD
  * Fix and add tests for SWIG/_aes.i module
  * Bundle-in unittest2 for Python 2.6
  * Remove all PGP modules</changelog>
  <changelog author="tchvatal@suse.com" date="1518177600">- Enable tests, fix docu install phase</changelog>
  <changelog author="michael@stroeder.com" date="1518177601">- Update to 0.28.2:
  * Fix ppc builds</changelog>
  <changelog author="mcepl@suse.com" date="1559044800">- Fix use of urlunsplit (bsc#1135009)</changelog>
  <changelog author="mcepl@suse.com" date="1568808000">- bsc#1149792 jsc#SLE-9135 Update to 0.35.2, bugfixes only.
  Changes cumulatively:
  - fix compatibility with OpenSSL 1.1.1c. Thank you,
    Sebastian Andrzej Siewior from the Debian team for resolving it.
  - Stop pretending to support Python 3.4.
  - The project is now Linux-distribution agnostic
  - Replace all old-style classes with the new ones (it shouldn't cause
    any problems, but feel free to file an issue, if it does)
  - Do not by-pass a potential transfer decoding in m2urllib2
  - SSLv3 just removed.
  - Various fixes of the build system and internal errors.
- Patch fix_urlunsplit.patch is removed, because it is included
  in the upstream tarball.</changelog>
  <changelog author="jgonzalez@suse.com" date="1590667200">- Add python3-M2crypto to LTSS channels, to allow using salt even
  when the Server Applications Module is not used (bsc#1172226)</changelog>
  <changelog author="mcepl@suse.com" date="1657627200">- Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657,
  bsc#1178829), which mitigates the Bleichenbacher timing attacks
  in the RSA decryption API.
- Add python-M2Crypto.keyring to verify GPG signature of tarball.</changelog>
</package>
<package pkgid="6539f230947d6ec829c6890b98683bc1434f925050fa98d0e0ca6febe4d5586e" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="fb5d6861bbff07a7e936ddfd1db09896582ec31bf0def78bda75939aef72d547" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="02e2616b29d80b3faa641ed630bd80aeac0657a4958030047d90ff3999b8464d" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="b349c650ceec8fdffbbdb122f45813f1519596fb44b643aba3ac08272c1e3ea1" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="952fcee05e8e0331bf34c44adeeaae8181c82a7ad3a640cf83202ab081cf65f2" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="57e7cf9ea44cd70f442f4fee74c461b2dbe3c9501ff5243705e66a24af008891" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="3722265f2cd65fd45a673411a17c4168e1fc2155b856c0448521f7bf42eb1c6e" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="dc2532e5731cdf087451e2ff217183cca39ce7b3609d3d3d93b1abb56d4439f9" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="c352ad19701ea05f3dc630d1cbf4626904016d10bdf963d464962ec259bfabcc" name="python3-botocore" arch="noarch">
  <version epoch="0" ver="1.26.4" rel="150200.37.9.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Enable python2 builds for SLE-15</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626868800">- Version update to 1.20.112
  * api-change:``dms``: Release of feature needed for ECA-Endpoint settings. This allows
    customer to delete a field in endpoint settings by using --exact-settings flag in modify-
    endpoint api. This also displays default values for certain required fields of endpoint
    settings in describe-endpoint-settings api.
  * api-change:``glue``: Add support for Event Driven Workflows
  * api-change:``acm``: Added support for RSA 3072 SSL certificate import
  * api-change:``healthlake``: General availability for Amazon HealthLake. StartFHIRImportJob
    and StartFHIRExportJob APIs now require AWS KMS parameter. For more information, see the
    Amazon HealthLake Documentation https://docs.aws.amazon.com/healthlake/index.html.
  * api-change:``wellarchitected``: This update provides support for Well-Architected API users
    to mark answer choices as not applicable.
  * api-change:``lightsail``: This release adds support for the Amazon Lightsail object storage
    service, which allows you to create buckets and store objects.
- from version 1.20.111
  * api-change:``amplifybackend``: Added Sign in with Apple OAuth provider.
  * api-change:``redshift``: Release new APIs to support new Redshift feature - Authentication Profile
  * api-change:``ssm``: Changes to OpsCenter APIs to support a new feature, operational insights.
  * api-change:``lex-models``: Customers can now migrate bots built with Lex V1 APIs to V2 APIs.
    This release adds APIs to initiate and manage the migration of a bot.
  * api-change:``directconnect``: This release adds a new filed named awsLogicalDeviceId that it
    displays the AWS Direct Connect endpoint which terminates a physical connection's BGP Sessions.
  * api-change:``pricing``: Documentation updates for api.pricing
- from version 1.20.110
  * api-change:``eks``: Documentation updates for Wesley to support the parallel node upgrade feature.
  * api-change:``kendra``: Amazon Kendra now supports Principal Store
- from version 1.20.109
  * api-change:``sagemaker``: Releasing new APIs related to Tuning steps in model building pipelines.
  * api-change:``frauddetector``: This release adds support for ML Explainability to display model
    variable importance value in Amazon Fraud Detector.
  * api-change:``mediaconvert``: MediaConvert now supports color, style and position information
    passthrough from 608 and Teletext to SRT and WebVTT subtitles. MediaConvert now also supports
    Automatic QVBR quality levels for QVBR RateControlMode.
- from version 1.20.108
  * api-change:``eks``: Added waiters for EKS FargateProfiles.
  * api-change:``outposts``: Added property filters for listOutposts
  * api-change:``fms``: AWS Firewall Manager now supports route table monitoring, and provides
    remediation action recommendations to security administrators for AWS Network Firewall policies
    with misconfigured routes.
  * api-change:``mediatailor``: Add ListAlerts for Channel, Program, Source Location, and VOD Source to
    return alerts for resources.
  * api-change:``devops-guru``: Add AnomalyReportedTimeRange field to include open and close
    time of anomalies.
  * api-change:``ssm-contacts``: Updated description for CreateContactChannel contactId.
- from version 1.20.107
  * api-change:``iam``: Documentation updates for AWS Identity and Access Management (IAM).
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``mq``: adds support for modifying the maintenance window for brokers.
  * api-change:``cloudfront``: Amazon CloudFront now provides two new APIs, ListConflictingAliases and
    AssociateAlias, that help locate and move Alternate Domain Names (CNAMEs) if you encounter the
    CNAMEAlreadyExists error code.
  * api-change:``chime``: Releasing new APIs for AWS Chime MediaCapturePipeline
  * api-change:``iotsitewise``: This release add storage configuration APIs for AWS IoT SiteWise.
  * api-change:``storagegateway``: Adding support for oplocks for SMB file shares,  S3 Access Point and
    S3 Private Link for all file shares and IP address support for file system associations
  * api-change:``ec2``: This release adds resource ids and tagging support for VPC security group rules.
- from version 1.20.106
  * api-change:``lambda``: Added support for AmazonMQRabbitMQ as an event source. Added support for
    VIRTUAL_HOST as SourceAccessType for streams event source mappings.
  * api-change:``imagebuilder``: Adds support for specifying parameters to customize components for recipes.
    Expands configuration of the Amazon EC2 instances that are used for building and testing images,
    including the ability to specify commands to run on launch, and more control over installation and
    removal of the SSM agent.
  * api-change:``mgn``: Bug fix: Remove not supported EBS encryption type "NONE"
  * api-change:``eks``: Adding new error code UnsupportedAddonModification for Addons in EKS
  * api-change:``macie2``: Sensitive data findings in Amazon Macie now include enhanced location
    data for JSON and JSON Lines files
  * api-change:``sns``: Documentation updates for Amazon SNS.
- from version 1.20.105
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``ec2``: This release removes network-insights-boundary
- from version 1.20.104
  * api-change:``sagemaker``: SageMaker model registry now supports up to 5 containers
    and associated environment variables.
  * api-change:``sqs``: Documentation updates for Amazon SQS.
  * api-change:``ec2``: Adding a new reserved field to support future infrastructure
    improvements for Amazon EC2 Fleet.
- from version 1.20.103
  * api-change:``autoscaling``: Amazon EC2 Auto Scaling infrastructure improvements and optimizations.
  * api-change:``kendra``: Amazon Kendra Enterprise Edition now offered in smaller more granular units
    to enable customers with smaller workloads. Virtual Storage Capacity units now offer scaling in
    increments of 100,000 documents (up to 30GB) per unit and Virtual Query Units offer scaling increments
    of 8,000 queries per day.
  * api-change:``mediapackage-vod``: Add support for Widevine DRM on CMAF packaging configurations.
    Both Widevine and FairPlay DRMs can now be used simultaneously, with CBCS encryption.
  * api-change:``ssm-contacts``: Fixes the tag key length range to 128 chars,  tag value length to 256
    chars; Adds support for UTF-8 chars for contact and channel names, Allows users to unset name in
    UpdateContact API; Adds throttling exception to StopEngagement API, validation exception to APIs
    UntagResource, ListTagsForResource
  * api-change:``databrew``: Adds support for the output of job results to the AWS Glue Data Catalog.
  * api-change:``servicediscovery``: AWS Cloud Map now allows configuring the TTL of the SOA record for a
    hosted zone to control the negative caching for new services.
- from version 1.20.102
  * api-change:``sagemaker``: Sagemaker Neo now supports running compilation jobs using customer's Amazon VPC
  * api-change:``glue``: Add JSON Support for Glue Schema Registry
  * api-change:``redshift``: Added InvalidClusterStateFault to the DisableLogging API, thrown when calling the
    API on a non available cluster.
  * api-change:``mediaconvert``: MediaConvert adds support for HDR10+, ProRes 4444,  and XAVC outputs, ADM/DAMF
    support for Dolby Atmos ingest, and alternative audio and WebVTT caption ingest via HLS inputs. MediaConvert
    also now supports creating trickplay outputs for Roku devices for HLS, CMAF, and DASH output groups.
- from version 1.20.101
  * api-change:``proton``: Added waiters for template registration, service operations, and environment deployments.
  * api-change:``amplifybackend``: Imports an existing backend authentication resource.
  * api-change:``snowball``: AWS Snow Family customers can remotely monitor and operate their connected AWS Snowcone
    devices. AWS Snowball Edge Storage Optimized customers can now import and export their data using NFS.
- from version 1.20.100
  * api-change:``chime``: Adds EventIngestionUrl field to MediaPlacement
  * api-change:``cloud9``: Minor update to AWS Cloud9 documentation to allow correct parsing of outputted text
  * api-change:``connect``: Released Amazon Connect quick connects management API for general availability (GA).
    For more information, see https://docs.aws.amazon.com/connect/latest/APIReference/Welcome.html
  * api-change:``dax``: Add support for encryption in transit to DAX clusters.
  * api-change:``wafv2``: Added support for 15 new text transformation.
  * api-change:``kendra``: Amazon Kendra now supports SharePoint 2013 and SharePoint 2016 when
    using a SharePoint data source.
  * api-change:``securityhub``: Added new resource details for ECS clusters and ECS task definitions. Added
    additional information for S3 buckets, Elasticsearch domains, and API Gateway V2 stages.
  * api-change:``transfer``: Customers can successfully use legacy clients with Transfer Family endpoints enabled
    for FTPS and FTP behind routers, firewalls, and load balancers by providing a Custom IP address used for data
    channel communication.
  * api-change:``codebuild``: BucketOwnerAccess is currently not supported
- from version 1.20.99
  * api-change:``docdb``: DocumentDB documentation-only edits
  * api-change:``cloud9``: Updated documentation for CreateEnvironmentEC2 to explain that because Amazon Linux AMI
    has ended standard support as of December 31, 2020, we recommend you choose Amazon Linux 2--which includes long
    term support through 2023--for new AWS Cloud9 environments.
  * api-change:``quicksight``: Releasing new APIs for AWS QuickSight Folders
  * api-change:``mediatailor``: Update GetChannelSchedule to return information on ad breaks.
  * api-change:``cloudfront``: Amazon CloudFront adds support for a new security policy, TLSv1.2_2021.
  * api-change:``license-manager``: AWS License Manager now allows license administrators and end users to communicate
    to each other by setting custom status reasons when updating the status on a granted license.
  * api-change:``ec2``: This release adds support for provisioning your own IP (BYOIP) range in multiple regions.
    This feature is in limited Preview for this release. Contact your account manager if you are interested in
    this feature.
  * api-change:``events``: Added the following parameters to ECS targets: CapacityProviderStrategy, EnableECSManagedTags,
    EnableExecuteCommand, PlacementConstraints, PlacementStrategy, PropagateTags, ReferenceId, and Tags
  * api-change:``cloudsearch``: This release replaces previous generation CloudSearch instances with equivalent new
    instances that provide better stability at the same price.
  * api-change:``codeguru-reviewer``: Adds support for S3 based full repository analysis and changed lines scan.
- from version 1.20.98
  * api-change:``cloudformation``: CloudFormation registry service now supports 3rd party public type sharing
- from version 1.20.97
  * api-change:``kendra``: Amazon Kendra now supports the indexing of web documents for search through the web crawler.
  * api-change:``sagemaker``: Enable ml.g4dn instance types for SageMaker Batch Transform and SageMaker Processing
  * api-change:``rds``: This release enables Database Activity Streams for RDS Oracle
  * api-change:``chime``: This release adds a new API UpdateSipMediaApplicationCall, to update an in-progress
    call for SipMediaApplication.
- from version 1.20.96
  * api-change:``kms``: Adds support for multi-Region keys
  * api-change:``ec2``: This release adds support for VLAN-tagged network traffic over an Elastic Network Interface
    (ENI). This feature is in limited Preview for this release. Contact your account manager if you are interested
    in this feature.
  * api-change:``rds``: This release enables fast cloning in Aurora Serverless. You can now clone between Aurora
    Serverless clusters and Aurora Provisioned clusters.
  * api-change:``mediatailor``: Adds AWS Secrets Manager Access Token Authentication for Source Locations
- from version 1.20.95
  * api-change:``redshift-data``: Redshift Data API service now supports SQL parameterization.
  * api-change:``connect``: This release adds new sets of APIs: AssociateBot, DisassociateBot, and ListBots. You can
    use it to programmatically add an Amazon Lex bot or Amazon Lex V2 bot on the specified Amazon Connect instance
  * api-change:``ec2``: EC2 M5n, M5dn, R5n, R5dn metal instances with 100 Gbps network performance and Elastic Fabric
    Adapter (EFA) for ultra low latency
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
- from version 1.20.94
  * api-change:``lookoutmetrics``: Added "LEARNING" status for anomaly detector and updated description for "Offset"
    parameter in MetricSet APIs.
  * api-change:``iotanalytics``: Adds support for data store partitions.
  * api-change:``greengrassv2``: We have verified the APIs being released here and are ready to release
- from version 1.20.93
  * api-change:``ec2``: Amazon EC2 adds new AMI property to flag outdated AMIs
  * api-change:``medialive``: AWS MediaLive now supports OCR-based conversion of DVB-Sub and SCTE-27 image-based
    source captions to WebVTT, and supports ingest of ad avail decorations in HLS input manifests.
  * api-change:``mediaconnect``: When you enable source failover, you can now designate one of two sources as the
    primary source. You can choose between two failover modes to prevent any disruption to the video stream. Merge
    combines the sources into a single stream. Failover allows switching between a primary and a backup stream.
- from version 1.20.92
  * api-change:``sagemaker``: Using SageMaker Edge Manager with AWS IoT Greengrass v2 simplifies accessing, maintaining,
    and deploying models to your devices. You can now create deployable IoT Greengrass components during edge packaging
    jobs. You can choose to create a device fleet with or without creating an AWS IoT role alias.
  * api-change:``appmesh``: AppMesh now supports additional routing capabilities in match and rewrites for Gateway Routes
    and Routes. Additionally, App Mesh also supports specifying DNS Response Types in Virtual Nodes.
  * api-change:``redshift``: Added InvalidClusterStateFault to the ModifyAquaConfiguration API, thrown when calling the
    API on a non available cluster.
  * api-change:``chime``: This SDK release adds support for UpdateAccount API to allow users to update their default
    license on Chime account.
  * api-change:``ec2``: This release adds a new optional parameter connectivityType (public, private) for the
    CreateNatGateway API. Private NatGateway does not require customers to attach an InternetGateway to the VPC
    and can be used for communication with other VPCs and on-premise networks.
  * api-change:``ram``: AWS Resource Access Manager (RAM) is releasing new field isResourceTypeDefault in ListPermissions
    and GetPermission response, and adding permissionArn parameter to GetResourceShare request to filter by permission
    attached
  * api-change:``sagemaker-featurestore-runtime``: Release BatchGetRecord API for AWS SageMaker Feature Store Runtime.
  * api-change:``cognito-idp``: Amazon Cognito now supports targeted sign out through refresh token revocation
  * api-change:``appflow``: Adding MAP_ALL task type support.
  * api-change:``managedblockchain``: This release supports KMS customer-managed Customer Master Keys (CMKs) on
    member-specific Hyperledger Fabric resources.
- from version 1.20.91
  * api-change:``transfer``: Documentation updates for the AWS Transfer Family service.
  * api-change:``personalize-events``: Support for unstructured text inputs in the items dataset to to automatically
    extract key information from product/content description as an input when creating solution versions.
  * api-change:``proton``: This is the initial SDK release for AWS Proton
  * api-change:``kendra``: AWS Kendra now supports checking document status.
- from version 1.20.90
  * api-change:``fsx``: This release adds support for auditing end-user access to files, folders, and file shares
    using Windows event logs, enabling customers to meet their security and compliance needs.
  * api-change:``servicecatalog``: increase max pagesize for List/Search apis
  * api-change:``macie2``: This release of the Amazon Macie API introduces stricter validation of S3 object
    criteria for classification jobs.
  * api-change:``cognito-idp``: Documentation updates for cognito-idp
- from version 1.20.89
  * api-change:``sagemaker``: AWS SageMaker - Releasing new APIs related to Callback steps in model building pipelines.
    Adds experiment integration to model building pipelines.
  * api-change:``glue``: Add SampleSize variable to S3Target to enable s3-sampling feature through API.
  * api-change:``personalize``: Update regex validation in kmsKeyArn and s3 path API parameters for AWS Personalize APIs
  * api-change:``eks``: Added updateConfig option that allows customers to control upgrade velocity in Managed Node Group.
- from version 1.20.88
  * api-change:``rds``: Documentation updates for RDS: fixing an outdated link to the RDS documentation
    in DBInstance$DBInstanceStatus
  * api-change:``pi``: The new GetDimensionKeyDetails action retrieves the attributes of the specified dimension group
    for a DB instance or data source.
  * api-change:``cloudtrail``: AWS CloudTrail supports data events on new service resources, including Amazon DynamoDB
    tables and S3 Object Lambda access points.
  * api-change:``medialive``: Add support for automatically setting the H.264 adaptive quantization and GOP B-frame fields.
  * api-change:``autoscaling``: Documentation updates for Amazon EC2 Auto Scaling
  * api-change:``qldb``: Documentation updates for Amazon QLDB
- from version 1.20.87
  * api-change:``s3``: S3 Inventory now supports Bucket Key Status
  * api-change:``s3control``: Amazon S3 Batch Operations now supports S3 Bucket Keys.
  * api-change:``route53resolver``: Documentation updates for Route 53 Resolver
  * api-change:``ssm``: Documentation updates for ssm to fix customer reported issue
  * api-change:``forecast``: Added optional field AutoMLOverrideStrategy to CreatePredictor API that allows users to
    customize AutoML strategy. If provided in CreatePredictor request, this field is visible in DescribePredictor and
    GetAccuracyMetrics responses.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1627387200">- Version update to 1.21.7 (bsc#1189649)
  * api-change:``s3control``: S3 Access Point aliases can be used anywhere you
    use S3 bucket names to access data in S3
  * api-change:``textract``: Adds support for AnalyzeExpense, a new API to extract
    relevant data such as contact information, items purchased, and vendor name,
    from almost any invoice or receipt without the need for any templates or
    configuration.
  * api-change:``proton``: Documentation-only update links
  * api-change:``identitystore``: Documentation updates for SSO API Ref.
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``synthetics``: CloudWatch Synthetics now supports visual
    testing in its canaries.
- from version 1.21.6
  * api-change:``securityhub``: Added product name, company name, and Region fields for
    security findings. Added details objects for RDS event subscriptions and AWS ECS
    services. Added fields to the details for AWS Elasticsearch domains.
  * api-change:``imagebuilder``: Update to documentation to reapply missing change to
    SSM uninstall switch default value and improve description.
  * api-change:``s3outposts``: Add on-premise access type support for endpoints
- from version 1.21.5
  * api-change:``medialive``: MediaLive now supports passing through style data
    on WebVTT caption outputs.
  * api-change:``databrew``: This SDK release adds two new features: 1) Output to
    Native JDBC destinations and 2) Adding configurations to profile jobs
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``s3control``: Documentation updates for Amazon S3-control
  * api-change:``ec2``: This release allows customers to assign prefixes to their
    elastic network interface and to reserve IP blocks in their subnet CIDRs. These
    reserved blocks can be used to assign prefixes to elastic network interfaces or
    be excluded from auto-assignment.
  * api-change:``qldb``: Amazon QLDB now supports ledgers encrypted with customer
    managed KMS keys. Changes in CreateLedger, UpdateLedger and DescribeLedger APIs
    to support the changes.
- from version 1.21.4
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for
    Amazon WorkDocs. For more information, see
    https://docs.aws.amazon.com/kendra/latest/dg/data-source-workdocs.html
  * api-change:``proton``: Documentation updates for AWS Proton
  * api-change:``iam``: Documentation updates for AWS Identity and Access Management (IAM).
  * api-change:``rds``: Adds the OriginalSnapshotCreateTime field to the DBSnapshot response
    object. This field timestamps the underlying data of a snapshot and doesn't change when
    the snapshot is copied.
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``lambda``: New ResourceConflictException error code for PutFunctionEventInvokeConfig,
    UpdateFunctionEventInvokeConfig, and DeleteFunctionEventInvokeConfig operations.
  * api-change:``codebuild``: AWS CodeBuild now allows you to set the access permissions for build
    artifacts, project artifacts, and log files that are uploaded to an Amazon S3 bucket that is
    owned by another account.
  * api-change:``personalize``: My AWS Service (placeholder) - Making minProvisionedTPS an optional
    parameter when creating a campaign. If not provided, it defaults to 1.
  * api-change:``emr``: Update emr client to latest version
- from version 1.21.3
  * api-change:``compute-optimizer``: Documentation updates for Compute Optimizer
  * api-change:``ec2``: Added idempotency to the CreateVolume API using the ClientToken
    request parameter
- from version 1.21.2
  * api-change:``imagebuilder``: Documentation updates for reversal of default value for additional
    instance configuration SSM switch, plus improved descriptions for semantic versioning.
  * api-change:``directconnect``: Documentation updates for directconnect
  * api-change:``health``: In the Health API, the maximum number of entities for the EventFilter and
    EntityFilter data types has changed from 100 to 99. This change is related to an internal
    optimization of the AWS Health service.
  * api-change:``robomaker``: This release allows customers to create a new version of WorldTemplates
    with support for Doors.
  * api-change:``location``: Add five new API operations: UpdateGeofenceCollection, UpdateMap,
    UpdatePlaceIndex, UpdateRouteCalculator, UpdateTracker.
  * api-change:``emr-containers``: Updated DescribeManagedEndpoint and ListManagedEndpoints to return
    failureReason and stateDetails in API response.
- from version 1.21.1
  * api-change:``appintegrations``: Documentation update for AppIntegrations Service
  * api-change:``chime``: This SDK release adds Account Status as one of the attributes in Account API response
  * api-change:``auditmanager``: This release relaxes the S3 URL character restrictions in AWS Audit Manager.
    Regex patterns have been updated for the following attributes: s3RelativePath, destination, and s3ResourcePath.
    'AWS' terms have also been replaced with entities to align with China Rebrand documentation efforts.
- from version 1.21.0
  * api-change:``ec2``: This feature enables customers  to specify weekly recurring time window(s) for scheduled
    events that reboot, stop or terminate EC2 instances.
  * api-change:``cognito-idp``: Documentation updates for cognito-idp
  * api-change:``ecs``: Documentation updates for support of awsvpc mode on Windows.
  * api-change:``lex-models``: Lex now supports the en-IN locale
  * api-change:``iotsitewise``: Update the default endpoint for the APIs used to manage asset models, assets, gateways,
    tags, and account configurations. If you have firewalls with strict egress rules, configure the rules to grant
    you access to api.iotsitewise.[region].amazonaws.com or api.iotsitewise.[cn-region].amazonaws.com.cn.
  * feature:Python: Dropped support for Python 2.7
- Disable Python2 builds for all SUSE distributions
- Remove Python2 build dependencies from spec file</changelog>
  <changelog author="rjschwei@suse.com" date="1629806400">- Disables Py 2 build for SLE 15
  + Py 2 is considered legacy with limited support. Should not have been
    built or released for Py 2. This was a mistake.</changelog>
  <changelog author="mvyskocil@opensuse.org" date="1630497600">- Version update to 1.21.33
  * api-change:iot: Added Create/Update/Delete/Describe/List APIs for a new
    IoT resource named FleetMetric. Added a new Fleet Indexing query API named
    GetBucketsAggregation. Added a new field named DisconnectedReason in Fleet
    Indexing query response. Updated their related documentations.
  * api-change:polly: Amazon Polly adds new South African English voice -
    Ayanda. Ayanda is available as Neural voice only.
  * api-change:compute-optimizer: Documentation updates for Compute Optimizer
  * api-change:sqs: Amazon SQS adds a new queue attribute, RedriveAllowPolicy,
    which includes the dead-letter queue redrive permission parameters. It defines
    which source queues can specify dead-letter queues as a JSON object.
  * api-change:memorydb: Documentation updates for MemoryDB
- from version 1.21.32
  * api-change:codebuild: Documentation updates for CodeBuild
  * api-change:firehose: This release adds the Dynamic Partitioning feature to
    Kinesis Data Firehose service for S3 destinations.
  * api-change:kms: This release has changes to KMS nomenclature to remove the
    word master from both the "Customer master key" and "CMK" abbreviation and
    replace those naming conventions with "KMS key".
  * api-change:cloudformation: AWS CloudFormation allows you to iteratively
    develop your applications when failures are encountered without rolling back
    successfully provisioned resources. By specifying stack failure options, you
    can troubleshoot resources in a CREATE_FAILED or UPDATE_FAILED status.
- from version 1.21.31
  * api-change:s3: Documentation updates for Amazon S3.
  * api-change:emr: Update emr client to latest version
  * api-change:ec2: This release adds the BootMode flag to the ImportImage API
    and showing the detected BootMode of an ImportImage task.
- from version 1.21.30
  * api-change:transcribe: This release adds support for batch transcription
    in six new languages - Afrikaans, Danish, Mandarin Chinese (Taiwan), New
    Zealand English, South African English, and Thai.
  * api-change:rekognition: This release added new attributes to Rekognition
    RecognizeCelebities and GetCelebrityInfo API operations.
  * api-change:ec2: Support added for resizing VPC prefix lists
  * api-change:compute-optimizer: Adds support for 1) the AWS Graviton
    (AWS_ARM64) recommendation preference for Amazon EC2 instance and Auto Scaling
    group recommendations, and 2) the ability to get the enrollment statuses for
    all member accounts of an organization.
- from version 1.21.29
  * api-change:fms: AWS Firewall Manager now supports triggering resource
    cleanup workflow when account or resource goes out of policy scope for AWS WAF,
    Security group, AWS Network Firewall, and Amazon Route 53 Resolver DNS Firewall
    policies.
  * api-change:ec2: Support added for IMDS IPv6 endpoint
  * api-change:datasync: Added include filters to CreateTask and UpdateTask,
    and added exclude filters to StartTaskExecution, giving customers more granular
    control over how DataSync transfers files, folders, and objects.  *
    api-change:events: AWS CWEvents adds an enum of EXTERNAL for EcsParameters
    LaunchType for PutTargets API
- from version 1.21.28
  * api-change:mediaconvert: AWS Elemental MediaConvert SDK has added MBAFF
    encoding support for AVC video and the ability to pass encryption context from
    the job settings to S3.
  * api-change:polly: Amazon Polly adds new New Zealand English voice - Aria.
    Aria is available as Neural voice only.  * api-change:transcribe: This release
    adds support for feature tagging with Amazon Transcribe batch jobs.
  * api-change:ssm: Updated Parameter Store property for logging improvements.
  * api-change:iot-data: Updated Publish with support for new Retain flag and
    added two new API operations: GetRetainedMessage, ListRetainedMessages.
- from version 1.21.27
  * api-change:dms: Amazon AWS DMS service now support Redis target endpoint
    migration. Now S3 endpoint setting is capable to setup features which are used
    to be configurable only in extract connection attributes.
  * api-change:frauddetector: Updated an element of the DescribeModelVersion
    API response (LogitMetrics -&gt; logOddsMetrics) for clarity. Added new exceptions
    to several APIs to protect against unlikely scenarios.
  * api-change:iotsitewise: Documentation updates for AWS IoT SiteWise
  * api-change:dlm: Added AMI deprecation support for Amazon Data Lifecycle
    Manager EBS-backed AMI policies.
  * api-change:glue: Add support for Custom Blueprints
  * api-change:apigateway: Adding some of the pending releases (1) Adding WAF
    Filter to GatewayResponseType enum (2) Ensuring consistent error model for all
    operations (3) Add missing BRE to GetVpcLink operation
  * api-change:backup: AWS Backup - Features: Evaluate your backup activity
    and generate audit reports.
- from version 1.21.26
  * api-change:eks: Adds support for EKS add-ons "preserve" flag, which allows
    customers to maintain software on their EKS clusters after removing it from EKS
    add-ons management.
  * api-change:comprehend: Add tagging support for Comprehend async inference job.
  * api-change:robomaker: Documentation updates for RoboMaker
  * api-change:ec2: encryptionInTransitSupported added to DescribeInstanceTypes API
- from version 1.21.25
  * api-change:ec2: The ImportImage API now supports the ability to create
    AMIs with AWS-managed licenses for Microsoft SQL Server for both Windows and
    Linux.
  * api-change:memorydb: AWS MemoryDB SDK now supports all APIs for newly launched MemoryDB service.
  * api-change:application-autoscaling: This release extends Application Auto
    Scaling support for replication group of Amazon ElastiCache Redis clusters.
    Auto Scaling monitors and automatically expands node group count and number of
    replicas per node group when a critical usage threshold is met or according to
    customer-defined schedule.
  * api-change:appflow: This release adds support for SAPOData connector and
    extends Veeva connector for document extraction.
- from version 1.21.24
  * api-change:codebuild: CodeBuild now allows you to make the build results
    for your build projects available to the public without requiring access to an
    AWS account.
  * api-change:route53: Documentation updates for route53
  * api-change:sagemaker-runtime: Update sagemaker-runtime client to latest version
  * api-change:route53resolver: Documentation updates for Route 53 Resolver
  * api-change:sagemaker: Amazon SageMaker now supports Asynchronous Inference
    endpoints. Adds PlatformIdentifier field that allows Notebook Instance creation
    with different platform selections. Increases the maximum number of containers
    in multi-container endpoints to 15. Adds more instance types to InstanceType
    field.
- from version 1.21.23
  * api-change:cloud9: Added DryRun parameter to CreateEnvironmentEC2 API.
    Added ManagedCredentialsActions parameter to UpdateEnvironment API
  * api-change:ec2: This release adds support for EC2 ED25519 key pairs for authentication
  * api-change:clouddirectory: Documentation updates for clouddirectory
  * api-change:ce: This release is a new feature for Cost Categories: Split
    charge rules. Split charge rules enable you to allocate shared costs between
    your cost category values.
  * api-change:logs: Documentation-only update for CloudWatch Logs
- from version 1.21.22
  * api-change:iotsitewise: AWS IoT SiteWise added query window for the
    interpolation interval. AWS IoT SiteWise computes each interpolated value by
    using data points from the timestamp of each interval minus the window to the
    timestamp of each interval plus the window.
  * api-change:s3: Documentation updates for Amazon S3
  * api-change:codebuild: CodeBuild now allows you to select how batch build
    statuses are sent to the source provider for a project.
  * api-change:ds: This release adds support for describing client authentication settings.
  * api-change:config: Update ResourceType enum with values for Backup Plan,
    Selection, Vault, RecoveryPoint; ECS Cluster, Service, TaskDefinition; EFS
    AccessPoint, FileSystem; EKS Cluster; ECR Repository resources
  * api-change:license-manager: AWS License Manager now allows end users to
    call CheckoutLicense API using new CheckoutType PERPETUAL. Perpetual checkouts
    allow sellers to check out a quantity of entitlements to be drawn down for
    consumption.
- from version 1.21.21
  * api-change:quicksight: Documentation updates for QuickSight.
  * api-change:emr: Update emr client to latest version
  * api-change:customer-profiles: This release introduces Standard Profile
    Objects, namely Asset and Case which contain values populated by data from
    third party systems and belong to a specific profile. This release adds an
    optional parameter, ObjectFilter to the ListProfileObjects API in order to
    search for these Standard Objects.
  * api-change:elasticache: This release adds ReplicationGroupCreateTime field
    to ReplicationGroup which indicates the UTC time when ElastiCache
    ReplicationGroup is created
- from version 1.21.20
  * api-change:sagemaker: Amazon SageMaker Autopilot adds new metrics for all
    candidate models generated by Autopilot experiments.
  * api-change:apigatewayv2: Adding support for ACM imported or private CA
    certificates for mTLS enabled domain names
  * api-change:apigateway: Adding support for ACM imported or private CA
    certificates for mTLS enabled domain names
  * api-change:databrew: This SDK release adds support for the output of a
    recipe job results to Tableau Hyper format.
  * api-change:lambda: Lambda Python 3.9 runtime launch
- from version 1.21.19
  * api-change:snow-device-management: AWS Snow Family customers can remotely
    monitor and operate their connected AWS Snowcone devices.
  * api-change:ecs: Documentation updates for ECS.
  * api-change:nimble: Add new attribute 'ownedBy' in Streaming Session APIs.
    'ownedBy' represents the AWS SSO Identity Store User ID of the owner of the
    Streaming Session resource.
  * api-change:codebuild: CodeBuild now allows you to make the build results
    for your build projects available to the public without requiring access to an
    AWS account.
  * api-change:ebs: Documentation updates for Amazon EBS direct APIs.
  * api-change:route53: Documentation updates for route53
- from version 1.21.18
  * api-change:chime: Add support for "auto" in Region field of StartMeetingTranscription API request.
  * enchancement:Client: Improve client performance by caching _alias_event_name on EventAliaser
- from version 1.21.17
  * api-change:wafv2: This release adds APIs to support versioning
    feature of AWS WAF Managed rule groups
  * api-change:rekognition: This release adds support for four new types of
    segments (opening credits, content segments, slates, and studio logos),
    improved accuracy for credits and shot detection and new filters to control
    black frame detection.
  * api-change:ssm: Documentation updates for AWS Systems Manager.
  - from version 1.21.16
  * api-change:synthetics: Documentation updates for Visual Monitoring feature
    and other doc ticket fixes.
  * api-change:chime-sdk-identity: The Amazon Chime SDK Identity APIs allow
    software developers to create and manage unique instances of their messaging
    applications.
  * api-change:chime-sdk-messaging: The Amazon Chime SDK Messaging APIs allow
    software developers to send and receive messages in custom messaging
    applications.
  * api-change:connect: This release adds support for agent status and hours
    of operation. For details, see the Release Notes in the Amazon Connect
    Administrator Guide.
  * api-change:lightsail: This release adds support to track when a bucket
    access key was last used.
  * api-change:athena: Documentation updates for Athena.
- from version 1.21.15
  * api-change:lexv2-models: Update lexv2-models client to latest version
  * api-change:autoscaling: EC2 Auto Scaling adds configuration checks and
    Launch Template validation to Instance Refresh.
- from version 1.21.14
  * api-change:rds: This release adds AutomaticRestartTime to the
    DescribeDBInstances and DescribeDBClusters operations. AutomaticRestartTime
    indicates the time when a stopped DB instance or DB cluster is restarted
    automatically.
  * api-change:imagebuilder: Updated list actions to include a list of valid
    filters that can be used in the request.
  * api-change:transcribe: This release adds support for call analytics
    (batch) within Amazon Transcribe.
  * api-change:events: Update events client to latest version
  * api-change:ssm-incidents: Documentation updates for Incident Manager.
- from version 1.21.13
  * api-change:redshift: API support for Redshift Data Sharing feature.
  * api-change:iotsitewise: My AWS Service (placeholder) - This release
    introduces custom Intervals and offset for tumbling window in metric for AWS
    IoT SiteWise.
  * api-change:glue: Add ConcurrentModificationException to create-table,
    delete-table, create-database, update-database, delete-database
  * api-change:mediaconvert: AWS Elemental MediaConvert SDK has added control
    over the passthrough of XDS captions metadata to outputs.
  * api-change:proton: Docs only add idempotent create apis
- from version 1.21.12
  * api-change:ssm-contacts: Added new attribute in AcceptCode API.
    AcceptCodeValidation takes in two values - ENFORCE, IGNORE. ENFORCE forces
    validation of accept code and IGNORE ignores it which is also the default
    behavior; Corrected TagKeyList length from 200 to 50
  * api-change:greengrassv2: This release adds support for component system
    resource limits and idempotent Create operations. You can now specify the
    maximum amount of CPU and memory resources that each component can use.
- from version 1.21.11
  * api-change:appsync: AWS AppSync now supports a new authorization mode
    allowing you to define your own authorization logic using an AWS Lambda
    function.
  * api-change:elbv2: Update elbv2 client to latest version
  * api-change:secretsmanager: Add support for KmsKeyIds in the
    ListSecretVersionIds API response
  * api-change:sagemaker: API changes with respect to Lambda steps in model
    building pipelines. Adds several waiters to async Sagemaker Image APIs. Add
    more instance types to AppInstanceType field
- from version 1.21.10
  * api-change:savingsplans: Documentation update for valid Savings Plans offering ID pattern
  * api-change:ec2: This release adds support for G4ad xlarge and 2xlarge
    instances powered by AMD Radeon Pro V520 GPUs and AMD 2nd Generation EPYC
    processors
  * api-change:chime: Adds support for live transcription of meetings with
    Amazon Transcribe and Amazon Transcribe Medical. The new APIs,
    StartMeetingTranscription and StopMeetingTranscription, control the generation
    of user-attributed transcriptions sent to meeting clients via Amazon Chime SDK
    data messages.
  * api-change:iotsitewise: Added support for AWS IoT SiteWise Edge. You can
    now create an AWS IoT SiteWise gateway that runs on AWS IoT Greengrass V2. With
    the gateway, you can collect local server and equipment data, process the data,
    and export the selected data from the edge to the AWS Cloud.
  * api-change:iot: Increase maximum credential duration of role alias to 12 hours.
- from version 1.21.9
  * api-change:sso-admin: Documentation updates for
    arn:aws:trebuchet:::service:v1:03a2216d-1cda-4696-9ece-1387cb6f6952
  * api-change:cloudformation: SDK update to support Importing existing Stacks
    to new/existing Self Managed StackSet - Stack Import feature.
- from version 1.21.8
  * api-change:route53: This release adds support for the RECOVERY_CONTROL
    health check type to be used in conjunction with Route53 Application Recovery
    Controller.
  * api-change:iotwireless: Add SidewalkManufacturingSn as an identifier to
    allow Customer to query WirelessDevice, in the response, AmazonId is added in
    the case that Sidewalk device is return.
  * api-change:route53-recovery-control-config: Amazon Route 53 Application
    Recovery Controller's routing control - Routing Control Configuration APIs help
    you create and delete clusters, control panels, routing controls and safety
    rules. State changes (On/Off) of routing controls are not part of configuration
    APIs.
  * api-change:route53-recovery-readiness: Amazon Route 53 Application
    Recovery Controller's readiness check capability continually monitors resource
    quotas, capacity, and network routing policies to ensure that the recovery
    environment is scaled and configured to take over when needed.
  * api-change:quicksight: Add support to use row-level security with tags
    when embedding dashboards for users not provisioned in QuickSight
  * api-change:iotanalytics: IoT Analytics now supports creating a dataset
    resource with IoT SiteWise MultiLayerStorage data stores, enabling customers to
    query industrial data within the service. This release includes adding JOIN
    functionality for customers to query multiple data sources in a dataset.
  * api-change:shield: Change name of DDoS Response Team (DRT) to Shield Response Team (SRT)
  * api-change:lexv2-models: Update lexv2-models client to latest version
  * api-change:redshift-data: Added structures to support new Data API
    operation BatchExecuteStatement, used to execute multiple SQL statements within
    a single transaction.
  * api-change:route53-recovery-cluster: Amazon Route 53 Application Recovery
    Controller's routing control - Routing Control Data Plane APIs help you update
    the state (On/Off) of the routing controls to reroute traffic across
    application replicas in a 100% available manner.
  * api-change:batch: Add support for ListJob filters</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1633435200">- Version update to 1.21.54
  * api-change:``codebuild``: CodeBuild now allows you to select how batch
    build statuses are sent to the source provider for a project.
  * api-change:``efs``: Update efs client to latest version
  * api-change:``kms``: Added SDK examples for ConnectCustomKeyStore, CreateCustomKeyStore,
    CreateKey, DeleteCustomKeyStore, DescribeCustomKeyStores, DisconnectCustomKeyStore,
    GenerateDataKeyPair, GenerateDataKeyPairWithoutPlaintext, GetPublicKey, ReplicateKey,
    Sign, UpdateCustomKeyStore and Verify APIs
- from version 1.21.53
  * api-change:``synthetics``: CloudWatch Synthetics now enables customers to choose a customer
    managed AWS KMS key or an Amazon S3-managed key instead of an AWS managed key (default)
    for the encryption of artifacts that the canary stores in Amazon S3. CloudWatch Synthetics
    also supports artifact S3 location updation now.
  * api-change:``ssm``: When "AutoApprovable" is true for a Change Template, then specifying
  - -auto-approve (boolean) in Start-Change-Request-Execution will create a change request
    that bypasses approver review. (except for change calendar restrictions)
  * api-change:``apprunner``: This release contains several minor bug fixes.
- from version 1.21.52
  * api-change:``network-firewall``: This release adds support for strict ordering for stateful
    rule groups. Using strict ordering, stateful rules are evaluated in the exact order in which
    you provide them.
  * api-change:``dataexchange``: This release enables subscribers to set up automatic exports of
    newly published revisions using the new EventAction API.
  * api-change:``workmail``: This release adds support for mobile device access overrides management
    in Amazon WorkMail.
  * api-change:``account``: This release of the Account Management API enables customers to manage
    the alternate contacts for their AWS accounts.
    For more information, see https://docs.aws.amazon.com/accounts/latest/reference/accounts-welcome.html
  * api-change:``workspaces``: Added CreateUpdatedWorkspaceImage API to update WorkSpace images with
    latest software and drivers. Updated DescribeWorkspaceImages API to display if there are updates
    available for WorkSpace images.
  * api-change:``cloudcontrol``: Initial release of the SDK for AWS Cloud Control API
  * api-change:``macie2``: Amazon S3 bucket metadata now indicates whether an error or a bucket's
    permissions settings prevented Amazon Macie from retrieving data about the bucket or the bucket's
    objects.
- from version 1.21.51
  * api-change:``lambda``: Adds support for Lambda functions powered by AWS Graviton2 processors.
    Customers can now select the CPU architecture for their functions.
  * api-change:``sesv2``: This release includes the ability to use 2048 bits RSA key pairs for DKIM
    in SES, either with Easy DKIM or Bring Your Own DKIM.
  * api-change:``amp``: This release adds alert manager and rule group namespace APIs
- from version 1.21.50
  * api-change:``transfer``: Added changes for managed workflows feature APIs.
  * api-change:``imagebuilder``: Fix description for AmiDistributionConfiguration Name property,
    which actually refers to the output AMI name. Also updated for consistent terminology to use
    "base" image, and another update to fix description text.
- from version 1.21.49
  * api-change:``appintegrations``: The Amazon AppIntegrations service enables you to configure
    and reuse connections to external applications.
  * api-change:``wisdom``: Released Amazon Connect Wisdom, a feature of Amazon Connect, which provides
    real-time recommendations and search functionality in general availability (GA).
    For more information, see https://docs.aws.amazon.com/wisdom/latest/APIReference/Welcome.html.
  * api-change:``pinpoint``: Added support for journey with contact center activity
  * api-change:``voice-id``: Released the Amazon Voice ID SDK, for usage with the Amazon Connect
    Voice ID feature released for Amazon Connect.
  * api-change:``connect``: This release updates a set of APIs: CreateIntegrationAssociation,
    ListIntegrationAssociations, CreateUseCase, and StartOutboundVoiceContact. You can use it to
    create integrations with Amazon Pinpoint for the Amazon Connect Campaigns use case, Amazon
    Connect Voice ID, and Amazon Connect Wisdom.
  * api-change:``elbv2``: Update elbv2 client to latest version
- from version 1.21.48
  * api-change:``license-manager``: AWS License Manager now allows customers to get the LicenseArn
    in the Checkout API Response.
  * api-change:``ec2``: DescribeInstances now returns Platform Details, Usage Operation, and Usage
    Operation Update Time.
- from version 1.21.47
  * api-change:``mediaconvert``: This release adds style and positioning support for caption or
    subtitle burn-in from rich text sources such as TTML. This release also introduces configurable
    image-based trick play track generation.
  * api-change:``appsync``: Documented the new OpenSearchServiceDataSourceConfig data type. Added
    deprecation notes to the ElasticsearchDataSourceConfig data type.
  * api-change:``ssm``: Added cutoff behavior support for preventing new task invocations from
    starting when the maintenance window cutoff time is reached.
- from version 1.21.46
  * api-change:``imagebuilder``: This feature adds support for specifying GP3 volume throughput and
    configuring instance metadata options for instances launched by EC2 Image Builder.
  * api-change:``wafv2``: Added the regex match rule statement, for matching web requests against
    a single regular expression.
  * api-change:``mediatailor``: This release adds support to configure logs for playback configuration.
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``iam``: Added changes to OIDC API about not using port numbers in the URL.
  * api-change:``license-manager``: AWS License Manager now allows customers to change their Windows
    Server or SQL license types from Bring-Your-Own-License (BYOL) to License Included or vice-versa
    (using the customer's media).
  * api-change:``mediapackage-vod``: MediaPackage VOD will now return the current processing statuses
    of an asset's endpoints. The status can be QUEUED, PROCESSING, PLAYABLE, or FAILED.
- from version 1.21.45
  * api-change:``comprehend``: Amazon Comprehend now supports versioning of custom models, improved
    training with ONE_DOC_PER_FILE text documents for custom entity recognition, ability to provide
    specific test sets during training, and live migration to new model endpoints.
  * api-change:``iot``: This release adds support for verifying, viewing and filtering AWS IoT Device
    Defender detect violations with four verification states.
  * api-change:``ecr``: This release adds additional support for repository replication
  * api-change:``ec2``: This update adds support for downloading configuration templates using new
    APIs (GetVpnConnectionDeviceTypes and GetVpnConnectionDeviceSampleConfiguration) and Internet
    Key Exchange version 2 (IKEv2) parameters for many popular CGW devices.
- from version 1.21.44
  * api-change:``opensearch``: This release adds an optional parameter in the ListDomainNames API to
    filter domains based on the engine type (OpenSearch/Elasticsearch).
  * api-change:``es``: This release adds an optional parameter in the ListDomainNames API to filter
    domains based on the engine type (OpenSearch/Elasticsearch).
  * api-change:``dms``: Optional flag force-planned-failover added to reboot-replication-instance
    API call. This flag can be used to test a planned failover scenario used during some maintenance
    operations.
- from version 1.21.43
  * api-change:``kafkaconnect``: This is the initial SDK release for Amazon Managed Streaming for
    Apache Kafka Connect (MSK Connect).
  * api-change:``macie2``: This release adds support for specifying which managed data identifiers
    are used by a classification job, and retrieving a list of managed data identifiers that are
    available.
  * api-change:``robomaker``: Adding support to create container based Robot and Simulation
    applications by introducing an environment field
  * api-change:``s3``: Add support for access point arn filtering in S3 CW Request Metrics
  * api-change:``transcribe``: This release adds support for subtitling with Amazon
    Transcribe batch jobs.
  * api-change:``sagemaker``: Add API for users to retry a failed pipeline execution
    or resume a stopped one.
  * api-change:``pinpoint``: This SDK release adds a new feature for Pinpoint campaigns,
    in-app messaging.
- from version 1.21.42
  * api-change:``sagemaker``: This release adds support for "Project Search"
  * api-change:``ec2``: This release adds support for vt1 3xlarge, 6xlarge and 24xlarge instances
    powered by Xilinx Alveo U30 Media Accelerators for video transcoding workloads
  * api-change:``wafv2``: This release adds support for including rate based rules in a rule group.
  * api-change:``chime``: Adds support for SipHeaders parameter for CreateSipMediaApplicationCall.
  * api-change:``comprehend``: Amazon Comprehend now allows you to train and run PDF and Word
    documents for custom entity recognition. With PDF and Word formats, you can extract information
    from documents containing headers, lists and tables.
- from version 1.21.41
  * api-change:``iot``: AWS IoT Rules Engine adds OpenSearch action. The OpenSearch rule action
    lets you stream data from IoT sensors and applications to Amazon OpenSearch Service which
    is a successor to Amazon Elasticsearch Service.
  * api-change:``ec2``: Adds support for T3 instances on Amazon EC2 Dedicated Hosts.
  * enhancement:Tagged Unions: Introducing support for the `union` trait on structures in request
    and response objects.
- from version 1.21.40
  * api-change:``cloudformation``: Doc only update for CloudFormation that fixes several
    customer-reported issues.
  * api-change:``rds``: This release adds support for providing a custom timeout value for
    finding a scaling point during autoscaling in Aurora Serverless v1.
  * api-change:``ecr``: This release updates terminology around KMS keys.
  * api-change:``sagemaker``: This release adds support for "Lifecycle Configurations" to
    SageMaker Studio
  * api-change:``transcribe``: This release adds an API option for startTranscriptionJob and
    startMedicalTranscriptionJob that allows the user to specify encryption context key value
    pairs for batch jobs.
  * api-change:``quicksight``: Add new data source type for Amazon OpenSearch
    (successor to Amazon ElasticSearch).
- from version 1.21.39
  * api-change:``emr``: Update emr client to latest version
  * api-change:``codeguru-reviewer``: The Amazon CodeGuru Reviewer API now includes the
    RuleMetadata data object and a Severity attribute on a RecommendationSummary object.
    A RuleMetadata object contains information about a rule that generates a recommendation.
    Severity indicates how severe the issue associated with a recommendation is.
  * api-change:``lookoutequipment``: Added OffCondition parameter to CreateModel API
- from version 1.21.38
  * api-change:``opensearch``: Updated Configuration APIs for Amazon OpenSearch Service
    (successor to Amazon Elasticsearch Service)
  * api-change:``ram``: A minor text-only update that fixes several customer issues.
  * api-change:``kafka``: Amazon MSK has added a new API that allows you to update the
    encrypting and authentication settings for an existing cluster.
- from version 1.21.37
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``amp``: This release adds tagging support for Amazon Managed Service
    for Prometheus workspace.
  * api-change:``forecast``: Predictor creation now supports selecting an accuracy metric
    to optimize in AutoML and hyperparameter optimization. This release adds additional
    accuracy metrics for predictors - AverageWeightedQuantileLoss, MAPE and MASE.
  * api-change:``xray``: Updated references to AWS KMS keys and customer managed
    keys to reflect current terminology.
  * api-change:``ssm-contacts``: Added SDK examples for SSM-Contacts.
  * api-change:``mediapackage``: SPEKE v2 support for live CMAF packaging type. SPEKE v2
    is an upgrade to the existing SPEKE API to support multiple encryption keys, it supports
    live DASH currently.
  * api-change:``eks``: Adding RegisterCluster and DeregisterCluster operations, to support
    connecting external clusters to EKS.
- from version 1.21.36
  * api-change:``chime-sdk-identity``: Documentation updates for Chime
  * api-change:``chime-sdk-messaging``: Documentation updates for Chime
  * api-change:``outposts``: This release adds a new API CreateOrder.
  * api-change:``frauddetector``: Enhanced GetEventPrediction API response to include
    risk scores from imported SageMaker models
  * api-change:``codeguru-reviewer``: Added support for CodeInconsistencies detectors
- from version 1.21.35
  * api-change:``acm-pca``: Private Certificate Authority Service now allows customers
    to enable an online certificate status protocol (OCSP) responder service on their
    private certificate authorities. Customers can also optionally configure a custom
    CNAME for their OCSP responder.
  * api-change:``s3control``: S3 Multi-Region Access Points provide a single global
    endpoint to access a data set that spans multiple S3 buckets in different AWS Regions.
  * api-change:``accessanalyzer``: Updates service API, documentation, and paginators to
    support multi-region access points from Amazon S3.
  * api-change:``schemas``: This update include the support for Schema Discoverer to
    discover the events sent to the bus from another account. The feature will be enabled
    by default when discoverer is created or updated but can also be opt-in or opt-out
    by specifying the value for crossAccount.
  * api-change:``securityhub``: New ASFF Resources: AwsAutoScalingLaunchConfiguration,
    AwsEc2VpnConnection, AwsEcrContainerImage. Added KeyRotationStatus to AwsKmsKey.
    Added AccessControlList, BucketLoggingConfiguration,BucketNotificationConfiguration
    and BucketNotificationConfiguration to AwsS3Bucket.
  * enhancement:s3: Added support for S3 Multi-Region Access Points
  * api-change:``efs``: Update efs client to latest version
  * api-change:``transfer``: AWS Transfer Family introduces Managed Workflows for creating,
    executing, monitoring, and standardizing post file transfer processing
  * api-change:``ebs``: Documentation updates for Amazon EBS direct APIs.
  * api-change:``quicksight``: This release adds support for referencing parent
    datasets as sources in a child dataset.
  * api-change:``fsx``: Announcing Amazon FSx for NetApp ONTAP, a new service that provides
    fully managed shared storage in the AWS Cloud with the data access and management
    capabilities of ONTAP.
  * enhancement:Signers: Added support for Sigv4a Signing Algorithm
  * api-change:``lex-models``: Lex now supports Korean (ko-KR) locale.
- from version 1.21.34
  * api-change:``ec2``: Added LaunchTemplate support for the IMDS IPv6 endpoint
  * api-change:``cloudtrail``: Documentation updates for CloudTrail
  * api-change:``mediatailor``: This release adds support for wall clock
    programs in LINEAR channels.
  * api-change:``config``: Documentation updates for config
  * api-change:``servicecatalog-appregistry``: Introduction of GetAssociatedResource
    API and GetApplication response extension for Resource Groups support.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1635508800">- Version update to 1.22.6
  * api-change:``gamelift``: Added support for Arm-based AWS Graviton2 instances,
    such as M6g, C6g, and R6g.
  * api-change:``ecs``: Amazon ECS now supports running Fargate tasks on Windows
    Operating Systems Families which includes Windows Server 2019 Core and Windows
    Server 2019 Full.
  * api-change:``sagemaker``: This release adds support for RStudio on SageMaker.
  * api-change:``connectparticipant``: This release adds a new boolean attribute
  - Connect Participant - to the CreateParticipantConnection API, which can be
    used to mark the participant as connected.
  * api-change:``ec2``: Added new read-only DenyAllIGWTraffic network interface
    attribute. Added support for DL1 24xlarge instances powered by Habana Gaudi
    Accelerators for deep learning model training workloads
  * api-change:``ssm-incidents``: Updating documentation, adding new field to
    ConflictException to indicate earliest retry timestamp for some operations,
    increase maximum length of nextToken fields
- from version 1.22.5
  * api-change:``autoscaling``: This release adds support for attribute-based
    instance type selection, a new EC2 Auto Scaling feature that lets customers
    express their instance requirements as a set of attributes, such as vCPU,
    memory, and storage.
  * api-change:``ec2``: This release adds: attribute-based instance type selection
    for EC2 Fleet, Spot Fleet, a feature that lets customers express instance
    requirements as attributes like vCPU, memory, and storage; and Spot placement
    score, a feature that helps customers identify an optimal location to run
    Spot workloads.
  * api-change:``eks``: EKS managed node groups now support BOTTLEROCKET_x86_64
    and BOTTLEROCKET_ARM_64 AMI types.
  * api-change:``sagemaker``: This release allows customers to describe one or
    more versioned model packages through BatchDescribeModelPackage, update
    project via UpdateProject, modify and read customer metadata properties
    using Create, Update and Describe ModelPackage and enables cross account
    registration of model packages.
  * enhancement:Session: Added `get_partition_for_region` allowing partition
    lookup by region name.
  * api-change:``textract``: This release adds support for asynchronously analyzing
    invoice and receipt documents through two new APIs: StartExpenseAnalysis and
    GetExpenseAnalysis
- from version 1.22.4
  * api-change:``emr-containers``: This feature enables auto-generation of certificate
    to secure the managed-endpoint and removes the need for customer provided
    certificate-arn during managed-endpoint setup.
  * api-change:``chime-sdk-messaging``: The Amazon Chime SDK now supports push
    notifications through Amazon Pinpoint
  * api-change:``chime-sdk-identity``: The Amazon Chime SDK now supports push
    notifications through Amazon Pinpoint
- from version 1.22.3
  * api-change:``rds``: This release adds support for Amazon RDS Custom, which
    is a new RDS management type that gives you full access to your database
    and operating system.
    For more information, see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-custom.html
  * api-change:``auditmanager``: This release introduces a new feature for Audit
    Manager: Custom framework sharing. You can now share your custom frameworks
    with another AWS account, or replicate them into another AWS Region under
    your own account.
  * api-change:``ec2``: This release adds support to create a VPN Connection
    that is not attached to a Gateway at the time of creation. Use this to
    create VPNs associated with Core Networks, or modify your VPN and attach
    a gateway using the modify API after creation.
  * api-change:``route53resolver``: New API for ResolverConfig, which allows
    autodefined rules for reverse DNS resolution to be disabled for a VPC
- from version 1.22.2
  * api-change:``quicksight``: Added QSearchBar option for GenerateEmbedUrlForRegisteredUser
    ExperienceConfiguration to support Q search bar embedding
  * api-change:``auditmanager``: This release introduces character restrictions for
    ControlSet names. We updated regex patterns for the following attributes:
    ControlSet, CreateAssessmentFrameworkControlSet, and UpdateAssessmentFrameworkControlSet.
  * api-change:``chime``: Chime VoiceConnector and VoiceConnectorGroup APIs
    will now return an ARN.
- from version 1.22.1
  * api-change:``connect``: Released Amazon Connect hours of operation API for
    general availability (GA). This API also supports AWS CloudFormation. For
    more information, see Amazon Connect Resource Type Reference in the AWS
    CloudFormation User Guide.
- from version 1.22.0
  * api-change:``appflow``: Feature to add support for  JSON-L format
    for S3 as a source.
  * api-change:``mediapackage-vod``: MediaPackage passes through digital
    video broadcasting (DVB) subtitles into the output.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added
    support for specifying caption time delta in milliseconds and the ability
    to apply color range legalization to source content other than AVC video.
  * api-change:``mediapackage``: When enabled, MediaPackage passes through
    digital video broadcasting (DVB) subtitles into the output.
  * api-change:``panorama``: General availability for AWS Panorama. AWS SDK
    for Panorama includes APIs to manage your devices and nodes, and deploy
    computer vision applications to the edge. For more information, see the
    AWS Panorama documentation at http://docs.aws.amazon.com/panorama
  * feature:Serialization: rest-json serialization defaults aligned across AWS SDKs
  * api-change:``directconnect``: This release adds 4 new APIS, which needs to be public able
  * api-change:``securityhub``: Added support for cross-Region finding aggregation,
    which replicates findings from linked Regions to a single aggregation Region.
    Added operations to view, enable, update, and delete the finding aggregation.
- from version 1.21.65
  * api-change:``dataexchange``: This release adds support for our public preview
    of AWS Data Exchange for Amazon Redshift. This enables data providers to list
    products including AWS Data Exchange datashares for Amazon Redshift, giving
    subscribers read-only access to provider data in Amazon Redshift.
  * api-change:``chime-sdk-messaging``: The Amazon Chime SDK now allows developers
    to execute business logic on in-flight messages before they are delivered to
    members of a messaging channel with channel flows.
- from version 1.21.64
  * api-change:``quicksight``: AWS QuickSight Service  Features - Add IP Restriction
    UI and public APIs support.
  * enchancement:AWSCRT: Upgrade awscrt extra to 0.12.5
  * api-change:``ivs``: Bug fix: remove unsupported maxResults and nextToken
    pagination parameters from ListTagsForResource
- from version 1.21.63
  * api-change:``efs``: Update efs client to latest version
  * api-change:``glue``: Enable S3 event base crawler API.
- from version 1.21.62
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``autoscaling``: Amazon EC2 Auto Scaling now supports filtering
    describe Auto Scaling groups API using tags
  * api-change:``sagemaker``: This release updates the provisioning artifact ID
    to an optional parameter in CreateProject API. The provisioning artifact ID
    defaults to the latest provisioning artifact ID of the product if you don't
    provide one.
  * api-change:``robomaker``: Adding support to GPU simulation jobs as well
    as non-ROS simulation jobs.
- from version 1.21.61
  * api-change:``config``: Adding Config support for AWS::OpenSearch::Domain
  * api-change:``ec2``: This release adds support for additional VPC Flow Logs
    delivery options to S3, such as Apache Parquet formatted files, Hourly
    partitions and Hive-compatible S3 prefixes
  * api-change:``storagegateway``: Adding support for Audit Logs on NFS shares
    and Force Closing Files on SMB shares.
  * api-change:``workmail``: This release adds APIs for adding, removing and
    retrieving details of mail domains
  * api-change:``kinesisanalyticsv2``: Support for Apache Flink 1.13 in Kinesis
    Data Analytics. Changed the required status of some Update properties to better
    fit the corresponding Create properties.
- from version 1.21.60
  * api-change:``cloudsearch``: Adds an additional validation exception for
    Amazon CloudSearch configuration APIs for better error handling.
  * api-change:``ecs``: Documentation only update to address tickets.
  * api-change:``mediatailor``: MediaTailor now supports ad prefetching.
  * api-change:``ec2``: EncryptionSupport for InstanceStorageInfo added
    to DescribeInstanceTypes API
- from version 1.21.59
  * api-change:``elbv2``: Update elbv2 client to latest version
  * bugfix:Signing: SigV4QueryAuth and CrtSigV4QueryAuth now properly respect
    AWSRequest.params while signing boto/botocore (#2521)
  * api-change:``medialive``: This release adds support for Transport Stream
    files as an input type to MediaLive encoders.
  * api-change:``ec2``: Documentation update for Amazon EC2.
  * api-change:``frauddetector``: New model type: Transaction Fraud Insights,
    which is optimized for online transaction fraud. Stored Events, which allows
    customers to send and store data directly within Amazon Fraud Detector.
    Batch Import, which allows customers to upload a CSV file of historic
    event data for processing and storage
- from version 1.21.58
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager
  * api-change:``securityhub``: Added new resource details objects to ASFF,
    including resources for WAF rate-based rules, EC2 VPC endpoints, ECR
    repositories, EKS clusters, X-Ray encryption, and OpenSearch domains.
    Added additional details for CloudFront distributions, CodeBuild projects,
    ELB V2 load balancers, and S3 buckets.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert has added the ability
    to set account policies which control access restrictions for HTTP, HTTPS,
    and S3 content sources.
  * api-change:``ec2``: This release removes a requirement for filters on
    SearchLocalGatewayRoutes operations.
- from version 1.21.57
  * api-change:``kendra``: Amazon Kendra now supports indexing and querying
    documents in different languages.
  * api-change:``grafana``: Initial release of the SDK for Amazon Managed Grafana API.
  * api-change:``firehose``: Allow support for Amazon Opensearch Service(successor
    to Amazon Elasticsearch Service) as a Kinesis Data Firehose delivery destination.
  * api-change:``backup``: Launch of AWS Backup Vault Lock, which protects your
    backups from malicious and accidental actions, works with existing backup policies,
    and helps you meet compliance requirements.
  * api-change:``schemas``: Removing unused request/response objects.
  * api-change:``chime``: This release enables customers to configure Chime
    MediaCapturePipeline via API.
- from version 1.21.56
  * api-change:``sagemaker``: This release adds a new TrainingInputMode FastFile
    for SageMaker Training APIs.
  * api-change:``amplifybackend``: Adding a new field 'AmplifyFeatureFlags' to the
    response of the GetBackend operation. It will return a stringified version of
    the cli.json file for the given Amplify project.
  * api-change:``fsx``: This release adds support for Lustre 2.12 to FSx for Lustre.
  * api-change:``kendra``: Amazon Kendra now supports integration with AWS SSO
- from version 1.21.55
  * api-change:``workmail``: This release allows customers to change their inbound
    DMARC settings in Amazon WorkMail.
  * api-change:``location``: Add support for PositionFiltering.
  * api-change:``application-autoscaling``: With this release, Application Auto
    Scaling adds support for Amazon Neptune. Customers can now automatically add
    or remove Read Replicas of their Neptune clusters to keep the average CPU
    Utilization at the target value specified by the customers.
  * api-change:``ec2``: Released Capacity Reservation Fleet, a feature of Amazon
    EC2 Capacity Reservations, which provides a way to manage reserved capacity
    across instance types.
    For more information: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cr-fleets.html
  * api-change:``glue``: This release adds tag as an input of CreateConnection
  * api-change:``backup``: AWS Backup Audit Manager framework report.
- Remove unnecessary dependencies from BuildRequires
- Skip integration tests as these require an internet connection
- Switch package to multibuild and split tests into separate package
- Switch tests from nose to pytest</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1639656000">- Version update to 1.23.24
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager
- from version 1.23.23
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``network-firewall``: This release adds support for managed rule groups.
  * api-change:``route53-recovery-control-config``: This release adds tagging supports to Route53
    Recovery Control Configuration. New APIs: TagResource, UntagResource and ListTagsForResource.
    Updates: add optional field `tags` to support tagging while calling CreateCluster,
    CreateControlPanel and CreateSafetyRule.
  * api-change:``ec2``: Adds waiters support for internet gateways.
  * api-change:``sms``: This release adds SMS discontinuation information to the API and CLI
    references.
  * api-change:``route53domains``: Amazon Route 53 domain registration APIs now support filtering and
    sorting in the ListDomains API, deleting a domain by using the DeleteDomain API and getting domain
    pricing information by using the ListPrices API.
  * api-change:``savingsplans``: Adds the ability to specify Savings Plans hourly commitments using
    five digits after the decimal point.
- from version 1.23.22
  * api-change:``lookoutvision``: This release adds new APIs for packaging an Amazon Lookout for
    Vision model as an AWS IoT Greengrass component.
  * api-change:``sagemaker``: This release added a new Ambarella device(amba_cv2) compilation support
    for Sagemaker Neo.
  * api-change:``comprehendmedical``: This release adds a new set of APIs (synchronous and batch) to
    support the SNOMED-CT ontology.
  * api-change:``health``: Documentation updates for AWS Health
  * api-change:``logs``: This release adds AWS Organizations support as condition key in destination
    policy for cross account Subscriptions in CloudWatch Logs.
  * api-change:``outposts``: This release adds the UpdateOutpost API.
  * api-change:``support``: Documentation updates for AWS Support.
  * api-change:``iot``: This release allows customer to enable caching of custom authorizer on HTTP
    protocol for clients that use persistent or Keep-Alive connection in order to reduce the number of
    Lambda invocations.
- from version 1.23.21
  * api-change:``location``: This release adds support for Accuracy position filtering, position
    metadata and autocomplete for addresses and points of interest based on partial or misspelled
    free-form text.
  * api-change:``appsync``: AWS AppSync now supports custom domain names, allowing you to associate a
    domain name that you own with an AppSync API in your account.
  * api-change:``route53``: Add PriorRequestNotComplete exception to UpdateHostedZoneComment API
- from version 1.23.20
  * api-change:``rekognition``: This release added new KnownGender types for Celebrity Recognition.
- from version 1.23.19
  * api-change:``ram``: This release adds the ability to use the new ResourceRegionScope parameter on
    List operations that return lists of resources or resource types. This new parameter filters the
    results by letting you differentiate between global or regional resource types.
  * api-change:``networkmanager``: This release adds API support for AWS Cloud WAN.
  * api-change:``amplifyuibuilder``: This release introduces the actions and data types for the new
    Amplify UI Builder API. The Amplify UI Builder API provides a programmatic interface for creating
    and configuring user interface (UI) component libraries and themes for use in Amplify applications.
- from version 1.23.18
  * api-change:``sagemaker``: This release enables - 1/ Inference endpoint configuration
    recommendations and ability to run custom load tests to meet performance needs. 2/ Deploy
    serverless inference endpoints. 3/ Query, filter and retrieve end-to-end ML lineage graph, and
    incorporate model quality/bias detection in ML workflow.
  * api-change:``kendra``: Experience Builder allows customers to build search applications without
    writing code. Analytics Dashboard provides quality and usability metrics for Kendra indexes. Custom
    Document Enrichment allows customers to build a custom ingestion pipeline to pre-process documents
    and generate metadata.
  * api-change:``directconnect``: Adds SiteLink support to private and transit virtual interfaces.
    SiteLink is a new Direct Connect feature that allows routing between Direct Connect points of
    presence.
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``ec2``: This release adds support for Amazon VPC IP Address Manager (IPAM), which
    enables you to plan, track, and monitor IP addresses for your workloads. This release also adds
    support for VPC Network Access Analyzer, which enables you to analyze network access to resources
    in your Virtual Private Clouds.
  * api-change:``shield``: This release adds API support for Automatic Application Layer DDoS
    Mitigation for AWS Shield Advanced. Customers can now enable automatic DDoS mitigation in count or
    block mode for layer 7 protected resources.
  * api-change:``sagemaker-runtime``: Update sagemaker-runtime client to latest version
  * api-change:``devops-guru``: DevOps Guru now provides detailed, database-specific analyses of
    performance issues and recommends corrective actions for Amazon Aurora database instances with
    Performance Insights turned on. You can also use AWS tags to choose which resources to analyze and
    define your applications.
  * api-change:``dynamodb``: Add support for Table Classes and introduce the Standard Infrequent
    Access table class.
- from version 1.23.17
  * api-change:``s3``: Introduce Amazon S3 Glacier Instant Retrieval storage class and a new setting
    in S3 Object Ownership to disable ACLs for bucket and the objects in it.
  * api-change:``backup-gateway``: Initial release of AWS Backup gateway which enables you to
    centralize and automate protection of on-premises VMware and VMware Cloud on AWS workloads using
    AWS Backup.
  * api-change:``iot``: Added the ability to enable/disable IoT Fleet Indexing for Device Defender
    and Named Shadow information, and search them through IoT Fleet Indexing APIs.
  * api-change:``ec2``: This release adds support for Is4gen and Im4gn instances. This release also
    adds a new subnet attribute, enableLniAtDeviceIndex, to support local network interfaces, which are
    logical networking components that connect an EC2 instance to your on-premises network.
  * api-change:``outposts``: This release adds the SupportedHardwareType parameter to CreateOutpost.
  * api-change:``storagegateway``: Added gateway type VTL_SNOW. Added new SNOWBALL HostEnvironment
    for gateways running on a Snowball device. Added new field HostEnvironmentId to serve as an
    identifier for the HostEnvironment on which the gateway is running.
  * api-change:``kinesis``: Amazon Kinesis Data Streams now supports on demand streams.
  * api-change:``glue``: Support for DataLake transactions
  * api-change:``accessanalyzer``: AWS IAM Access Analyzer now supports policy validation for
    resource policies attached to S3 buckets and access points. You can run additional policy checks by
    specifying the S3 resource type you want to attach to your resource policy.
  * api-change:``lakeformation``: This release adds support for row and cell-based access control in
    Lake Formation. It also adds support for Lake Formation Governed Tables, which support ACID
    transactions and automatic storage optimizations.
  * api-change:``kafka``: This release adds three new V2 APIs. CreateClusterV2 for creating both
    provisioned and serverless clusters. DescribeClusterV2 for getting information about provisioned
    and serverless clusters and ListClustersV2 for listing all clusters (both provisioned and
    serverless) in your account.
  * api-change:``redshift-data``: Data API now supports serverless queries.
  * api-change:``snowball``: Tapeball is to integrate tape gateway onto snowball, it enables customer
    to transfer local data on the tape to snowball,and then ingest the data into tape gateway on the
    cloud.
  * api-change:``workspaces-web``: This is the initial SDK release for Amazon WorkSpaces Web. Amazon
    WorkSpaces Web is a low-cost, fully managed WorkSpace built to deliver secure web-based workloads
    and software-as-a-service (SaaS) application access to users within existing web browsers.
  * api-change:``iottwinmaker``: AWS IoT TwinMaker makes it faster and easier to create, visualize
    and monitor digital twins of real-world systems like buildings, factories and industrial equipment
    to optimize operations. Learn more:
    https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/Welcome.html (New Service) (Preview)
  * api-change:``fsx``: This release adds support for the FSx for OpenZFS file system type, FSx for
    Lustre file systems with the Persistent_2 deployment type, and FSx for Lustre file systems with
    Amazon S3 data repository associations and automatic export policies.
- from version 1.23.16
  * api-change:``s3``: Amazon S3 Event Notifications adds Amazon EventBridge as a destination and
    supports additional event types. The PutBucketNotificationConfiguration API can now skip validation
    of Amazon SQS, Amazon SNS and AWS Lambda destinations.
  * api-change:``wellarchitected``: This update provides support for Well-Architected API users to
    use custom lens features.
  * api-change:``rum``: This is the first public release of CloudWatch RUM
  * api-change:``rbin``: This release adds support for Recycle Bin.
  * api-change:``iotsitewise``: AWS IoT SiteWise now supports retention configuration for the hot
    tier storage.
  * api-change:``compute-optimizer``: Adds support for the enhanced infrastructure metrics paid
    feature. Also adds support for two new sets of resource efficiency metrics, including savings
    opportunity metrics and performance improvement opportunity metrics.
  * api-change:``ecr``: This release adds supports for pull through cache rules and enhanced scanning.
  * api-change:``evidently``: Introducing Amazon CloudWatch Evidently. This is the first public
    release of Amazon CloudWatch Evidently.
  * api-change:``inspector2``: This release adds support for the new Amazon Inspector API. The new
    Amazon Inspector can automatically discover and scan Amazon EC2 instances and Amazon ECR container
    images for software vulnerabilities and unintended network exposure, and report centralized
    findings across multiple AWS accounts.
  * api-change:``ssm``: Added two new attributes to DescribeInstanceInformation called SourceId and
    SourceType along with new string filters SourceIds and SourceTypes to filter instance records.
  * api-change:``ec2``: This release adds support for G5g and M6a instances. This release also adds
    support for Amazon EBS Snapshots Archive, a feature that enables you to archive your EBS snapshots;
    and Recycle Bin, a feature that enables you to protect your EBS snapshots against accidental
    deletion.
  * api-change:``dataexchange``: This release enables providers and subscribers to use Data Set, Job,
    and Asset operations to work with API assets from Amazon API Gateway. In addition, this release
    enables subscribers to use the SendApiAsset operation to invoke a provider's Amazon API Gateway API
    that they are entitled to.
- from version 1.23.15
  * api-change:``migration-hub-refactor-spaces``: This is the initial SDK release for AWS Migration
    Hub Refactor Spaces
  * api-change:``textract``: This release adds support for synchronously analyzing identity documents
    through a new API: AnalyzeID
  * api-change:``personalize-runtime``: This release adds inference support for Recommenders.
  * api-change:``personalize``: This release adds API support for Recommenders and BatchSegmentJobs.
- from version 1.23.14
  * api-change:``autoscaling``: Documentation updates for Amazon EC2 Auto Scaling.
  * api-change:``mgn``: Application Migration Service now supports an additional replication method
    that does not require agent installation on each source server. This option is available for source
    servers running on VMware vCenter versions 6.7 and 7.0.
  * api-change:``ec2``: Documentation updates for EC2.
  * api-change:``iotdeviceadvisor``: Documentation update for Device Advisor GetEndpoint API
  * api-change:``pinpoint``: Added a One-Time Password (OTP) management feature. You can use the
    Amazon Pinpoint API to generate OTP codes and send them to your users as SMS messages. Your apps
    can then call the API to verify the OTP codes that your users input
  * api-change:``outposts``: This release adds new APIs for working with Outpost sites and orders.
- from version 1.23.13
  * api-change:``timestream-query``: Releasing Amazon Timestream Scheduled Queries. It makes
    real-time analytics more performant and cost-effective for customers by calculating and storing
    frequently accessed aggregates, and other computations, typically used in operational dashboards,
    business reports, and other analytics applications
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``proton``: This release adds APIs for getting the outputs and provisioned stacks for
    Environments, Pipelines, and ServiceInstances.  You can now add tags to
    EnvironmentAccountConnections.  It also adds APIs for working with PR-based provisioning.  Also, it
    adds APIs for syncing templates with a git repository.
  * api-change:``translate``: This release enables customers to use translation settings to mask
    profane words and phrases in their translation output.
  * api-change:``lambda``: Remove Lambda function url apis
  * api-change:``imagebuilder``: This release adds support for sharing AMIs with Organizations within
    an EC2 Image Builder Distribution Configuration.
  * api-change:``customer-profiles``: This release introduces a new auto-merging feature for profile
    matching. The auto-merging configurations can be set via CreateDomain API or UpdateDomain API. You
    can use GetIdentityResolutionJob API and ListIdentityResolutionJobs API to fetch job status.
  * api-change:``autoscaling``: Customers can now configure predictive scaling policies to
    proactively scale EC2 Auto Scaling groups based on any CloudWatch metrics that more accurately
    represent the load on the group than the four predefined metrics. They can also use math
    expressions to further customize the metrics.
  * api-change:``timestream-write``: This release adds support for multi-measure records and magnetic
    store writes. Multi-measure records allow customers to store multiple measures in a single table
    row. Magnetic store writes enable customers to write late arrival data (data with timestamp in the
    past) directly into the magnetic store.
  * api-change:``iotsitewise``: AWS IoT SiteWise now accepts data streams that aren't associated with
    any asset properties. You can organize data by updating data stream associations.
- from version 1.23.12
  * api-change:``redshift``: This release adds support for reserved node exchange with restore/resize
  * api-change:``elasticache``: Adding support for r6gd instances for Redis with data tiering. In a
    cluster with data tiering enabled, when available memory capacity is exhausted, the least recently
    used data is automatically tiered to solid state drives for cost-effective capacity scaling with
    minimal performance impact.
  * api-change:``opensearch``: This release adds an optional parameter dry-run for the
    UpdateDomainConfig API to perform basic validation checks, and detect the deployment type that will
    be required for the configuration change, without actually applying the change.
  * api-change:``backup``: This release adds new opt-in settings for advanced features for DynamoDB
    backups
  * api-change:``iot``: This release introduces a new feature, Managed Job Template, for AWS IoT Jobs
    Service. Customers can now use service provided managed job templates to easily create jobs for
    supported standard job actions.
  * api-change:``iotwireless``: Two new APIs, GetNetworkAnalyzerConfiguration and
    UpdateNetworkAnalyzerConfiguration, are added for the newly released Network Analyzer feature which
    enables customers to view real-time frame information and logs from LoRaWAN devices and gateways.
  * api-change:``workspaces``: Documentation updates for Amazon WorkSpaces
  * api-change:``s3``: Introduce two new Filters to S3 Lifecycle configurations -
    ObjectSizeGreaterThan and ObjectSizeLessThan. Introduce a new way to trigger actions on noncurrent
    versions by providing the number of newer noncurrent versions along with noncurrent days.
  * api-change:``elbv2``: Update elbv2 client to latest version
  * api-change:``macie2``: Documentation updates for Amazon Macie
  * api-change:``ec2``: This release adds a new parameter ipv6Native to the allow creation of
    IPv6-only subnets using the CreateSubnet operation, and the operation ModifySubnetAttribute
    includes new parameters to modify subnet attributes to use resource-based naming and enable DNS
    resolutions for Private DNS name.
  * api-change:``sqs``: Amazon SQS adds a new queue attribute, SqsManagedSseEnabled, which enables
    server-side queue encryption using SQS owned encryption keys.
  * api-change:``ecs``: Documentation update for ARM support on Amazon ECS.
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``finspace-data``: Update documentation for createChangeset API.
  * api-change:``dynamodb``: DynamoDB PartiQL now supports ReturnConsumedCapacity, which returns
    capacity units consumed by PartiQL APIs if the request specified returnConsumedCapacity parameter.
    PartiQL APIs include ExecuteStatement, BatchExecuteStatement, and ExecuteTransaction.
  * api-change:``lambda``: Release Lambda event source filtering for SQS, Kinesis Streams, and
    DynamoDB Streams.
  * api-change:``iotdeviceadvisor``: This release introduces a new feature for Device Advisor:
    ability to execute multiple test suites in parallel for given customer account. You can use
    GetEndpoint API to get the device-level test endpoint and call StartSuiteRun with
    "parallelRun=true" to run suites in parallel.
  * api-change:``rds``: Adds support for Multi-AZ DB clusters for RDS for MySQL and RDS for
    PostgreSQL.
- from version 1.23.11
  * api-change:``connect``: This release adds support for UpdateContactFlowMetadata,
    DeleteContactFlow and module APIs. For details, see the Release Notes in the Amazon Connect
    Administrator Guide.
  * api-change:``dms``: Added new S3 endpoint settings to allow to convert the current UTC time into
    a specified time zone when a date partition folder is created. Using with 'DatePartitionedEnabled'.
  * api-change:``es``: This release adds an optional parameter dry-run for the
    UpdateElasticsearchDomainConfig API to perform basic validation checks, and detect the deployment
    type that will be required for the configuration change, without actually applying the change.
  * api-change:``ssm``: Adds new parameter to CreateActivation API . This parameter is for "internal
    use only".
  * api-change:``chime-sdk-meetings``: Added new APIs for enabling Echo Reduction with Voice Focus.
  * api-change:``eks``: Adding missing exceptions to RegisterCluster operation
  * api-change:``quicksight``: Add support for Exasol data source, 1 click enterprise embedding and
    email customization.
  * api-change:``cloudformation``: This release include SDK changes for the feature launch of Stack
    Import to Service Managed StackSet.
  * api-change:``rds``: Adds local backup support to Amazon RDS on AWS Outposts.
  * api-change:``braket``: This release adds support for Amazon Braket Hybrid Jobs.
  * api-change:``s3control``: Added Amazon CloudWatch publishing option for S3 Storage Lens metrics.
  * api-change:``finspace-data``: Add new APIs for managing Datasets, Changesets, and Dataviews.
- from version 1.23.10
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``cloudformation``: The StackSets ManagedExecution feature will allow concurrency for
    non-conflicting StackSet operations and queuing the StackSet operations that conflict at a given
    time for later execution.
  * api-change:``redshift``: Added support of default IAM role for CreateCluster,
    RestoreFromClusterSnapshot and ModifyClusterIamRoles APIs
  * api-change:``lambda``: Add support for Lambda Function URLs. Customers can use Function URLs to
    create built-in HTTPS endpoints on their functions.
  * api-change:``appstream``: Includes APIs for managing resources for Elastic fleets: applications,
    app blocks, and application-fleet associations.
  * api-change:``medialive``: This release adds support for specifying a SCTE-35 PID on input.
    MediaLive now supports SCTE-35 PID selection on inputs containing one or more active SCTE-35 PIDs.
  * api-change:``batch``: Documentation updates for AWS Batch.
  * api-change:``application-insights``: Application Insights now supports monitoring for HANA
- from version 1.23.9
  * api-change:``ivs``: Add APIs for retrieving stream session information and support for filtering
    live streams by health.  For more information, see
    https://docs.aws.amazon.com/ivs/latest/userguide/stream-health.html
  * api-change:``lambda``: Added support for CLIENT_CERTIFICATE_TLS_AUTH and
    SERVER_ROOT_CA_CERTIFICATE as SourceAccessType for MSK and Kafka event source mappings.
  * api-change:``chime``: Adds new Transcribe API parameters to StartMeetingTranscription, including
    support for content identification and redaction (PII &amp; PHI), partial results stabilization, and
    custom language models.
  * api-change:``chime-sdk-meetings``: Adds new Transcribe API parameters to
    StartMeetingTranscription, including support for content identification and redaction (PII &amp; PHI),
    partial results stabilization, and custom language models.
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``auditmanager``: This release introduces a new feature for Audit Manager: Dashboard
    views. You can now view insights data for your active assessments, and quickly identify
    non-compliant evidence that needs to be remediated.
  * api-change:``databrew``: This SDK release adds the following new features: 1) PII detection in
    profile jobs, 2) Data quality rules, enabling validation of data quality in profile jobs, 3) SQL
    query-based datasets for Amazon Redshift and Snowflake data sources, and 4) Connecting DataBrew
    datasets with Amazon AppFlow flows.
  * api-change:``redshift-data``: Rolling back Data API serverless features until dependencies are
    live.
  * api-change:``kafka``: Amazon MSK has added a new API that allows you to update the connectivity
    settings for an existing cluster to enable public accessibility.
  * api-change:``forecast``: NEW CreateExplanability API that helps you understand how attributes
    such as price, promotion, etc. contributes to your forecasted values; NEW CreateAutoPredictor API
    that trains up to 40% more accurate forecasting model, saves up to 50% of retraining time, and
    provides model level explainability.
  * api-change:``appconfig``: Add Type to support feature flag configuration profiles
- from version 1.23.8
  * api-change:``appconfigdata``: AWS AppConfig Data is a new service that allows you to retrieve
    configuration deployed by AWS AppConfig. See the AppConfig user guide for more details on getting
    started. https://docs.aws.amazon.com/appconfig/latest/userguide/what-is-appconfig.html
  * api-change:``drs``: Introducing AWS Elastic Disaster Recovery (AWS DRS), a new service that
    minimizes downtime and data loss with fast, reliable recovery of on-premises and cloud-based
    applications using affordable storage, minimal compute, and point-in-time recovery.
  * api-change:``apigateway``: Documentation updates for Amazon API Gateway.
  * api-change:``sns``: Amazon SNS introduces the PublishBatch API, which enables customers to
    publish up to 10 messages per API request. The new API is valid for Standard and FIFO topics.
  * api-change:``redshift-data``: Data API now supports serverless requests.
  * api-change:``amplifybackend``: New APIs to support the Amplify Storage category. Add and manage
    file storage in your Amplify app backend.
- from version 1.23.7
  * api-change:``location``: This release adds the support for Relevance, Distance, Time Zone,
    Language and Interpolated Address for Geocoding and Reverse Geocoding.
  * api-change:``cloudtrail``: CloudTrail Insights now supports ApiErrorRateInsight, which enables
    customers to identify unusual activity in their AWS account based on API error codes and their rate.
- from version 1.23.6
  * api-change:``migrationhubstrategy``: AWS SDK for Migration Hub Strategy Recommendations. It
    includes APIs to start the portfolio assessment, import portfolio data for assessment, and to
    retrieve recommendations. For more information, see the AWS Migration Hub documentation at
    https://docs.aws.amazon.com/migrationhub/index.html
  * api-change:``ec2``: Adds a new VPC Subnet attribute "EnableDns64." When enabled on IPv6 Subnets,
    the Amazon-Provided DNS Resolver returns synthetic IPv6 addresses for IPv4-only destinations.
  * api-change:``wafv2``: Your options for logging web ACL traffic now include Amazon CloudWatch Logs
    log groups and Amazon S3 buckets.
  * api-change:``dms``: Add Settings in JSON format for the source GCP MySQL endpoint
  * api-change:``ssm``: Adds support for Session Reason and Max Session Duration for Systems Manager
    Session Manager.
  * api-change:``appstream``: This release includes support for images of AmazonLinux2 platform type.
  * api-change:``eks``: Adding Tags support to Cluster Registrations.
  * api-change:``transfer``: AWS Transfer Family now supports integrating a custom identity provider
    using AWS Lambda
- from version 1.23.5
  * api-change:``ec2``: C6i instances are powered by a third-generation Intel Xeon Scalable processor
    (Ice Lake) delivering all-core turbo frequency of 3.5 GHz. G5 instances feature up to 8 NVIDIA A10G
    Tensor Core GPUs and second generation AMD EPYC processors.
  * api-change:``ssm``: This Patch Manager release supports creating Patch Baselines for RaspberryPi
    OS (formerly Raspbian)
  * api-change:``devops-guru``: Add support for cross account APIs.
  * api-change:``connect``: This release adds APIs for creating and managing scheduled tasks.
    Additionally, adds APIs to describe and update a contact and list associated references.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added automatic modes for GOP
    configuration and added the ability to ingest screen recordings generated by Safari on MacOS 12
    Monterey.
- from version 1.23.4
  * api-change:``dynamodb``: Updated Help section for "dynamodb update-contributor-insights" API
  * api-change:``ec2``: This release provides an additional route target for the VPC route table.
  * api-change:``translate``: This release enables customers to import Multi-Directional Custom
    Terminology and use Multi-Directional Custom Terminology in both real-time translation and
    asynchronous batch translation.
- from version 1.23.3
  * api-change:``backup``: AWS Backup SDK provides new options when scheduling backups: select
    supported services and resources that are assigned to a particular tag, linked to a combination of
    tags, or can be identified by a partial tag value, and exclude resources from their assignments.
  * api-change:``ecs``: This release adds support for container instance health.
  * api-change:``resiliencehub``: Initial release of AWS Resilience Hub, a managed service that
    enables you to define, validate, and track the resilience of your applications on AWS
- from version 1.23.2
  * api-change:``batch``: Adds support for scheduling policy APIs.
  * api-change:``health``: Documentation updates for AWS Health.
  * api-change:``greengrassv2``: This release adds support for Greengrass core devices running
    Windows. You can now specify name of a Windows user to run a component.
- from version 1.23.1
  * bugfix:urllib3: Fix NO_OP_TICKET import bug in older versions of urllib3
- from version 1.23.0
  * feature:EndpointResolver: Adding support for resolving modeled FIPS and Dualstack endpoints.
  * feature:``six``: Updated vendored version of ``six`` from 1.10.0 to 1.16.0
  * api-change:``sagemaker``: SageMaker CreateEndpoint and UpdateEndpoint APIs now support additional
    deployment configuration to manage traffic shifting options and automatic rollback monitoring.
    DescribeEndpoint now shows new in-progress deployment details with stage status.
  * api-change:``chime-sdk-meetings``: Updated format validation for ids and regions.
  * api-change:``wafv2``: You can now configure rules to run a CAPTCHA check against web requests
    and, as needed, send a CAPTCHA challenge to the client.
  * api-change:``ec2``: This release adds internal validation on the GatewayAssociationState field
- from version 1.22.12
  * api-change:``ec2``: DescribeInstances now returns customer-owned IP addresses for instances
    running on an AWS Outpost.
  * api-change:``translate``: This release enable customers to use their own KMS keys to encrypt
    output files when they submit a batch transform job.
  * api-change:``resourcegroupstaggingapi``: Documentation updates and improvements.
- from version 1.22.11
  * api-change:``chime-sdk-meetings``: The Amazon Chime SDK Meetings APIs allow software developers
    to create meetings and attendees for interactive audio, video, screen and content sharing in custom
    meeting applications which use the Amazon Chime SDK.
  * api-change:``sagemaker``: ListDevices and DescribeDevice now show Edge Manager agent version.
  * api-change:``connect``: This release adds CRUD operation support for Security profile resource in
    Amazon Connect
  * api-change:``iotwireless``: Adding APIs for the FUOTA (firmware update over the air) and
    multicast for LoRaWAN devices and APIs to support event notification opt-in feature for Sidewalk
    related events. A few existing APIs need to be modified for this new feature.
  * api-change:``ec2``: This release adds a new instance replacement strategy for EC2 Fleet, Spot
    Fleet. Now you can select an action to perform when your instance gets a rebalance notification.
    EC2 Fleet, Spot Fleet can launch a replacement then terminate the instance that received
    notification after a termination delay
- from version 1.22.10
  * api-change:``finspace``: Adds superuser and data-bundle parameters to CreateEnvironment API
  * api-change:``connectparticipant``: This release adds a new boolean attribute - Connect
    Participant - to the CreateParticipantConnection API, which can be used to mark the participant as
    connected.
  * api-change:``datasync``: AWS DataSync now supports Hadoop Distributed File System (HDFS) Locations
  * api-change:``macie2``: This release adds support for specifying the severity of findings that a
    custom data identifier produces, based on the number of occurrences of text that matches the
    detection criteria.
- from version 1.22.9
  * api-change:``cloudfront``: CloudFront now supports response headers policies to add HTTP headers
    to the responses that CloudFront sends to viewers. You can use these policies to add CORS headers,
    control browser caching, and more, without modifying your origin or writing any code.
  * api-change:``connect``: Amazon Connect Chat now supports real-time message streaming.
  * api-change:``nimble``: Amazon Nimble Studio adds support for users to stop and start streaming
    sessions.
- from version 1.22.8
  * api-change:``rekognition``: This Amazon Rekognition Custom Labels release introduces the
    management of datasets with  projects
  * api-change:``networkmanager``: This release adds API support to aggregate resources, routes, and
    telemetry data across a Global Network.
  * api-change:``lightsail``: This release adds support to enable access logging for buckets in the
    Lightsail object storage service.
  * api-change:``neptune``: Adds support for major version upgrades to ModifyDbCluster API
- from version 1.22.7
  * api-change:``transcribe``: Transcribe and Transcribe Call Analytics now support automatic
    language identification along with custom vocabulary, vocabulary filter, custom language model and
    PII redaction.
  * api-change:``application-insights``: Added Monitoring support for SQL Server Failover Cluster
    Instance. Additionally, added a new API to allow one-click monitoring of containers resources.
  * api-change:``rekognition``: This release added new attributes to Rekognition Video
    GetCelebrityRecognition API operations.
  * api-change:``connect``: Amazon Connect Chat now supports real-time message streaming.
  * api-change:``ec2``: Support added for AMI sharing with organizations and organizational units in
    ModifyImageAttribute API</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1641384000">- Version update to 1.23.28
  * api-change:``rekognition``: This release introduces a new field IndexFacesModelVersion, which is
    the version of the face detect and storage model that was used when indexing the face vector.
  * api-change:``s3``: Minor doc-based updates based on feedback bugs received.
  * enhancement:JSONFileCache: Add support for __delitem__ in JSONFileCache
  * api-change:``s3control``: Documentation updates for the renaming of Glacier to Glacier Flexible
    Retrieval.
- from version 1.23.27
  * api-change:``sagemaker``: The release allows users to pass pipeline definitions as Amazon S3
    locations and control the pipeline execution concurrency using ParallelismConfiguration. It also
    adds support of EMR jobs as pipeline steps.
  * api-change:``rds``: Multiple doc-only updates for Relational Database Service (RDS)
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added strength levels to the
    Sharpness Filter and now permits OGG files to be specified as sidecar audio inputs.
  * api-change:``greengrassv2``: This release adds the API operations to manage the Greengrass role
    associated with your account and to manage the core device connectivity information. Greengrass V2
    customers can now depend solely on Greengrass V2 SDK for all the API operations needed to manage
    their fleets.
  * api-change:``detective``: Added and updated API operations to support the Detective integration
    with AWS Organizations. New actions are used to manage the delegated administrator account and the
    integration configuration.
- from version 1.23.26
  * api-change:``nimble``: Amazon Nimble Studio adds support for users to upload files during a
    streaming session using NICE DCV native client or browser.
  * api-change:``chime-sdk-messaging``: The Amazon Chime SDK now supports updating message attributes
    via channel flows
  * api-change:``imagebuilder``: Added a note to infrastructure configuration actions and data types
    concerning delivery of Image Builder event messages to encrypted SNS topics. The key that's used to
    encrypt the SNS topic must reside in the account that Image Builder runs under.
  * api-change:``workmail``: This release allows customers to change their email monitoring
    configuration in Amazon WorkMail.
  * api-change:``transfer``: Property for Transfer Family used with the FTPS protocol. TLS Session
    Resumption provides a mechanism to resume or share a negotiated secret key between the control and
    data connection for an FTPS session.
  * api-change:``lookoutmetrics``: This release adds support for Causal Relationships. Added new
    ListAnomalyGroupRelatedMetrics API operation and InterMetricImpactDetails API data type
  * api-change:``mediaconnect``: You can now use the Fujitsu-QoS protocol for your MediaConnect
    sources and outputs to transport content to and from Fujitsu devices.
  * api-change:``qldb``: Amazon QLDB now supports journal exports in JSON and Ion Binary formats.
    This release adds an optional OutputFormat parameter to the ExportJournalToS3 API.
- from version 1.23.25
  * api-change:``customer-profiles``: This release adds an optional parameter, ObjectTypeNames to the
    PutIntegration API to support multiple object types per integration option. Besides, this release
    introduces Standard Order Objects which contain data from third party systems and each order object
    belongs to a specific profile.
  * api-change:``sagemaker``: This release adds a new ContentType field in AutoMLChannel for
    SageMaker CreateAutoMLJob InputDataConfig.
  * api-change:``forecast``: Adds ForecastDimensions field to the DescribeAutoPredictorResponse
  * api-change:``securityhub``: Added new resource details objects to ASFF, including resources for
    Firewall, and RuleGroup, FirewallPolicy Added additional details for AutoScalingGroup,
    LaunchConfiguration, and S3 buckets.
  * api-change:``location``: Making PricingPlan optional as part of create resource API.
  * api-change:``redshift``: This release adds API support for managed Redshift datashares. Customers
    can now interact with a Redshift datashare that is managed by a different service, such as AWS Data
    Exchange.
  * api-change:``apigateway``: Documentation updates for Amazon API Gateway
  * api-change:``devops-guru``: Adds Tags support to DescribeOrganizationResourceCollectionHealth
  * api-change:``imagebuilder``: This release adds support for importing and exporting VM Images as
    part of the Image Creation workflow via EC2 VM Import/Export.
  * api-change:``datasync``: AWS DataSync now supports FSx Lustre Locations.
  * api-change:``finspace-data``: Make dataset description optional and allow s3 export for dataviews</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642161600">- Version update to 1.23.35
  * api-change:``pinpoint``: Adds JourneyChannelSettings to WriteJourneyRequest
  * api-change:``lexv2-runtime``: Update lexv2-runtime client to latest version
  * api-change:``nimble``: Amazon Nimble Studio now supports validation for Launch Profiles. Launch
    Profiles now report static validation results after create/update to detect errors in network or
    active directory configuration.
  * api-change:``glue``: This SDK release adds support to pass run properties when starting a
    workflow run
  * api-change:``ssm``: AWS Systems Manager adds category support for DescribeDocument API
  * api-change:``elasticache``: AWS ElastiCache for Redis has added a new Engine Log LogType in
    LogDelivery feature. You can now publish the Engine Log from your Amazon ElastiCache for Redis
    clusters to Amazon CloudWatch Logs and Amazon Kinesis Data Firehose.
- from version 1.23.34
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``honeycode``: Honeycode is releasing new APIs to allow user to create, delete and
    list tags on resources.
  * api-change:``ec2``: Hpc6a instances are powered by a third-generation AMD EPYC processors (Milan)
    delivering all-core turbo frequency of 3.4 GHz
  * api-change:``fms``: Shield Advanced policies for Amazon CloudFront resources now support
    automatic application layer DDoS mitigation. The max length for SecurityServicePolicyData
    ManagedServiceData is now 8192 characters, instead of 4096.
  * api-change:``pi``: This release adds three Performance Insights APIs. Use
    ListAvailableResourceMetrics to get available metrics, GetResourceMetadata to get feature metadata,
    and ListAvailableResourceDimensions to list available dimensions. The AdditionalMetrics field in
    DescribeDimensionKeys retrieves per-SQL metrics.
- from version 1.23.33
  * api-change:``finspace-data``: Documentation updates for FinSpace.
  * api-change:``rds``: This release adds the db-proxy event type to support subscribing to RDS Proxy
    events.
  * api-change:``ce``: Doc only update for Cost Explorer API that fixes missing clarifications for
    MatchOptions definitions
  * api-change:``kendra``: Amazon Kendra now supports advanced query language and query-less search.
  * api-change:``workspaces``: Introducing new APIs for Workspaces audio optimization with Amazon
    Connect: CreateConnectClientAddIn, DescribeConnectClientAddIns, UpdateConnectClientAddIn and
    DeleteConnectClientAddIn.
  * api-change:``iotevents-data``: This release provides documentation updates for Timer.timestamp in
    the IoT Events API Reference Guide.
  * api-change:``ec2``: EC2 Capacity Reservations now supports RHEL instance platforms (RHEL with SQL
    Server Standard, RHEL with SQL Server Enterprise, RHEL with SQL Server Web, RHEL with HA, RHEL with
    HA and SQL Server Standard, RHEL with HA and SQL Server Enterprise)
- from version 1.23.32
  * api-change:``ec2``: New feature: Updated EC2 API to support faster launching for Windows images.
    Optimized images are pre-provisioned, using snapshots to launch instances up to 65% faster.
  * api-change:``compute-optimizer``: Adds support for new Compute Optimizer capability that makes it
    easier for customers to optimize their EC2 instances by leveraging multiple CPU architectures.
  * api-change:``lookoutmetrics``: This release adds FailureType in the response of
    DescribeAnomalyDetector.
  * api-change:``databrew``: This SDK release adds support for specifying a Bucket Owner for an S3
    location.
  * api-change:``transcribe``: Documentation updates for Amazon Transcribe.
- from version 1.23.31
  * api-change:``medialive``: This release adds support for selecting the Program Date Time (PDT)
    Clock source algorithm for HLS outputs.
- from version 1.23.30
  * api-change:``ec2``: This release introduces On-Demand Capacity Reservation support for Cluster
    Placement Groups, adds Tags on instance Metadata, and includes documentation updates for Amazon EC2.
  * api-change:``mediatailor``: This release adds support for filler slate when updating MediaTailor
    channels that use the linear playback mode.
  * api-change:``opensearch``: Amazon OpenSearch Service adds support for Fine Grained Access Control
    for existing domains running Elasticsearch version 6.7 and above
  * api-change:``iotwireless``: Downlink Queue Management feature provides APIs for customers to
    manage the queued messages destined to device inside AWS IoT Core for LoRaWAN. Customer can view,
    delete or purge the queued message(s). It allows customer to preempt the queued messages and let
    more urgent messages go through.
  * api-change:``es``: Amazon OpenSearch Service adds support for Fine Grained Access Control for
    existing domains running Elasticsearch version 6.7 and above
  * api-change:``mwaa``: This release adds a "Source" field that provides the initiator of an update,
    such as due to an automated patch from AWS or due to modification via Console or API.
  * api-change:``appsync``: AppSync: AWS AppSync now supports configurable batching sizes for AWS
    Lambda resolvers, Direct AWS Lambda resolvers and pipeline functions
- from version 1.23.29
  * api-change:``cloudtrail``: This release adds support for CloudTrail Lake, a new feature that lets
    you run SQL-based queries on events that you have aggregated into event data stores. New APIs have
    been added for creating and managing event data stores, and creating, running, and managing queries
    in CloudTrail Lake.
  * api-change:``iot``: This release adds an automatic retry mechanism for AWS IoT Jobs. You can now
    define a maximum number of retries for each Job rollout, along with the criteria to trigger the
    retry for FAILED/TIMED_OUT/ALL(both FAILED an TIMED_OUT) job.
  * api-change:``ec2``: This release adds a new API called
    ModifyVpcEndpointServicePayerResponsibility which allows VPC endpoint service owners to take payer
    responsibility of their VPC Endpoint connections.
  * api-change:``snowball``: Updating validation rules for interfaces used in the Snowball API to
    tighten security of service.
  * api-change:``lakeformation``: Add new APIs for 3rd Party Support for Lake Formation
  * api-change:``appstream``: Includes APIs for App Entitlement management regarding entitlement and
    entitled application association.
  * api-change:``eks``: Amazon EKS now supports running applications using IPv6 address space
  * api-change:``quicksight``: Multiple Doc-only updates for Amazon QuickSight.
  * api-change:``ecs``: Documentation update for ticket fixes.
  * api-change:``sagemaker``: Amazon SageMaker now supports running training jobs on ml.g5 instance
    types.
  * api-change:``glue``: Add Delta Lake target support for Glue Crawler and 3rd Party Support for
    Lake Formation</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1642766400">- Version update to 1.23.40
  * api-change:``guardduty``: Amazon GuardDuty findings now include remoteAccountDetails under
    AwsApiCallAction section if instance credential is exfiltrated.
  * api-change:``connect``: This release adds tagging support for UserHierarchyGroups resource.
  * api-change:``mediatailor``: This release adds support for multiple Segment Delivery
    Configurations. Users can provide a list of names and URLs when creating or editing a source
    location. When retrieving content, users can send a header to choose which URL should be used to
    serve content.
  * api-change:``fis``: Added action startTime and action endTime timestamp fields to the
    ExperimentAction object
  * api-change:``ec2``: C6i, M6i and R6i instances are powered by a third-generation Intel Xeon
    Scalable processor (Ice Lake) delivering all-core turbo frequency of 3.5 GHz
- from version 1.23.39
  * api-change:``macie2``: This release of the Amazon Macie API introduces stricter validation of
    requests to create custom data identifiers.
  * api-change:``ec2-instance-connect``: Adds support for ED25519 keys. PushSSHPublicKey Availability
    Zone parameter is now optional. Adds EC2InstanceStateInvalidException for instances that are not
    running. This was previously a service exception, so this may require updating your code to handle
    this new exception.
- from version 1.23.38
  * api-change:``ivs``: This release adds support for the new Thumbnail Configuration property for
    Recording Configurations. For more information see
    https://docs.aws.amazon.com/ivs/latest/userguide/record-to-s3.html
  * api-change:``storagegateway``: Documentation update for adding bandwidth throttling support for
    S3 File Gateways.
  * api-change:``location``: This release adds the CalculateRouteMatrix API which calculates routes
    for the provided departure and destination positions. The release also deprecates the use of
    pricing plan across all verticals.
  * api-change:``cloudtrail``: This release fixes a documentation bug in the description for the
    readOnly field selector in advanced event selectors. The description now clarifies that users omit
    the readOnly field selector to select both Read and Write management events.
  * api-change:``ec2``: Add support for AWS Client VPN client login banner and session timeout.
- from version 1.23.37
  * enhancement:Configuration: Adding support for `defaults_mode` configuration. The `defaults_mode`
    will be used to determine how certain default configuration options are resolved in the SDK.
- from version 1.23.36
  * api-change:``config``: Update ResourceType enum with values for CodeDeploy, EC2 and Kinesis
    resources
  * api-change:``application-insights``: Application Insights support for Active Directory and
    SharePoint
  * api-change:``honeycode``: Added read and write api support for multi-select picklist. And added
    errorcode field to DescribeTableDataImportJob API output, when import job fails.
  * api-change:``ram``: This release adds the ListPermissionVersions API which lists the versions for
    a given permission.
  * api-change:``lookoutmetrics``: This release adds a new DeactivateAnomalyDetector API operation.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1643716800">- Version update to 1.23.46
  * api-change:``appconfigdata``: Documentation updates for AWS AppConfig Data.
  * api-change:``athena``: This release adds a field, AthenaError, to the GetQueryExecution response
    object when a query fails.
  * api-change:``appconfig``: Documentation updates for AWS AppConfig
  * api-change:``cognito-idp``: Doc updates for Cognito user pools API Reference.
  * api-change:``secretsmanager``: Feature are ready to release on Jan 28th
  * api-change:``sagemaker``: This release added a new NNA accelerator compilation support for
    Sagemaker Neo.
- from version 1.23.45
  * api-change:``ec2``: X2ezn instances are powered by Intel Cascade Lake CPUs that deliver turbo all
    core frequency of up to 4.5 GHz and up to 100 Gbps of networking bandwidth
  * api-change:``kafka``: Amazon MSK has updated the CreateCluster and UpdateBrokerStorage API that
    allows you to specify volume throughput during cluster creation and broker volume updates.
  * api-change:``connect``: This release adds support for configuring a custom chat duration when
    starting a new chat session via the StartChatContact API. The default value for chat duration is 25
    hours, minimum configurable value is 1 hour (60 minutes) and maximum configurable value is 7 days
    (10,080 minutes).
  * api-change:``amplify``: Doc only update to the description of basicauthcredentials to describe
    the required encoding and format.
  * api-change:``opensearch``: Allows customers to get progress updates for blue/green deployments
- from version 1.23.44
  * api-change:``frauddetector``: Added new APIs for viewing past predictions and obtaining
    prediction metadata including prediction explanations: ListEventPredictions and
    GetEventPredictionMetadata
  * api-change:``ebs``: Documentation updates for Amazon EBS Direct APIs.
  * api-change:``codeguru-reviewer``: Added failure state and adjusted timeout in waiter
  * api-change:``securityhub``: Adding top level Sample boolean field
  * api-change:``sagemaker``: API changes relating to Fail steps in model building pipeline and add
    PipelineExecutionFailureReason in PipelineExecutionSummary.
- from version 1.23.43
  * api-change:``fsx``: This release adds support for growing SSD storage capacity and
    growing/shrinking SSD IOPS for FSx for ONTAP file systems.
  * api-change:``efs``: Update efs client to latest version
  * api-change:``connect``: This release adds support for custom vocabularies to be used with Contact
    Lens. Custom vocabularies improve transcription accuracy for one or more specific words.
  * api-change:``guardduty``: Amazon GuardDuty expands threat detection coverage to protect Amazon
    Elastic Kubernetes Service (EKS) workloads.
- from version 1.23.42
  * api-change:``route53-recovery-readiness``: Updated documentation for Route53 Recovery Readiness
    APIs.
- from version 1.23.41
  * enhancement:Exceptions: ProxyConnectionError previously provided the full proxy URL. User info
    will now be appropriately masked if needed.
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added support for 4K AV1 output
    resolutions &amp; 10-bit AV1 color, the ability to ingest sidecar Dolby Vision XML metadata files, and
    the ability to flag WebVTT and IMSC tracks for accessibility in HLS.
  * api-change:``transcribe``: Add support for granular PIIEntityTypes when using Batch
    ContentRedaction.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1645012800">- Version update to 1.24.0
  * api-change:``appflow``: Launching Amazon AppFlow SAP as a destination connector SDK.
  * feature:Parser: Adding support for parsing int/long types in rest-json response headers.
  * api-change:``rds``: Adds support for determining which Aurora PostgreSQL versions support
    Babelfish.
  * api-change:``athena``: This release adds a subfield, ErrorType, to the AthenaError response
    object in the GetQueryExecution API when a query fails.
- from version 1.23.54
  * api-change:``ssm``: Documentation updates for AWS Systems Manager.
- from version 1.23.53
  * api-change:``cloudformation``: This SDK release adds AWS CloudFormation Hooks HandlerErrorCodes
  * api-change:``lookoutvision``: This release makes CompilerOptions in Lookout for Vision's
    StartModelPackagingJob's Configuration object optional.
  * api-change:``pinpoint``: This SDK release adds a new paramater creation date for GetApp and
    GetApps Api call
  * api-change:``sns``: Customer requested typo fix in API documentation.
  * api-change:``wafv2``: Adds support for AWS WAF Fraud Control account takeover prevention (ATP),
    with configuration options for the new managed rule group AWSManagedRulesATPRuleSet and support for
    application integration SDKs for Android and iOS mobile apps.
- from version 1.23.52
  * api-change:``cloudformation``: This SDK release is for the feature launch of AWS CloudFormation
    Hooks.
- from version 1.23.51
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Amazon FSx. For
    more information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-fsx.html
  * api-change:``apprunner``: This release adds support for App Runner to route outbound network
    traffic of a service through an Amazon VPC. New API: CreateVpcConnector, DescribeVpcConnector,
    ListVpcConnectors, and DeleteVpcConnector. Updated API: CreateService, DescribeService, and
    UpdateService.
  * api-change:``s3control``: This release adds support for S3 Batch Replication. Batch Replication
    lets you replicate existing objects, already replicated objects to new destinations, and objects
    that previously failed to replicate. Customers will receive object-level visibility of progress and
    a detailed completion report.
  * api-change:``sagemaker``: Autopilot now generates an additional report with information on the
    performance of the best model, such as a Confusion matrix and  Area under the receiver operating
    characteristic (AUC-ROC). The path to the report can be found in CandidateArtifactLocations.
- from version 1.23.50
  * api-change:``auditmanager``: This release updates 3 API parameters.
    UpdateAssessmentFrameworkControlSet now requires the controls attribute, and
    CreateAssessmentFrameworkControl requires the id attribute. Additionally, UpdateAssessmentFramework
    now has a minimum length constraint for the controlSets attribute.
  * api-change:``synthetics``: Adding names parameters to the Describe APIs.
  * api-change:``ssm-incidents``: Update RelatedItem enum to support SSM Automation
  * api-change:``events``: Update events client to latest version
  * enhancement:Lambda Request Header: Adding request header for Lambda recursion detection.
- from version 1.23.49
  * api-change:``athena``: You can now optionally specify the account ID that you expect to be the
    owner of your query results output location bucket in Athena. If the account ID of the query
    results bucket owner does not match the specified account ID, attempts to output to the bucket will
    fail with an S3 permissions error.
  * api-change:``rds``: updates for RDS Custom for Oracle 12.1 support
  * api-change:``lakeformation``: Add support for calling Update Table Objects without a
    TransactionId.
- from version 1.23.48
  * api-change:``ec2``: adds support for AMIs in Recycle Bin
  * api-change:``robomaker``: The release deprecates the use various APIs of RoboMaker Deployment
    Service in favor of AWS IoT GreenGrass v2.0.
  * api-change:``meteringmarketplace``: Add CustomerAWSAccountId to ResolveCustomer API response and
    increase UsageAllocation limit to 2500.
  * api-change:``rbin``: Add EC2 Image recycle bin support.
- from version 1.23.47
  * api-change:``emr``: Update emr client to latest version
  * api-change:``personalize``: Adding minRecommendationRequestsPerSecond attribute to recommender
    APIs.
  * enhancement:Request headers: Adding request headers with retry information.
  * api-change:``appflow``: Launching Amazon AppFlow Custom Connector SDK.
  * api-change:``dynamodb``: Documentation update for DynamoDB Java SDK.
  * api-change:``iot``: This release adds support for configuring AWS IoT logging level per client
    ID, source IP, or principal ID.
  * api-change:``comprehend``: Amazon Comprehend now supports sharing and importing custom trained
    models from one AWS account to another within the same region.
  * api-change:``ce``: Doc-only update for Cost Explorer API that adds INVOICING_ENTITY dimensions
  * api-change:``fis``: Added GetTargetResourceType and ListTargetResourceTypesAPI actions. These
    actions return additional details about resource types and parameters that can be targeted by FIS
    actions. Added a parameters field for the targets that can be specified in experiment templates.
  * api-change:``es``: Allows customers to get progress updates for blue/green deployments
  * api-change:``glue``: Launch Protobuf support for AWS Glue Schema Registry
  * api-change:``elasticache``: Documentation update for AWS ElastiCache</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1646222400">- Version update to 1.24.10
  * api-change:``mediapackage``: This release adds Hybridcast as an available profile option for Dash
    Origin Endpoints.
  * api-change:``rds``: Documentation updates for Multi-AZ DB clusters.
  * api-change:``mgn``: Add support for GP3 and IO2 volume types. Add bootMode to LaunchConfiguration
    object (and as a parameter to UpdateLaunchConfigurationRequest).
  * api-change:``kafkaconnect``: Adds operation for custom plugin deletion (DeleteCustomPlugin) and
    adds new StateDescription field to DescribeCustomPlugin and DescribeConnector responses to return
    errors from asynchronous resource creation.
- from version 1.24.9
  * api-change:``finspace-data``: Add new APIs for managing Users and Permission Groups.
  * api-change:``amplify``: Add repositoryCloneMethod field for hosting an Amplify app. This field
    shows what authorization method is used to clone the repo: SSH, TOKEN, or SIGV4.
  * api-change:``fsx``: This release adds support for the following FSx for OpenZFS features:
    snapshot lifecycle transition messages, force flag for deleting file systems with child resources,
    LZ4 data compression, custom record sizes, and unsetting volume quotas and reservations.
  * api-change:``fis``: This release adds logging support for AWS Fault Injection Simulator
    experiments. Experiment templates can now be configured to send experiment activity logs to Amazon
    CloudWatch Logs or to an S3 bucket.
  * api-change:``route53-recovery-cluster``: This release adds a new API option to enable overriding
    safety rules to allow routing control state updates.
  * api-change:``amplifyuibuilder``: We are adding the ability to configure workflows and actions for
    components.
  * api-change:``athena``: This release adds support for updating an existing named query.
  * api-change:``ec2``: This release adds support for new AMI property 'lastLaunchedTime'
  * api-change:``servicecatalog-appregistry``: AppRegistry is deprecating Application and
    Attribute-Group Name update feature. In this release, we are marking the name attributes for Update
    APIs as deprecated to give a heads up to our customers.
- from version 1.24.8
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``panorama``: Added NTP server configuration parameter to ProvisionDevice operation.
    Added alternate software fields to DescribeDevice response
- from version 1.24.7
  * api-change:``route53``: SDK doc update for Route 53 to update some parameters with new
    information.
  * api-change:``databrew``: This AWS Glue Databrew release adds feature to merge job outputs into a
    max number of files for S3 File output type.
  * api-change:``transfer``: Support automatic pagination when listing AWS Transfer Family resources.
  * api-change:``s3control``: Amazon S3 Batch Operations adds support for new integrity checking
    capabilities in Amazon S3.
  * api-change:``s3``: This release adds support for new integrity checking capabilities in Amazon
    S3. You can choose from four supported checksum algorithms for data integrity checking on your
    upload and download requests. In addition, AWS SDK can automatically calculate a checksum as it
    streams data into S3
  * api-change:``fms``: AWS Firewall Manager now supports the configuration of AWS Network Firewall
    policies with either centralized or distributed deployment models. This release also adds support
    for custom endpoint configuration, where you can choose which Availability Zones to create firewall
    endpoints in.
  * api-change:``lightsail``: This release adds support to delete and create Lightsail default key
    pairs that you can use with Lightsail instances.
  * api-change:``autoscaling``: You can now hibernate instances in a warm pool to stop instances
    without deleting their RAM contents. You can now also return instances to the warm pool on scale
    in, instead of always terminating capacity that you will need later.
- from version 1.24.6
  * api-change:``transfer``: The file input selection feature provides the ability to use either the
    originally uploaded file or the output file from the previous workflow step, enabling customers to
    make multiple copies of the original file while keeping the source file intact for file archival.
  * api-change:``lambda``: Lambda releases .NET 6 managed runtime to be available in all commercial
    regions.
  * api-change:``textract``: Added support for merged cells and column header for table response.
- from version 1.24.5
  * api-change:``translate``: This release enables customers to use translation settings for
    formality customization in their synchronous translation output.
  * api-change:``wafv2``: Updated descriptions for logging configuration.
  * api-change:``apprunner``: AWS App Runner adds a Java platform (Corretto 8, Corretto 11 runtimes)
    and a Node.js 14 runtime.
- from version 1.24.4
  * api-change:``imagebuilder``: This release adds support to enable faster launching for Windows
    AMIs created by EC2 Image Builder.
  * api-change:``customer-profiles``: This release introduces apis CreateIntegrationWorkflow,
    DeleteWorkflow, ListWorkflows, GetWorkflow and GetWorkflowSteps. These apis are used to manage and
    view integration workflows.
  * api-change:``dynamodb``: DynamoDB ExecuteStatement API now supports Limit as a request parameter
    to specify the maximum number of items to evaluate. If specified, the service will process up to
    the Limit and the results will include a LastEvaluatedKey value to continue the read in a
    subsequent operation.
- from version 1.24.3
  * api-change:``transfer``: Properties for Transfer Family used with SFTP, FTP, and FTPS protocols.
    Display Banners are bodies of text that can be displayed before and/or after a user authenticates
    onto a server using one of the previously mentioned protocols.
  * api-change:``gamelift``: Increase string list limit from 10 to 100.
  * api-change:``budgets``: This change introduces DescribeBudgetNotificationsForAccount API which
    returns budget notifications for the specified account
- from version 1.24.2
  * api-change:``iam``: Documentation updates for AWS Identity and Access Management (IAM).
  * api-change:``redshift``: SDK release for Cross region datasharing and cost-control for cross
    region datasharing
  * api-change:``evidently``: Add support for filtering list of experiments and launches by status
  * api-change:``backup``: AWS Backup add new S3_BACKUP_OBJECT_FAILED and S3_RESTORE_OBJECT_FAILED
    event types in BackupVaultNotifications events list.
- from version 1.24.1
  * api-change:``ec2``: Documentation updates for EC2.
  * api-change:``budgets``: Adds support for auto-adjusting budgets, a new budget method alongside
    fixed and planned. Auto-adjusting budgets introduces new metadata to configure a budget limit
    baseline using a historical lookback average or current period forecast.
  * api-change:``ce``: AWS Cost Anomaly Detection now supports SNS FIFO topic subscribers.
  * api-change:``glue``: Support for optimistic locking in UpdateTable
  * api-change:``ssm``: Assorted ticket fixes and updates for AWS Systems Manager.</changelog>
  <changelog author="dmueller@suse.com" date="1647864000">- Update to 1.24.22
  * enhancement:jmespath: Add env markers to get working version of jmespath for python 3.6
  * api-change:``glue``: Added 9 new APIs for AWS Glue Interactive Sessions: ListSessions,
    StopSession, CreateSession, GetSession, DeleteSession, RunStatement, GetStatement, ListStatements,
    CancelStatement
- from version 1.24.21
  * enhancement:Dependency: Added support for jmespath 1.0
  * api-change:``amplifybackend``: Adding the ability to customize Cognito verification messages for
    email and SMS in CreateBackendAuth and UpdateBackendAuth. Adding deprecation documentation for
    ForgotPassword in CreateBackendAuth and UpdateBackendAuth
  * api-change:``acm-pca``: AWS Certificate Manager (ACM) Private Certificate Authority (CA) now
    supports customizable certificate subject names and extensions.
  * api-change:``ssm-incidents``: Removed incorrect validation pattern for
    IncidentRecordSource.invokedBy
  * api-change:``billingconductor``: This is the initial SDK release for AWS Billing Conductor. The
    AWS Billing Conductor is a customizable billing service, allowing you to customize your billing
    data to match your desired business structure.
  * api-change:``s3outposts``: S3 on Outposts is releasing a new API, ListSharedEndpoints, that lists
    all endpoints associated with S3 on Outpost, that has been shared by Resource Access Manager (RAM).
- from version 1.24.20
  * api-change:``robomaker``: This release deprecates ROS, Ubuntu and Gazbeo from RoboMaker
    Simulation Service Software Suites in favor of user-supplied containers and Relaxed Software Suites.
  * api-change:``dataexchange``: This feature enables data providers to use the RevokeRevision
    operation to revoke subscriber access to a given revision. Subscribers are unable to interact with
    assets within a revoked revision.
  * api-change:``ec2``: Adds the Cascade parameter to the DeleteIpam API. Customers can use this
    parameter to automatically delete their IPAM, including non-default scopes, pools, cidrs, and
    allocations. There mustn't be any pools provisioned in the default public scope to use this
    parameter.
  * api-change:``cognito-idp``: Updated EmailConfigurationType and SmsConfigurationType to reflect
    that you can now choose Amazon SES and Amazon SNS resources in the same Region.
  * enhancement:AWSCRT: Upgrade awscrt extra to 0.13.5
  * api-change:``location``: New HERE style "VectorHereExplore" and "VectorHereExploreTruck".
  * api-change:``ecs``: Documentation only update to address tickets
  * api-change:``keyspaces``: Fixing formatting issues in CLI and SDK documentation
  * api-change:``rds``: Various documentation improvements
- from version 1.24.19
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Slack. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-slack.html
  * api-change:``timestream-query``: Amazon Timestream Scheduled Queries now support Timestamp
    datatype in a multi-measure record.
  * enhancement:Stubber: Added support for modeled exception fields when adding errors to a client
    stub. Implements boto/boto3`#3178 &lt;https://github.com/boto/botocore/issues/3178&gt;`__.
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``config``: Add resourceType enums for AWS::ECR::PublicRepository and
    AWS::EC2::LaunchTemplate
- from version 1.24.18
  * api-change:``outposts``: This release adds address filters for listSites
  * api-change:``lambda``: Adds PrincipalOrgID support to AddPermission API. Customers can use it to
    manage permissions to lambda functions at AWS Organizations level.
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager.
  * api-change:``connect``: This release adds support for enabling Rich Messaging when starting a new
    chat session via the StartChatContact API. Rich Messaging enables the following formatting options:
    bold, italics, hyperlinks, bulleted lists, and numbered lists.
  * api-change:``chime``: Chime VoiceConnector Logging APIs will now support MediaMetricLogs. Also
    CreateMeetingDialOut now returns AccessDeniedException.
- from version 1.24.17
  * api-change:``transcribe``: Documentation fix for API `StartMedicalTranscriptionJobRequest`, now
    showing min sample rate as 16khz
  * api-change:``transfer``: Adding more descriptive error types for managed workflows
  * api-change:``lexv2-models``: Update lexv2-models client to latest version
- from version 1.24.16
  * api-change:``comprehend``: Amazon Comprehend now supports extracting the sentiment associated
    with entities such as brands, products and services from text documents.
- from version 1.24.15
  * api-change:``eks``: Introducing a new enum for NodeGroup error code:
    Ec2SubnetMissingIpv6Assignment
  * api-change:``keyspaces``: Adding link to CloudTrail section in Amazon Keyspaces Developer Guide
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added support for reading
    timecode from AVCHD sources and now provides the ability to segment WebVTT at the same interval as
    the video and audio in HLS packages.
- from version 1.24.14
  * api-change:``chime-sdk-meetings``: Adds support for Transcribe language identification feature to
    the StartMeetingTranscription API.
  * api-change:``ecs``: Amazon ECS UpdateService API now supports additional parameters:
    loadBalancers, propagateTags, enableECSManagedTags, and serviceRegistries
  * api-change:``migration-hub-refactor-spaces``: AWS Migration Hub Refactor Spaces documentation
    update.
- from version 1.24.13
  * api-change:``synthetics``: Allow custom handler function.
  * api-change:``transfer``: Add waiters for server online and offline.
  * api-change:``devops-guru``: Amazon DevOps Guru now integrates with Amazon CodeGuru Profiler. You
    can view CodeGuru Profiler recommendations for your AWS Lambda function in DevOps Guru. This
    feature is enabled by default for new customers as of 3/4/2022. Existing customers can enable this
    feature with UpdateEventSourcesConfig.
  * api-change:``macie``: Amazon Macie Classic (macie) has been discontinued and is no longer
    available. A new Amazon Macie (macie2) is now available with significant design improvements and
    additional features.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``connect``: This release updates the *InstanceStorageConfig APIs so they support a
    new ResourceType: REAL_TIME_CONTACT_ANALYSIS_SEGMENTS. Use this resource type to enable streaming
    for real-time contact analysis and to associate the Kinesis stream where real-time contact analysis
    segments will be published.
- from version 1.24.12
  * api-change:``greengrassv2``: Doc only update that clarifies Create Deployment section.
  * api-change:``fsx``: This release adds support for data repository associations to use root ("/")
    as the file system path
  * api-change:``kendra``: Amazon Kendra now suggests spell corrections for a query. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/query-spell-check.html
  * api-change:``appflow``: Launching Amazon AppFlow Marketo as a destination connector SDK.
  * api-change:``timestream-query``: Documentation only update for SDK and CLI
- from version 1.24.11
  * api-change:``gamelift``: Minor updates to address errors.
  * api-change:``cloudtrail``: Add bytesScanned field into responses of DescribeQuery and
    GetQueryResults.
  * api-change:``athena``: This release adds support for S3 Object Ownership by allowing the S3
    bucket owner full control canned ACL to be set when Athena writes query results to S3 buckets.
  * api-change:``keyspaces``: This release adds support for data definition language (DDL) operations
  * api-change:``ecr``: This release adds support for tracking images lastRecordedPullTime.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1649073600">- Update to 1.24.32
  * api-change:``connect``: This release updates these APIs: UpdateInstanceAttribute,
    DescribeInstanceAttribute and ListInstanceAttributes. You can use it to programmatically
    enable/disable multi-party conferencing using attribute type MULTI_PARTY_CONFERENCING on the
    specified Amazon Connect instance.
- from version 1.24.31
  * api-change:``cloudcontrol``: SDK release for Cloud Control API in Amazon Web Services China
    (Beijing) Region, operated by Sinnet, and Amazon Web Services China (Ningxia) Region, operated by
    NWCD
  * api-change:``pinpoint-sms-voice-v2``: Amazon Pinpoint now offers a version 2.0 suite of SMS and
    voice APIs, providing increased control over sending and configuration. This release is a new SDK
    for sending SMS and voice messages called PinpointSMSVoiceV2.
  * api-change:``workspaces``: Added APIs that allow you to customize the logo, login message, and
    help links in the WorkSpaces client login page. To learn more, visit
    https://docs.aws.amazon.com/workspaces/latest/adminguide/customize-branding.html
  * api-change:``route53-recovery-cluster``: This release adds a new API "ListRoutingControls" to
    list routing control states using the highly reliable Route 53 ARC data plane endpoints.
  * api-change:``databrew``: This AWS Glue Databrew release adds feature to support ORC as an input
    format.
  * api-change:``auditmanager``: This release adds documentation updates for Audit Manager. The
    updates provide data deletion guidance when a customer deregisters Audit Manager or deregisters a
    delegated administrator.
  * api-change:``grafana``: This release adds tagging support to the Managed Grafana service. New
    APIs: TagResource, UntagResource and ListTagsForResource. Updates: add optional field tags to
    support tagging while calling CreateWorkspace.
- from version 1.24.30
  * api-change:``iot-data``: Update the default AWS IoT Core Data Plane endpoint from VeriSign signed
    to ATS signed. If you have firewalls with strict egress rules, configure the rules to grant you
    access to data-ats.iot.[region].amazonaws.com or data-ats.iot.[region].amazonaws.com.cn.
  * api-change:``ec2``: This release simplifies the auto-recovery configuration process enabling
    customers to set the recovery behavior to disabled or default
  * api-change:``fms``: AWS Firewall Manager now supports the configuration of third-party policies
    that can use either the centralized or distributed deployment models.
  * api-change:``fsx``: This release adds support for modifying throughput capacity for FSx for ONTAP
    file systems.
  * api-change:``iot``: Doc only update for IoT that fixes customer-reported issues.
- from version 1.24.29
  * api-change:``organizations``: This release provides the new CloseAccount API that enables
    principals in the management account to close any member account within an organization.
- from version 1.24.28
  * api-change:``medialive``: This release adds support for selecting a maintenance window.
  * api-change:``acm-pca``: Updating service name entities
- from version 1.24.27
  * api-change:``ec2``: This is release adds support for Amazon VPC Reachability Analyzer to analyze
    path through a Transit Gateway.
  * api-change:``ssm``: This Patch Manager release supports creating, updating, and deleting Patch
    Baselines for Rocky Linux OS.
  * api-change:``batch``: Bug Fix: Fixed a bug where shapes were marked as unboxed and were not
    serialized and sent over the wire, causing an API error from the service.
- from version 1.24.26
  * api-change:``lambda``: Adds support for increased ephemeral storage (/tmp) up to 10GB for Lambda
    functions. Customers can now provision up to 10 GB of ephemeral storage per function instance, a
    20x increase over the previous limit of 512 MB.
  * api-change:``config``: Added new APIs GetCustomRulePolicy and GetOrganizationCustomRulePolicy,
    and updated existing APIs PutConfigRule, DescribeConfigRule, DescribeConfigRuleEvaluationStatus,
    PutOrganizationConfigRule, DescribeConfigRule to support a new feature for building AWS Config
    rules with AWS CloudFormation Guard
  * api-change:``transcribe``: This release adds an additional parameter for subtitling with Amazon
    Transcribe batch jobs: outputStartIndex.
- from version 1.24.25
  * api-change:``redshift``: This release adds a new [--encrypted | --no-encrypted] field in
    restore-from-cluster-snapshot API. Customers can now restore an unencrypted snapshot to a cluster
    encrypted with AWS Managed Key or their own KMS key.
  * api-change:``ebs``: Increased the maximum supported value for the Timeout parameter of the
    StartSnapshot API from 60 minutes to 4320 minutes.  Changed the HTTP error code for
    ConflictException from 503 to 409.
  * api-change:``gamesparks``: Released the preview of Amazon GameSparks, a fully managed AWS service
    that provides a multi-service backend for game developers.
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``transfer``: Documentation updates for AWS Transfer Family to describe how to remove
    an associated workflow from a server.
  * api-change:``auditmanager``: This release updates 1 API parameter, the SnsArn attribute. The
    character length and regex pattern for the SnsArn attribute have been updated, which enables you to
    deselect an SNS topic when using the UpdateSettings operation.
  * api-change:``ssm``: Update AddTagsToResource, ListTagsForResource, and RemoveTagsFromResource
    APIs to reflect the support for tagging Automation resources. Includes other minor documentation
    updates.
- from version 1.24.24
  * api-change:``location``: Amazon Location Service now includes a MaxResults parameter for
    GetDevicePositionHistory requests.
  * api-change:``polly``: Amazon Polly adds new Catalan voice - Arlet. Arlet is available as Neural
    voice only.
  * api-change:``lakeformation``: The release fixes the incorrect permissions called out in the
    documentation - DESCRIBE_TAG, ASSOCIATE_TAG, DELETE_TAG, ALTER_TAG. This trebuchet release fixes
    the corresponding SDK and documentation.
  * api-change:``ecs``: Documentation only update to address tickets
  * api-change:``ce``: Added three new APIs to support tagging and resource-level authorization on
    Cost Explorer resources: TagResource, UntagResource, ListTagsForResource.  Added optional
    parameters to CreateCostCategoryDefinition, CreateAnomalySubscription and CreateAnomalyMonitor APIs
    to support Tag On Create.
- from version 1.24.23
  * api-change:``ram``: Document improvements to the RAM API operations and parameter descriptions.
  * api-change:``ecr``: This release includes a fix in the DescribeImageScanFindings paginated output.
  * api-change:``quicksight``: AWS QuickSight Service Features - Expand public API support for group
    management.
  * api-change:``chime-sdk-meetings``: Add support for media replication to link multiple WebRTC
    media sessions together to reach larger and global audiences. Participants connected to a replica
    session can be granted access to join the primary session and can switch sessions with their
    existing WebRTC connection
  * api-change:``mediaconnect``: This release adds support for selecting a maintenance window.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1651060800">- Update to 1.25.1
  * api-change:``lightsail``: This release adds support for Lightsail load balancer HTTP to HTTPS
    redirect and TLS policy configuration.
  * api-change:``sagemaker``: SageMaker Inference Recommender now accepts customer KMS key ID for
    encryption of endpoints and compilation outputs created during inference recommendation.
  * api-change:``pricing``: Documentation updates for Price List API
  * api-change:``glue``: This release adds documentation for the APIs to create, read, delete, list,
    and batch read of AWS Glue custom patterns, and for Lake Formation configuration settings in the
    AWS Glue crawler.
  * api-change:``cloudfront``: CloudFront now supports the Server-Timing header in HTTP responses
    sent from CloudFront. You can use this header to view metrics that help you gain insights about the
    behavior and performance of CloudFront. To use this header, enable it in a response headers policy.
  * api-change:``ivschat``: Adds new APIs for IVS Chat, a feature for building interactive chat
    experiences alongside an IVS broadcast.
  * api-change:``network-firewall``: AWS Network Firewall now enables customers to use a customer
    managed AWS KMS key for the encryption of their firewall resources.
- from version 1.25.0
  * api-change:``gamelift``: Documentation updates for Amazon GameLift.
  * api-change:``mq``: This release adds the CRITICAL_ACTION_REQUIRED broker state and the
    ActionRequired API property. CRITICAL_ACTION_REQUIRED informs you when your broker is degraded.
    ActionRequired provides you with a code which you can use to find instructions in the Developer
    Guide on how to resolve the issue.
  * feature:IMDS: Added resiliency mechanisms to IMDS Credential Fetcher
  * api-change:``securityhub``: Security Hub now lets you opt-out of auto-enabling the defaults
    standards (CIS and FSBP) in accounts that are auto-enabled with Security Hub via Security Hub's
    integration with AWS Organizations.
  * api-change:``connect``: This release adds SearchUsers API which can be used to search for users
    with a Connect Instance
  * api-change:``rds-data``: Support to receive SQL query results in the form of a simplified JSON
    string. This enables developers using the new JSON string format to more easily convert it to an
    object using popular JSON string parsing libraries.
- from version 1.24.46
  * api-change:``chime-sdk-meetings``: Include additional exceptions types.
  * api-change:``ec2``: Adds support for waiters that automatically poll for a deleted NAT Gateway
    until it reaches the deleted state.
- from version 1.24.45
  * api-change:``wisdom``: This release updates the GetRecommendations API to include a trigger event
    list for classifying and grouping recommendations.
  * api-change:``elasticache``: Doc only update for ElastiCache
  * api-change:``iottwinmaker``: General availability (GA) for AWS IoT TwinMaker. For more
    information, see https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/Welcome.html
  * api-change:``secretsmanager``: Documentation updates for Secrets Manager
  * api-change:``mediatailor``: This release introduces tiered channels and adds support for live
    sources. Customers using a STANDARD channel can now create programs using live sources.
  * api-change:``storagegateway``: This release adds support for minimum of 5 character length
    virtual tape barcodes.
  * api-change:``lookoutmetrics``: Added DetectMetricSetConfig API for detecting configuration
    required for creating metric set from provided S3 data source.
  * api-change:``iotsitewise``: This release adds 3 new batch data query APIs :
    BatchGetAssetPropertyValue, BatchGetAssetPropertyValueHistory and BatchGetAssetPropertyAggregates
  * api-change:``glue``: This release adds APIs to create, read, delete, list, and batch read of Glue
    custom entity types
- from version 1.24.44
  * api-change:``macie2``: Sensitive data findings in Amazon Macie now indicate how Macie found the
    sensitive data that produced a finding (originType).
  * api-change:``rds``: Added a new cluster-level attribute to set the capacity range for Aurora
    Serverless v2 instances.
  * api-change:``mgn``: Removed required annotation from input fields in Describe operations
    requests. Added quotaValue to ServiceQuotaExceededException
  * api-change:``connect``: This release adds APIs to search, claim, release, list, update, and
    describe phone numbers. You can also use them to associate and disassociate contact flows to phone
    numbers.
- from version 1.24.43
  * api-change:``textract``: This release adds support for specifying and extracting information from
    documents using the Queries feature within Analyze Document API
  * api-change:``worklink``: Amazon WorkLink is no longer supported. This will be removed in a future
    version of the SDK.
  * api-change:``ssm``: Added offset support for specifying the number of days to wait after the date
    and time specified by a CRON expression when creating SSM association.
  * api-change:``autoscaling``: EC2 Auto Scaling now adds default instance warm-up times for all
    scaling activities, health check replacements, and other replacement events in the Auto Scaling
    instance lifecycle.
  * api-change:``personalize``: Adding StartRecommender and StopRecommender APIs for Personalize.
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Quip. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-quip.html
  * api-change:``polly``: Amazon Polly adds new Austrian German voice - Hannah. Hannah is available
    as Neural voice only.
  * api-change:``transfer``: This release contains corrected HomeDirectoryMappings examples for
    several API functions: CreateAccess, UpdateAccess, CreateUser, and UpdateUser,.
  * api-change:``kms``: Adds support for KMS keys and APIs that generate and verify HMAC codes
  * api-change:``redshift``: Introduces new fields for LogDestinationType and LogExports on
    EnableLogging requests and Enable/Disable/DescribeLogging responses. Customers can now select
    CloudWatch Logs as a destination for their Audit Logs.
- from version 1.24.42
  * api-change:``lightsail``: This release adds support to describe the synchronization status of the
    account-level block public access feature for your Amazon Lightsail buckets.
  * api-change:``rds``: Removes Amazon RDS on VMware with the deletion of APIs related to Custom
    Availability Zones and Media installation
  * api-change:``athena``: This release adds subfields, ErrorMessage, Retryable, to the AthenaError
    response object in the GetQueryExecution API when a query fails.
- from version 1.24.41
  * api-change:``batch``: Enables configuration updates for compute environments with
    BEST_FIT_PROGRESSIVE and SPOT_CAPACITY_OPTIMIZED allocation strategies.
  * api-change:``ec2``: Documentation updates for Amazon EC2.
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``appstream``: Includes updates for create and update fleet APIs to manage the session
    scripts locations for Elastic fleets.
  * api-change:``glue``: Auto Scaling for Glue version 3.0 and later jobs to dynamically scale
    compute resources. This SDK change provides customers with the auto-scaled DPU usage
  * api-change:``appflow``: Enables users to pass custom token URL parameters for Oauth2
    authentication during create connector profile
- from version 1.24.40
  * api-change:``cloudwatch``: Update cloudwatch client to latest version
  * api-change:``fsx``: This release adds support for deploying FSx for ONTAP file systems in a
    single Availability Zone.
- from version 1.24.39
  * api-change:``ec2``: X2idn and X2iedn instances are powered by 3rd generation Intel Xeon Scalable
    processors with an all-core turbo frequency up to 3.5 GHzAmazon EC2. C6a instances are powered by
    3rd generation AMD EPYC processors.
  * api-change:``devops-guru``: This release adds new APIs DeleteInsight to deletes the insight along
    with the associated anomalies, events and recommendations.
  * api-change:``efs``: Update efs client to latest version
  * api-change:``iottwinmaker``: This release adds the following new features: 1) ListEntities API
    now supports search using ExternalId. 2) BatchPutPropertyValue and GetPropertyValueHistory API now
    allows users to represent time in sub-second level precisions.
- from version 1.24.38
  * api-change:``amplifyuibuilder``: In this release, we have added the ability to bind events to
    component level actions.
  * api-change:``apprunner``: This release adds tracing for App Runner services with X-Ray using AWS
    Distro for OpenTelemetry. New APIs: CreateObservabilityConfiguration,
    DescribeObservabilityConfiguration, ListObservabilityConfigurations, and
    DeleteObservabilityConfiguration. Updated APIs: CreateService and UpdateService.
  * api-change:``workspaces``: Added API support that allows customers to create GPU-enabled
    WorkSpaces using EC2 G4dn instances.
- from version 1.24.37
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK has added support for the
    pass-through of WebVTT styling to WebVTT outputs, pass-through of KLV metadata to supported
    formats, and improved filter support for processing 444/RGB content.
  * api-change:``wafv2``: Add a new CurrentDefaultVersion field to
    ListAvailableManagedRuleGroupVersions API response; add a new VersioningSupported boolean to each
    ManagedRuleGroup returned from ListAvailableManagedRuleGroups API response.
  * api-change:``mediapackage-vod``: This release adds ScteMarkersSource as an available field for
    Dash Packaging Configurations. When set to MANIFEST, MediaPackage will source the SCTE-35 markers
    from the manifest. When set to SEGMENTS, MediaPackage will source the SCTE-35 markers from the
    segments.
- from version 1.24.36
  * api-change:``apigateway``: ApiGateway CLI command get-usage now includes usagePlanId, startDate,
    and endDate fields in the output to match documentation.
  * api-change:``personalize``: This release provides tagging support in AWS Personalize.
  * api-change:``pi``: Adds support for DocumentDB to the Performance Insights API.
  * api-change:``events``: Update events client to latest version
  * api-change:``docdb``: Added support to enable/disable performance insights when creating or
    modifying db instances
  * api-change:``sagemaker``: Amazon Sagemaker Notebook Instances now supports G5 instance types
- from version 1.24.35
  * bugfix:Proxy: Fix failure case for IP proxy addresses using TLS-in-TLS. `boto/botocore#2652
    &lt;https://github.com/boto/botocore/pull/2652&gt;`__
  * api-change:``config``: Add resourceType enums for AWS::EMR::SecurityConfiguration and
    AWS::SageMaker::CodeRepository
  * api-change:``panorama``: Added Brand field to device listings.
  * api-change:``lambda``: This release adds new APIs for creating and managing Lambda Function URLs
    and adds a new FunctionUrlAuthType parameter to the AddPermission API. Customers can use Function
    URLs to create built-in HTTPS endpoints on their functions.
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Box. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-box.html
- from version 1.24.34
  * api-change:``securityhub``: Added additional ASFF details for RdsSecurityGroup AutoScalingGroup,
    ElbLoadBalancer, CodeBuildProject and RedshiftCluster.
  * api-change:``fsx``: Provide customers more visibility into file system status by adding new
    "Misconfigured Unavailable" status for Amazon FSx for Windows File Server.
  * api-change:``s3control``: Documentation-only update for doc bug fixes for the S3 Control API docs.
  * api-change:``datasync``: AWS DataSync now supports Amazon FSx for OpenZFS locations.
- from version 1.24.33
  * api-change:``iot``: AWS IoT - AWS IoT Device Defender adds support to list metric datapoints
    collected for IoT devices through the ListMetricValues API
  * api-change:``servicecatalog``: This release adds ProvisioningArtifictOutputKeys to
    DescribeProvisioningParameters to reference the outputs of a Provisioned Product and deprecates
    ProvisioningArtifactOutputs.
  * api-change:``sms``: Revised product update notice for SMS console deprecation.
  * api-change:``proton``: SDK release to support tagging for AWS Proton Repository resource
  * enhancement:AWSCRT: Upgrade awscrt version to 0.13.8</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652270400">- Update to 1.25.11
  * api-change:``migration-hub-refactor-spaces``: AWS Migration Hub Refactor Spaces documentation
    only update to fix a formatting issue.
  * api-change:``ec2``: Added support for using NitroTPM and UEFI Secure Boot on EC2 instances.
  * api-change:``emr``: Update emr client to latest version
  * api-change:``compute-optimizer``: Documentation updates for Compute Optimizer
  * api-change:``eks``: Adds BOTTLEROCKET_ARM_64_NVIDIA and BOTTLEROCKET_x86_64_NVIDIA AMI types to
    EKS managed nodegroups
- from version 1.25.10
  * api-change:``evidently``: Add detail message inside GetExperimentResults API response to indicate
    experiment result availability
  * api-change:``ssm-contacts``: Fixed an error in the DescribeEngagement example for AWS Incident
    Manager.
  * api-change:``cloudcontrol``: SDK release for Cloud Control API to include paginators for Python
    SDK.
- from version 1.25.9
  * api-change:``rds``: Various documentation improvements.
  * api-change:``redshift``: Introduces new field 'LoadSampleData' in CreateCluster operation.
    Customers can now specify 'LoadSampleData' option during creation of a cluster, which results in
    loading of sample data in the cluster that is created.
  * api-change:``ec2``: Add new state values for IPAMs, IPAM Scopes, and IPAM Pools.
  * api-change:``mediapackage``: This release adds Dvb Dash 2014 as an available profile option for
    Dash Origin Endpoints.
  * api-change:``securityhub``: Documentation updates for Security Hub API reference
  * api-change:``location``: Amazon Location Service now includes a MaxResults parameter for
    ListGeofences requests.
- from version 1.25.8
  * api-change:``ec2``: Amazon EC2 I4i instances are powered by 3rd generation Intel Xeon Scalable
    processors and feature up to 30 TB of local AWS Nitro SSD storage
  * api-change:``kendra``: AWS Kendra now supports hierarchical facets for a query. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/filtering.html
  * api-change:``iot``: AWS IoT Jobs now allows you to create up to 100,000 active continuous and
    snapshot jobs by using concurrency control.
  * api-change:``datasync``: AWS DataSync now supports a new ObjectTags Task API option that can be
    used to control whether Object Tags are transferred.
- from version 1.25.7
  * api-change:``ssm``: This release adds the TargetMaps parameter in SSM State Manager API.
  * api-change:``backup``: Adds support to 2 new filters about job complete time for 3 list jobs APIs
    in AWS Backup
  * api-change:``lightsail``: Documentation updates for Lightsail
  * api-change:``iotsecuretunneling``: This release introduces a new API RotateTunnelAccessToken that
    allow revoking the existing tokens and generate new tokens
- from version 1.25.6
  * api-change:``ec2``: Adds support for allocating Dedicated Hosts on AWS  Outposts. The
    AllocateHosts API now accepts an OutpostArn request  parameter, and the DescribeHosts API now
    includes an OutpostArn response parameter.
  * api-change:``s3``: Documentation only update for doc bug fixes for the S3 API docs.
  * api-change:``kinesisvideo``: Add support for multiple image feature related APIs for configuring
    image generation and notification of a video stream. Add "GET_IMAGES" to the list of supported API
    names for the GetDataEndpoint API.
  * api-change:``sagemaker``: SageMaker Autopilot adds new metrics for all candidate models generated
    by Autopilot experiments; RStudio on SageMaker now allows users to bring your own development
    environment in a custom image.
  * api-change:``kinesis-video-archived-media``: Add support for GetImages API  for retrieving images
    from a video stream
- from version 1.25.5
  * api-change:``organizations``: This release adds the INVALID_PAYMENT_INSTRUMENT as a fail reason
    and an error message.
  * api-change:``synthetics``: CloudWatch Synthetics has introduced a new feature to provide
    customers with an option to delete the underlying resources that Synthetics canary creates when the
    user chooses to delete the canary.
  * api-change:``outposts``: This release adds a new API called ListAssets to the Outposts SDK, which
    lists the hardware assets in an Outpost.
- from version 1.25.4
  * api-change:``rds``: Feature - Adds support for Internet Protocol Version 6 (IPv6) on RDS database
    instances.
  * api-change:``codeguru-reviewer``: Amazon CodeGuru Reviewer now supports suppressing
    recommendations from being generated on specific files and directories.
  * api-change:``ssm``: Update the StartChangeRequestExecution, adding TargetMaps to the Runbook
    parameter
  * api-change:``mediaconvert``: AWS Elemental MediaConvert SDK nows supports creation of Dolby
    Vision profile 8.1, the ability to generate black frames of video, and introduces audio-only DASH
    and CMAF support.
  * api-change:``wafv2``: You can now inspect all request headers and all cookies. You can now
    specify how to handle oversize body contents in your rules that inspect the body.
- from version 1.25.3
  * api-change:``auditmanager``: This release adds documentation updates for Audit Manager. We
    provided examples of how to use the Custom_ prefix for the keywordValue attribute. We also provided
    more details about the DeleteAssessmentReport operation.
  * api-change:``network-firewall``: AWS Network Firewall adds support for stateful threat signature
    AWS managed rule groups.
  * api-change:``ec2``: This release adds support to query the public key and creation date of EC2
    Key Pairs. Additionally, the format (pem or ppk) of a key pair can be specified when creating a new
    key pair.
  * api-change:``braket``: This release enables Braket Hybrid Jobs with Embedded Simulators to have
    multiple instances.
  * api-change:``guardduty``: Documentation update for API description.
  * api-change:``connect``: This release introduces an API for changing the current agent status of a
    user in Connect.
- from version 1.25.2
  * api-change:``rekognition``: This release adds support to configure stream-processor resources for
    label detections on streaming-videos. UpateStreamProcessor API is also launched with this release,
    which could be used to update an existing stream-processor.
  * api-change:``cloudtrail``: Increases the retention period maximum to 2557 days. Deprecates unused
    fields of the ListEventDataStores API response. Updates documentation.
  * api-change:``lookoutequipment``: This release adds the following new features: 1) Introduces an
    option for automatic schema creation 2) Now allows for Ingestion of data containing most common
    errors and allows automatic data cleaning 3) Introduces new API ListSensorStatistics that gives
    further information about the ingested data
  * api-change:``iotwireless``: Add list support for event configurations, allow to get and update
    event configurations by resource type, support LoRaWAN events; Make NetworkAnalyzerConfiguration as
    a resource, add List, Create, Delete API support; Add FCntStart attribute support for ABP
    WirelessDevice.
  * api-change:``amplify``: Documentation only update to support the Amplify GitHub App feature launch
  * api-change:``chime-sdk-media-pipelines``: For Amazon Chime SDK meetings, the Amazon Chime Media
    Pipelines SDK allows builders to capture audio, video, and content share streams. You can also
    capture meeting events, live transcripts, and data messages. The pipelines save the artifacts to an
    Amazon S3 bucket that you designate.
  * api-change:``sagemaker``: Amazon SageMaker Autopilot adds support for custom validation dataset
    and validation ratio through the CreateAutoMLJob and DescribeAutoMLJob APIs.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1652788800">- Update to 1.26.1
  * api-change:``resiliencehub``: In this release, we are introducing support for Amazon Elastic
    Container Service, Amazon Route 53, AWS Elastic Disaster Recovery, AWS Backup in addition to the
    existing supported Services.  This release also supports Terraform file input from S3 and
    scheduling daily assessments
  * api-change:``servicecatalog``: Updated the descriptions for the ListAcceptedPortfolioShares API
    description and the PortfolioShareType parameters.
  * api-change:``discovery``: Add Migration Evaluator Collector details to the GetDiscoverySummary
    API response
  * api-change:``sts``: Documentation updates for AWS Security Token Service.
  * api-change:``workspaces-web``: Amazon WorkSpaces Web now supports Administrator timeout control
  * api-change:``rekognition``: Documentation updates for Amazon Rekognition.
  * api-change:``cloudfront``: Introduced a new error (TooLongCSPInResponseHeadersPolicy) that is
    returned when the value of the Content-Security-Policy header in a response headers policy exceeds
    the maximum allowed length.
- from version 1.26.0
  * feature:Loaders: Support for loading gzip compressed model files.
  * api-change:``grafana``: This release adds APIs for creating and deleting API keys in an Amazon
    Managed Grafana workspace.
- from version 1.25.13
  * api-change:``ivschat``: Documentation-only updates for IVS Chat API Reference.
  * api-change:``lambda``: Lambda releases NodeJs 16 managed runtime to be available in all
    commercial regions.
  * api-change:``kendra``: Amazon Kendra now provides a data source connector for Jira. For more
    information, see https://docs.aws.amazon.com/kendra/latest/dg/data-source-jira.html
  * api-change:``transfer``: AWS Transfer Family now accepts ECDSA keys for server host keys
  * api-change:``iot``: Documentation update for China region ListMetricValues for IoT
  * api-change:``workspaces``: Increased the character limit of the login message from 600 to 850
    characters.
  * api-change:``finspace-data``: We've now deprecated CreateSnapshot permission for creating a data
    view, instead use CreateDataView permission.
  * api-change:``lightsail``: This release adds support to include inactive database bundles in the
    response of the GetRelationalDatabaseBundles request.
  * api-change:``outposts``: Documentation updates for AWS Outposts.
  * api-change:``ec2``: This release introduces a target type Gateway Load Balancer Endpoint for
    mirrored traffic. Customers can now specify GatewayLoadBalancerEndpoint option during the creation
    of a traffic mirror target.
  * api-change:``ssm-incidents``: Adding support for dynamic SSM Runbook parameter values. Updating
    validation pattern for engagements. Adding ConflictException to UpdateReplicationSet API contract.
- from version 1.25.12
  * api-change:``secretsmanager``: Doc only update for Secrets Manager that fixes several
    customer-reported issues.
  * api-change:``ec2``: This release updates AWS PrivateLink APIs to support IPv6 for PrivateLink
    Services and Endpoints of type 'Interface'.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1653048000">- Update to 1.26.4 (bsc#1199716)
  * api-change:``gamesparks``: This release adds an optional DeploymentResult field in the responses
    of GetStageDeploymentIntegrationTests and ListStageDeploymentIntegrationTests APIs.
  * enhancement:StreamingBody: Allow StreamingBody to be used as a context manager
  * api-change:``lookoutmetrics``: In this release we added SnsFormat to SNSConfiguration to support
    human readable alert.
- from version 1.26.3
  * api-change:``greengrassv2``: This release adds the new DeleteDeployment API operation that you
    can use to delete deployment resources. This release also adds support for discontinued
    AWS-provided components, so AWS can communicate when a component has any issues that you should
    consider before you deploy it.
  * api-change:``quicksight``: API UpdatePublicSharingSettings enables IAM admins to enable/disable
    account level setting for public access of dashboards. When enabled, owners/co-owners for
    dashboards can enable public access on their dashboards. These dashboards can only be accessed
    through share link or embedding.
  * api-change:``appmesh``: This release updates the existing Create and Update APIs for meshes and
    virtual nodes by adding a new IP preference field. This new IP preference field can be used to
    control the IP versions being used with the mesh and allows for IPv6 support within App Mesh.
  * api-change:``batch``: Documentation updates for AWS Batch.
  * api-change:``iotevents-data``: Introducing new API for deleting detectors: BatchDeleteDetector.
  * api-change:``transfer``: AWS Transfer Family now supports SetStat server configuration option,
    which provides the ability to ignore SetStat command issued by file transfer clients, enabling
    customers to upload files without any errors.
- from version 1.26.2
  * api-change:``kms``: Add HMAC best practice tip, annual rotation of AWS managed keys.
  * api-change:``glue``: This release adds a new optional parameter called codeGenNodeConfiguration
    to CRUD job APIs that allows users to manage visual jobs via APIs. The updated CreateJob and
    UpdateJob will create jobs that can be viewed in Glue Studio as a visual graph. GetJob can be used
    to get codeGenNodeConfiguration.</changelog>
</package>
<package pkgid="440aad4a371cc6e57a35cf360f89645c29780c6dc292e8fac1fb011ede1f0180" name="python3-certifi" arch="noarch">
  <version epoch="0" ver="2018.1.18" rel="150000.3.3.1"/>
  <changelog author="mcihar@suse.cz" date="1429704000">- Initial packaging</changelog>
  <changelog author="toddrme2178@gmail.com" date="1443268800">- Update to version 2015.9.6.2:
  * Actually ship weak cert bundle.
  * Provide old cert bundle.
  * Use secure roots by default.
  * Update scripts to use mkcert.org
  * Concatenate the two roots
  * Add the needed 1024-bit roots
  * Move mkcert output to non-core file
- Fix dependencies on SLES 11
- Certifi is released under MPL-2.0; fix the license tag
- Rebase python-certifi-shipped-requests-cabundle.patch</changelog>
  <changelog author="michael@stroeder.com" date="1453464000">- Update to version 2015.11.20.1</changelog>
  <changelog author="jacobwinski@gmail.com" date="1464955200">- Update to version 2016.2.28
- Update copyright year in spec file
- Fix executable warning (fix taken from python3-certifi)</changelog>
  <changelog author="aloisio@gmx.com" date="1491652800">- Updated to version 2017.1.23
- Converted to single-spec
- Updated source URL</changelog>
  <changelog author="dmueller@suse.com" date="1497096000">- update to 2017.4.17</changelog>
  <changelog author="dmueller@suse.com" date="1497182400">- require ca-certificates-mozilla, otherwise certifi does not
  provide any ca bundle (the bundled one that openSUSE patches
  out is the mozilla bundle as well)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1499688000">- Fix wrong-script-interpreter rpmlint error.
- Fix script-without-shebang rpmlint warning.</changelog>
  <changelog author="arun@gmx.de" date="1507032000">- updated patch
- update to version 2017.7.27.1:
  * Use a more expressive API for getting the dir a path is in
  * set zip_safe=False to help out setuptools (#63)
  * Change license from ISC to MPL-2.0 in setup.py
  * Add trove classifiers for missing supported Python versions
  * Rename [wheel] section to [bdist_wheel] as the former is legacy</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1507809600">- add patch to fix version string from 2017.07.27.1 to
  2017.7.27.1 to fix the build on SLE12_SP3 and earlier
  + python-certifi-fix-version-string.patch</changelog>
  <changelog author="jmatejek@suse.com" date="1508328000">- fix macros to support not having python2</changelog>
  <changelog author="dmueller@suse.com" date="1510660800">- update to 2017.11.5:
  * Sync with bundle mozilla release
- remove  python-certifi-fix-version-string.patch: obsolete</changelog>
  <changelog author="arun@gmx.de" date="1517745600">- specfile:
  * update copyright year
- update to version 2018.1.18:
  * Remove 1024-bit root certificates
  * Include license in the list of trove classifiers
  * Include license file in the generated wheel package</changelog>
  <changelog author="dbenini@suse.com" date="1672488000">- remove all TrustCor CAs, as TrustCor issued multiple man-in-the-middle
  certs (bsc#1206212 CVE-2022-23491)
  - TrustCor RootCert CA-1
  - TrustCor RootCert CA-2
  - TrustCor ECA-1
- Add removeTrustCor.patch</changelog>
</package>
<package pkgid="63517b6e7b8f3f9dc4ae7ae5cc25913b30cae4a94396f1fa4826c19ccdd8042f" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.27.1"/>
  <changelog author="mcepl@suse.com" date="1626782400">- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).</changelog>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
</package>
<package pkgid="e6263b30f36c55a7a5be5906601855a42d02c855dab7cde06dcaf377350a6483" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.30.1"/>
  <changelog author="mcepl@suse.com" date="1627300800">- Rebuild to get new headers, avoid building in support for
  stropts.h (bsc#1187338).</changelog>
  <changelog author="qydwhotmail@gmail.com" date="1628596800">- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
  - CVE-2021-3733-ReDoS-urllib-AbstractBasicAuthHandler.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch</changelog>
  <changelog author="schwab@suse.de" date="1629979200">- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there</changelog>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
</package>
<package pkgid="606debca9eea3aabc5c2ba6adba79895a05c25d7d93cd136caaed67df91ed044" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.37.2"/>
  <changelog author="mcepl@suse.com" date="1631707200">- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    ?volatile? keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch</changelog>
  <changelog author="mcepl@suse.com" date="1632398400">- Make build working even on older SLEs.</changelog>
  <changelog author="mcepl@suse.com" date="1632398401">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
</package>
<package pkgid="2e5f87c5482cdad34873a1f98c7efe045be3cfc7f3d61220989f0bfdc428a6a7" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.40.1"/>
  <changelog author="mcepl@suse.com" date="1632398400">- Make python36 primary interpreter on SLE-15</changelog>
  <changelog author="mcepl@suse.com" date="1633521600">- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.</changelog>
  <changelog author="dimstar@opensuse.org" date="1634126400">- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.</changelog>
  <changelog author="mcepl@suse.com" date="1635336000">- The previous construct works only on the current Factory, not
  in SLE.</changelog>
  <changelog author="schwab@suse.de" date="1635940800">- 0001-allow-for-reproducible-builds-of-python-packages.patch: ignore
  permission error when changing the mtime of the source file in presence
  of SOURCE_DATE_EPOCH</changelog>
  <changelog author="dmueller@suse.com" date="1638014400">- build against openssl 1.1 as it is incompatible with openssl 3.0+  (bsc#1190566)</changelog>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
</package>
<package pkgid="c7a2e7cedfa00be7bda63bbd1bc82997a00b17d481f49ca176faebef9caf329d" name="python3-cryptography" arch="aarch64">
  <version epoch="0" ver="2.9.2" rel="150200.13.1"/>
  <changelog author="tchvatal@suse.com" date="1522065600">- Cleanup with spec-cleaner
- Use %setup to unpack all archives do not rely on tar calls</changelog>
  <changelog author="mimi.vx@gmail.com" date="1528804800">- update to 2.2.2
  * fix build on some systems with openssl 1.1.0h</changelog>
  <changelog author="michael@stroeder.com" date="1531915200">- update to 2.3:
  * SECURITY ISSUE: finalize_with_tag() allowed tag truncation by default
    which can allow tag forgery in some cases. The method now enforces the
    min_tag_length provided to the GCM constructor.
  * Added support for Python 3.7.
  * Added extract_timestamp() to get the authenticated timestamp of a Fernet token.
  * Support for Python 2.7.x without hmac.compare_digest has been deprecated.
    We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next
    cryptography release.
  * Fixed multiple issues preventing cryptography from compiling
    against LibreSSL 2.7.x.
  * Added get_revoked_certificate_by_serial_number for quick
    serial number searches in CRLs.
  * The RelativeDistinguishedName class now preserves the order of attributes.
    Duplicate attributes now raise an error instead of silently discarding duplicates.
  * aes_key_unwrap() and aes_key_unwrap_with_padding() now raise InvalidUnwrap
    if the wrapped key is an invalid length, instead of ValueError.</changelog>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="mcepl@suse.com" date="1536321600">- bsc#1101820 CVE-2018-10903 GCM tag forgery via truncated tag in
  finalize_with_tag API
  * add disallow_implicit_tag_truncation.patch from
    https://github.com/pyca/cryptography/commit/688e0f673bfb.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="mcepl@suse.com" date="1569326400">- Add openSSL_111d.patch to make this version of the package
  compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mcepl@suse.com" date="1606737600">- Add 5507-mitigate-Bleichenbacher-attacks.patch (bsc#1178168,
  CVE-2020-25659).</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1614168000">- Add patch CVE-2020-36242-buffer-overflow.patch (bsc#1182066, CVE-2020-36242)
  * Using the Fernet class to symmetrically encrypt multi gigabyte values
    could result in an integer overflow and buffer overflow.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623758400">- Refresh patches for new version
  + 5507-mitigate-Bleichenbacher-attacks.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)</changelog>
</package>
<package pkgid="0acae4709aadd97d99020eac8d3a800ef5896a7196d1f96c673f5f0f8a433894" name="python3-cryptography" arch="x86_64">
  <version epoch="0" ver="2.9.2" rel="150200.13.1"/>
  <changelog author="tchvatal@suse.com" date="1522065600">- Cleanup with spec-cleaner
- Use %setup to unpack all archives do not rely on tar calls</changelog>
  <changelog author="mimi.vx@gmail.com" date="1528804800">- update to 2.2.2
  * fix build on some systems with openssl 1.1.0h</changelog>
  <changelog author="michael@stroeder.com" date="1531915200">- update to 2.3:
  * SECURITY ISSUE: finalize_with_tag() allowed tag truncation by default
    which can allow tag forgery in some cases. The method now enforces the
    min_tag_length provided to the GCM constructor.
  * Added support for Python 3.7.
  * Added extract_timestamp() to get the authenticated timestamp of a Fernet token.
  * Support for Python 2.7.x without hmac.compare_digest has been deprecated.
    We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next
    cryptography release.
  * Fixed multiple issues preventing cryptography from compiling
    against LibreSSL 2.7.x.
  * Added get_revoked_certificate_by_serial_number for quick
    serial number searches in CRLs.
  * The RelativeDistinguishedName class now preserves the order of attributes.
    Duplicate attributes now raise an error instead of silently discarding duplicates.
  * aes_key_unwrap() and aes_key_unwrap_with_padding() now raise InvalidUnwrap
    if the wrapped key is an invalid length, instead of ValueError.</changelog>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="mcepl@suse.com" date="1536321600">- bsc#1101820 CVE-2018-10903 GCM tag forgery via truncated tag in
  finalize_with_tag API
  * add disallow_implicit_tag_truncation.patch from
    https://github.com/pyca/cryptography/commit/688e0f673bfb.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="mcepl@suse.com" date="1569326400">- Add openSSL_111d.patch to make this version of the package
  compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mcepl@suse.com" date="1606737600">- Add 5507-mitigate-Bleichenbacher-attacks.patch (bsc#1178168,
  CVE-2020-25659).</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="steven.kowalik@suse.com" date="1614168000">- Add patch CVE-2020-36242-buffer-overflow.patch (bsc#1182066, CVE-2020-36242)
  * Using the Fernet class to symmetrically encrypt multi gigabyte values
    could result in an integer overflow and buffer overflow.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623758400">- Refresh patches for new version
  + 5507-mitigate-Bleichenbacher-attacks.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)</changelog>
</package>
<package pkgid="5a33f00e07bd1a58f6d4fb7fe5e1276e5e4b450986e154dfdf5abadf08daa9ab" name="python3-cryptography" arch="aarch64">
  <version epoch="0" ver="3.3.2" rel="150200.16.1"/>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="mcepl@suse.com" date="1569326400">- Add openSSL_111d.patch to make this version of the package
  compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL?s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1606737600">- Add 5507-mitigate-Bleichenbacher-attacks.patch (bsc#1178168,
  CVE-2020-25659).</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="steven.kowalik@suse.com" date="1614168000">- Add patch CVE-2020-36242-buffer-overflow.patch (bsc#1182066, CVE-2020-36242)
  * Using the Fernet class to symmetrically encrypt multi gigabyte values
    could result in an integer overflow and buffer overflow.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623758400">- Refresh patches for new version
  + 5507-mitigate-Bleichenbacher-attacks.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1658404800">- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)</changelog>
</package>
<package pkgid="f6eb3086d4472466c0c0e6826395148c14185cbe18d379bfd1e86977f539aef3" name="python3-cryptography" arch="x86_64">
  <version epoch="0" ver="3.3.2" rel="150200.16.1"/>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="mcepl@suse.com" date="1569326400">- Add openSSL_111d.patch to make this version of the package
  compatible with OpenSSL 1.1.1d, thus fixing bsc#1149792.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL?s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1606737600">- Add 5507-mitigate-Bleichenbacher-attacks.patch (bsc#1178168,
  CVE-2020-25659).</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="steven.kowalik@suse.com" date="1614168000">- Add patch CVE-2020-36242-buffer-overflow.patch (bsc#1182066, CVE-2020-36242)
  * Using the Fernet class to symmetrically encrypt multi gigabyte values
    could result in an integer overflow and buffer overflow.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1623758400">- Refresh patches for new version
  + 5507-mitigate-Bleichenbacher-attacks.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1625572800">- Update in SLE-15 (bsc#1177083, jsc#PM-2730, jsc#SLE-18312)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1658404800">- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)</changelog>
</package>
<package pkgid="9d1eefe6fa1edc7baf76d90a443d136fccb743fd3e45bbc768f353424ca5824b" name="python3-future" arch="noarch">
  <version epoch="0" ver="0.18.2" rel="150300.3.3.1"/>
  <changelog author="glin@suse.com" date="1450094400">- initial import: 0.15.2 (fate#320644)</changelog>
  <changelog author="glin@suse.com" date="1473422400">- Remove %ghost from %{_bindir}/futurize and %{_bindir}/pasteurize
  (fate#320644)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1473940800">- Fix update-alternatives usage.</changelog>
  <changelog author="okurz@suse.com" date="1474459200">- Fix rpm uninstall warnings by removing alternatives in postun as
  discussed in https://build.opensuse.org/request/show/427095</changelog>
  <changelog author="ms@suse.com" date="1476187200">- Tracker changelog entry to add python-future to SLE12 (bnc#999200)</changelog>
  <changelog author="mimi.vx@gmail.com" date="1480075200">- update to 0.16.0
  * Fix newbytes constructor bug.
  * Fix semantics of bool() with newobject.
  * Fix standard_library.install_aliases() on PyPy
  * Fix assertRaises for pow and compile` on Python 3.5.
  * Fix return argument of future.utils.ensure_new_type
  if conversion to new type does not exist.
  * Add missing cmp_to_key for Py2.6.
  * Allow the old_div fixer to be disabled.
  * Improve compatibility with Google App Engine.
  * Add some missing imports to the tkinter and tkinter.filedialog
  package namespaces
  * Fix raise_from on PY3 when the exception cannot be recreated from its repr.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1491480000">- Implement single-spec version</changelog>
  <changelog author="toddrme2178@gmail.com" date="1542369600">- Update to version 0.17.1
  * This release address a packaging error because of an erroneous declaration that
    any built wheels are universal.
- Update to version 0.17.0
  * Fix ``from collections import ChainMap`` after install_aliases() (issue #226)
  * Fix multiple import from ``__future__`` bug in futurize (issue #113)
  * Add support for proper %s formatting of newbytes
  * Properly implement iterator protocol for newrange object
  * Fix ``past.translation`` on read-only file systems
  * Fix Tkinter import bug introduced in Python 2.7.4 (issue #262)
  * Correct TypeError to ValueError in a specific edge case for newrange
  * Support inequality tests betwen newstrs and newbytes
  * Add type check to __get__ in newsuper
  * Fix fix_divsion_safe to support better conversion of complex expressions, and
    skip obvious float division.</changelog>
  <changelog author="mcepl@suse.com" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="jayvdb@gmail.com" date="1552305600">- Activate test suite</changelog>
  <changelog author="jayvdb@gmail.com" date="1557230400">- Change License from MIT to MIT and Python-2.0</changelog>
  <changelog author="mcepl@suse.com" date="1570017600">- Add python38-compat.patch to fix compatibility with Python 3.8
  gh#PythonCharmers/python-future#447
- Add python38-pow.patch not to expect exception on new available
  parameters for Python 3.8. gh#PythonCharmers/python-future#474</changelog>
  <changelog author="steven.kowalik@suse.com" date="1571054400">- Update to 0.18.0.
- Remove python38-compat.patch, already included.
- Add future-correct-mimetype.patch, since Python 3.8 is able to detect
  the MIME type now.</changelog>
  <changelog author="mcepl@suse.com" date="1575547200">- Update to 0.18.2:
  - Fix min/max functions with generators, and 'None' default (PR #514)
  - Use BaseException in raise_() (PR #515)
  - Fix builtins.round() for Decimals (Issue #501)
  - Fix raise_from() to prevent failures with immutable classes (PR #518)
  - Make FixInput idempotent (Issue #427)
  - Fix type in newround (PR #521)
  - Support mimetype guessing in urllib2 for Py3.8+ (Issue #508)
  - fix for raise_() when passed an exception that's not an
    Exception (e.g. BaseException subclasses)
- Rebase future-correct-mimetype.patch to revert incorrect fix in
  gh#PythonCharmers/python-future#508</changelog>
  <changelog author="daniel.garcia@suse.com" date="1672920000">- Add CVE-2022-40899.patch to fix REDoS in http.cookiejar
  gh#PythonCharmers/python-future#610
  bsc#1206673</changelog>
</package>
<package pkgid="2e5953f1a968d218a7f908a77be5f3cefa80d955766f1484d10f280c548f8d6d" name="python3-libxml2-python" arch="aarch64">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="mgorse@suse.com" date="1548676800">- Add libxml2-python3-string-null-check.patch: fix NULL pointer
    dereference when parsing invalid data (bsc#1065270
    glgo#libxml2!15).).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
- Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="f2705c67235f7cd4ebc0620c65290835bde24e59326c9de2cb60a67375ae80dc" name="python3-libxml2-python" arch="x86_64">
  <version epoch="0" ver="2.9.7" rel="150000.3.51.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="mgorse@suse.com" date="1548676800">- Add libxml2-python3-string-null-check.patch: fix NULL pointer
    dereference when parsing invalid data (bsc#1065270
    glgo#libxml2!15).).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
- Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="bee9682b6c58e2907b03eabc7fe81ece74066861109423420154af16c1a88dc1" name="python3-libxml2-python" arch="aarch64">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="mgorse@suse.com" date="1548676800">- Add libxml2-python3-string-null-check.patch: fix NULL pointer
    dereference when parsing invalid data (bsc#1065270
    glgo#libxml2!15).).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
- Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="bdde7321aedceead5fbb767aa10a4a8b92e9a744074baa21bf112b0a28d9e08b" name="python3-libxml2-python" arch="x86_64">
  <version epoch="0" ver="2.9.7" rel="150000.3.54.1"/>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Version update to 2.9.7 release:
  * Bug Fixes:
    + xmlcatalog: restore ability to query system catalog easily
    + Fix comparison of nodesets to strings
  * Improvements:
    + Add Makefile rules to rebuild HTML man pages
    + Remove generated file python/setup.py from version control
    + Fix mixed decls and code in timsort.h
    + Rework handling of return values in thread tests
    + Fix unused variable warnings in testrecurse
    + Fix -Wimplicit-fallthrough warnings
    + Upgrade timsort.h to latest revision
    + Fix a couple of warnings in dict.c and threads.c
    + Fix unused variable warnings in nanohttp.c
    + Don't include winsock2.h in xmllint.c
    + Use __linux__ macro in generated code
  * Portability:
    + Add declaration for DllMain
    + Fix preprocessor conditional in threads.h
    + Fix macro redefinition warning
    + many Windows specific improvements
  * Documentation:
    + xmlcatalog: refresh man page wrt. quering system catalog easily
- Includes bug fixes from 2.9.6:
  * Fix XPath stack frame logic
  * Report undefined XPath variable error message
  * Fix regression with librsvg
  * Handle more invalid entity values in recovery mode
  * Fix structured validation errors
  * Fix memory leak in LZMA decompressor
  * Set memory limit for LZMA decompression
  * Handle illegal entity values in recovery mode
  * Fix debug dump of streaming XPath expressions
  * Fix memory leak in nanoftp
  * Fix memory leaks in SAX1 parser
- Drop libxml2-bug787941.patch
  * upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148800">- Security fix [bsc#1102046, CVE-2018-14404]
  * NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can
    allow attackers to cause a denial of service
  * Added libxml2-CVE-2018-14404.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1536148801">- Security fix:
  [bsc#1088279, CVE-2018-9251][bsc#1105166, CVE-2018-14567]
  * Infinite loop in LZMA decompression
  * Fixes CVE-2018-9251 introduced by CVE-2017-18258
  * Added libxml2-CVE-2018-14567.patch</changelog>
  <changelog author="mgorse@suse.com" date="1548676800">- Add libxml2-python3-string-null-check.patch: fix NULL pointer
    dereference when parsing invalid data (bsc#1065270
    glgo#libxml2!15).).</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1562241600">- Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH
  to avoid nodeset limit when processing large XML files [bsc#1135123]
  * Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Synchronize changelog files for libxml2 and python-libxml2-python [bsc#1123919]</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1577966400">- Security fix: [bsc#1159928, CVE-2019-19956]
  * Memory leak related to newDoc-&gt;oldNs in xmlParseBalancedChunkMemoryRecover:parser.c
- Add libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1579694400">- Security fix: [bsc#1161517, CVE-2020-7595]
  * xmlStringLenDecodeEntities in parser.c has an infinite loop in
    a certain end-of-file situation
- Add libxml2-CVE-2020-7595.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1582891200">- Security fix: [bsc#1161521, CVE-2019-20388]
  * Memory leak in xmlSchemaPreRun in xmlschemas.c
- Add libxml2-CVE-2019-20388.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1590580800">- Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]
- Remove libxml2-CVE-2019-19956.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1599480000">- Security fix: [bsc#1176179, CVE-2020-24977]
  * xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal
- Add patch libxml2-CVE-2020-24977.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1606305600">- Avoid quadratic checking of identity-constraints: [bsc#1178823]
  * key/unique/keyref schema attributes currently use qudratic loops
    to check their various constraints (that keys are unique and that
    keyrefs refer to existing keys).
  * This fix uses a hash table to avoid the quadratic behaviour.
- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185409, CVE-2021-3516]
  * Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3516.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611202">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, bsc#1185879, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="david.anes@suse.com" date="1646136000">- Security fix: [bsc#1196490, CVE-2022-23308]
  * Use-after-free of ID and IDREF attributes.
- Add libxml2-CVE-2022-23308.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1661774400">- Security fix: [bsc#1201978, CVE-2016-3709]
  * Cross-site scripting vulnerability after commit 960f0e2
  * Add libxml2-CVE-2016-3709.patch</changelog>
  <changelog author="david.anes@suse.com" date="1666008000">- Security fixes:
  * [CVE-2022-40303, bsc#1204366] Fix integer overflows with
    XML_PARSE_HUGE
    + Added patch libxml2-CVE-2022-40303.patch
  * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by
    entity reference cycles
    + Added patch libxml2-CVE-2022-40304.patch</changelog>
</package>
<package pkgid="cd03eea1444c9c85beb5c0466b4b1c8d6ba413c582c1424524ff657be1f37764" name="python3-msgpack" arch="aarch64">
  <version epoch="0" ver="0.5.6" rel="150100.3.3.1"/>
  <changelog author="toddrme2178@gmail.com" date="1416312000">- Update to 0.4.2
  Bugfixes
  - Unpacker doesn't increment refcount of ExtType hook.
  - Packer raises no exception for inputs doesn't fit to msgpack format.
- Update to 0.4.1
  Changes
  - fallback.Unpacker.feed() supports bytearray.
  Bugs fixed
  - Unpacker doesn't increment refcount of hooks. Hooks may be GCed while unpacking.
  - Unpacker may read unfilled internal buffer.</changelog>
  <changelog author="hpj@urpla.net" date="1426507200">- Update to version 0.4.6
  * fallback.Unpacker: Fix Data corruption when OutOfData. This bug
    only affects "Streaming unpacking."
- Changes from version 0.4.5
  * Fix test failure on pytest 2.3.
  * Fix typos in ChangeLog.
  * Improve README.rst
- Changes from version 0.4.4
  * Fix compile error.
- Changes from version 0.4.3
  * Unpacker may unpack wrong uint32 value on 32bit or LLP64
    environment. (#101)
  * Build failed on Windows Python 2.7.</changelog>
  <changelog author="mc@suse.com" date="1445083200">- build conditionally without tests</changelog>
  <changelog author="dmueller@suse.com" date="1479211200">- update to 0.4.8</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492603200">- Implement single-spec version.</changelog>
  <changelog author="dmueller@suse.com" date="1517054400">- update to 0.5.1:
  * Package name on PyPI was changed to msgpack from 0.5.
- rename from msgpack-python</changelog>
  <changelog author="jengelh@inai.de" date="1517313600">- Strip rheotrics from descriptions.</changelog>
  <changelog author="tbechtold@suse.com" date="1517918400">- update to version 0.5.4
  * packer: Use PyUnicode_AsUTF8AndSize() for utf-8 (#272)
  * Fix encoding and unicode_errors (#277)
  * Undeprecate unicode_errors (#278)
  * Packer.pack() reset buffer on exception (#274)
  * Use cython's cast for converting encoding and errors (#279)
  * 0.5.4
  * Add raw_as_bytes option to Unpacker. (#265)
  * s/raw_as_bytes/raw/g (#276)</changelog>
  <changelog author="dmueller@suse.com" date="1518436800">- fix typo in obsoletes</changelog>
  <changelog author="alarrosa@suse.com" date="1519646400">- Provide also python-msgpack-python in the python2 package to
  be able to obsolete the python2-msgpack-python package correctly.</changelog>
  <changelog author="alarrosa@suse.com" date="1519905600">- Update to version 0.5.6 (boo#1123558)
  * Fix fallback.Unpacker.feed() dropped unused data from buffer
  * Resurrect fallback.unpack() and _unpacker.unpack(). They were
    removed at 0.5.5 but it breaks backward compatibility.
- Update to version 0.5.5
  * Fix memory leak in pure Python Unpacker.feed()
  * Fix unpack() didn't support raw option</changelog>
  <changelog author="alarrosa@suse.com" date="1548763200">- Use %license</changelog>
  <changelog author="mcepl@suse.com" date="1664280000">- Loose the filelist for the package info to avoid FTBFS on
  SLE-15-SP5 (bsc#1203743).</changelog>
</package>
<package pkgid="ef39fa91132748507b1cc134cce31582fbe4a80528ef3100e55b7a97e81681e0" name="python3-msgpack" arch="x86_64">
  <version epoch="0" ver="0.5.6" rel="150100.3.3.1"/>
  <changelog author="toddrme2178@gmail.com" date="1416312000">- Update to 0.4.2
  Bugfixes
  - Unpacker doesn't increment refcount of ExtType hook.
  - Packer raises no exception for inputs doesn't fit to msgpack format.
- Update to 0.4.1
  Changes
  - fallback.Unpacker.feed() supports bytearray.
  Bugs fixed
  - Unpacker doesn't increment refcount of hooks. Hooks may be GCed while unpacking.
  - Unpacker may read unfilled internal buffer.</changelog>
  <changelog author="hpj@urpla.net" date="1426507200">- Update to version 0.4.6
  * fallback.Unpacker: Fix Data corruption when OutOfData. This bug
    only affects "Streaming unpacking."
- Changes from version 0.4.5
  * Fix test failure on pytest 2.3.
  * Fix typos in ChangeLog.
  * Improve README.rst
- Changes from version 0.4.4
  * Fix compile error.
- Changes from version 0.4.3
  * Unpacker may unpack wrong uint32 value on 32bit or LLP64
    environment. (#101)
  * Build failed on Windows Python 2.7.</changelog>
  <changelog author="mc@suse.com" date="1445083200">- build conditionally without tests</changelog>
  <changelog author="dmueller@suse.com" date="1479211200">- update to 0.4.8</changelog>
  <changelog author="toddrme2178@gmail.com" date="1492603200">- Implement single-spec version.</changelog>
  <changelog author="dmueller@suse.com" date="1517054400">- update to 0.5.1:
  * Package name on PyPI was changed to msgpack from 0.5.
- rename from msgpack-python</changelog>
  <changelog author="jengelh@inai.de" date="1517313600">- Strip rheotrics from descriptions.</changelog>
  <changelog author="tbechtold@suse.com" date="1517918400">- update to version 0.5.4
  * packer: Use PyUnicode_AsUTF8AndSize() for utf-8 (#272)
  * Fix encoding and unicode_errors (#277)
  * Undeprecate unicode_errors (#278)
  * Packer.pack() reset buffer on exception (#274)
  * Use cython's cast for converting encoding and errors (#279)
  * 0.5.4
  * Add raw_as_bytes option to Unpacker. (#265)
  * s/raw_as_bytes/raw/g (#276)</changelog>
  <changelog author="dmueller@suse.com" date="1518436800">- fix typo in obsoletes</changelog>
  <changelog author="alarrosa@suse.com" date="1519646400">- Provide also python-msgpack-python in the python2 package to
  be able to obsolete the python2-msgpack-python package correctly.</changelog>
  <changelog author="alarrosa@suse.com" date="1519905600">- Update to version 0.5.6 (boo#1123558)
  * Fix fallback.Unpacker.feed() dropped unused data from buffer
  * Resurrect fallback.unpack() and _unpacker.unpack(). They were
    removed at 0.5.5 but it breaks backward compatibility.
- Update to version 0.5.5
  * Fix memory leak in pure Python Unpacker.feed()
  * Fix unpack() didn't support raw option</changelog>
  <changelog author="alarrosa@suse.com" date="1548763200">- Use %license</changelog>
  <changelog author="mcepl@suse.com" date="1664280000">- Loose the filelist for the package info to avoid FTBFS on
  SLE-15-SP5 (bsc#1203743).</changelog>
</package>
<package pkgid="dcf2e0d6fc1a19b00e4e10e459cbf2084f0e693a77a3b7923ce06db17556d863" name="python3-psutil" arch="aarch64">
  <version epoch="0" ver="5.8.0" rel="150300.3.3.2"/>
  <changelog author="arun@gmx.de" date="1550318400">- update to version 5.5.1:
  * Enhancements
    + 1348: [Windows] on Windows &gt;= 8.1 if Process.cmdline() fails due
    to ERROR_ACCESS_DENIED attempt using NtQueryInformationProcess +
    ProcessCommandLineInformation. (patch by EccoTheFlintstone)
  * Bug fixes
    + 1394: [Windows] Process.exe() returns "[Error 0] The operation
    completed successfully" when Python process runs in "Virtual
    Secure Mode".
    + 1402: psutil exceptions' repr() show the internal private module
    path.
    + 1408: [AIX] psutil won't compile on AIX 7.1 due to missing
    header. (patch by Arnon Yaari)</changelog>
  <changelog author="arun@gmx.de" date="1552132800">- update to version 5.6.0:
  * Enhancements
    + 1379: [Windows] Process suspend() and resume() now use
    NtSuspendProcess and NtResumeProcess instead of
    stopping/resuming all threads of a process. This is faster and
    more reliable (aka this is what ProcessHacker does).
    + 1420: [Windows] in case of exception disk_usage() now also shows
    the path name.
    + 1422: [Windows] Windows APIs requiring to be dynamically loaded
    from DLL libraries are now loaded only once on startup (instead
    of on per function call) significantly speeding up different
    functions and methods.
    + 1426: [Windows] PAGESIZE and number of processors is now
    calculated on startup.
    + 1428: in case of error, the traceback message now shows the
    underlying C function called which failed.
    + 1433: new Process.parents() method. (idea by Ghislain Le Meur)
    + 1437: pids() are returned in sorted order.
    + 1442: python3 is now the default interpreter used by Makefile.
  * Bug fixes
    + 1353: process_iter() is now thread safe (it rarely raised
    TypeError).
    + 1394: [Windows] Process name() and exe() may erroneously return
    "Registry". QueryFullProcessImageNameW is now used instead of
    GetProcessImageFileNameW in order to prevent that.
    + 1411: [BSD] lack of Py_DECREF could cause segmentation fault on
    process instantiation.
    + 1419: [Windows] Process.environ() raises NotImplementedError
    when querying a 64-bit process in 32-bit-WoW mode. Now it raises
    AccessDenied.
    + 1427: [OSX] Process cmdline() and environ() may erroneously
    raise OSError on failed malloc().
    + 1429: [Windows] SE DEBUG was not properly set for current
    process. It is now, and it should result in less AccessDenied
    exceptions for low-pid processes.
    + 1432: [Windows] Process.memory_info_ex()'s USS memory is
    miscalculated because we're not using the actual system
    PAGESIZE.
    + 1439: [NetBSD] Process.connections() may return incomplete
    results if using oneshot().
    + 1447: original exception wasn't turned into NSP/AD exceptions
    when using Process.oneshot() ctx manager.
  * Incompatible API changes
    + 1291: [OSX] Process.memory_maps() was removed because inherently
    broken (segfault) for years.</changelog>
  <changelog author="jayvdb@gmail.com" date="1552910400">- Active test suite, using skip-test-missing-warnings.patch to
  explicitly skip 2 tests regarding warnings, skip-flaky-i586.patch
  to skip a flaky i586 test, and setting TRAVIS to skip tests which
  upstream doesnt run in their CI
- Add upstream pr_1364.patch to fix reading /sys/blocks on Linux 4.18+
- Remove tests from installed package
- Use URL https://github.com/giampaolo/psutil
- Use LANG=en_US.UTF-8 in %check to avoid failure in test_pmap
- update to version 5.6.1
  * No changes effecting Linux
  * Many checks added to tests to skip tests for missing features</changelog>
  <changelog author="tchvatal@suse.com" date="1558785600">- Update to 5.6.2:
  * 1404: [Linux] cpu_count(logical=False) uses a second method (read from /sys/devices/system/cpu/cpu[0-9]/topology/core_id) in order to determine the number of physical CPUs in case /proc/cpuinfo does not provide this info.
  * 1458: provide coloured test output. Also show failures on KeyboardInterrupt.
  * 1464: various docfixes (always point to python3 doc, fix links, etc.).
  * 1478: add make command to re-run tests failed on last run.
  * 1456: [Linux] cpu_freq() returns None instead of 0.0 when min/max not available (patch by Alex Manuskin)
  * 1462: [Linux] (tests) make tests invariant to LANG setting (patch by Benjamin Drung)
  * 1463: cpu_distribution.py script was broken.
  * 1470: [Linux] disk_partitions(): fix corner case when /etc/mtab doesn't exist. (patch by Cedric Lamoriniere)
  * 1472: [Linux] cpu_freq() does not return all CPUs on Rasbperry-pi 3.
  * 1493: [Linux] cpu_freq(): handle the case where /sys/devices/system/cpu/cpufreq/ exists but is empty.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 5.6.3:
  * 1494: [AIX] added support for Process.environ(). (patch by Arnon Yaari)
  * 1276: [AIX] can't get whole cmdline(). (patch by Arnon Yaari)
  * 1501_: [Windows] Process cmdline() and exe() raise unhandled "WinError 1168 element not found" exceptions for "Registry" and "Memory Compression" psuedo processes on Windows 10.
  * 1526_: [NetBSD] process cmdline() could raise MemoryError. (patch by Kamil Rytarowski)</changelog>
  <changelog author="tchvatal@suse.com" date="1568116800">- Add patch to skip more tests that won't work in OBS:
  * skip-obs.patch</changelog>
  <changelog author="arun@gmx.de" date="1573300800">- update to version 5.6.5:
  * Bug fixes
    + 1615: remove pyproject.toml as it was causing installation
    issues.
- changes from version 5.6.4:
  * Enhancements
    + 1527: [Linux] added Process.cpu_times().iowait counter, which is
    the time spent waiting for blocking I/O to complete.
    + 1565: add PEP 517/8 build backend and requirements specification
    for better pip integration. (patch by Bernát Gábor)
  * Bug fixes
    + 875: [Windows] Process' cmdline(), environ() or cwd() may
    occasionally fail with ERROR_PARTIAL_COPY which now gets
    translated to AccessDenied.
    + 1126: [Linux] cpu_affinity() segfaults on CentOS 5 /
    manylinux. cpu_affinity() support for CentOS 5 was removed.
    + 1528: [AIX] compilation error on AIX 7.2 due to 32 vs 64 bit
    differences. (patch by Arnon Yaari)
    + 1535: 'type' and 'family' fields returned by net_connections()
    are not always turned into enums.
    + 1536: [NetBSD] process cmdline() erroneously raise ZombieProcess
    error if cmdline has non encodable chars.
    + 1546: usage percent may be rounded to 0 on Python 2.
    + 1552: [Windows] getloadavg() math for calculating 5 and 15 mins
    values is incorrect.
    + 1568: [Linux] use CC compiler env var if defined.
    + 1570: [Windows] NtWow64* syscalls fail to raise the proper error
    code
    + 1585: [OSX] calling close() (in C) on possible negative
    integers. (patch by Athos Ribeiro)
    + 1606: [SunOS] compilation fails on SunOS 5.10. (patch by vser1)</changelog>
  <changelog author="arun@gmx.de" date="1574942400">- update to version 5.6.7:
  * Bug fixes
    + 1630: [Windows] can't compile source distribution due to C
    syntax error.
- changes from version 5.6.6:
  * Bug fixes
    + 1179: [Linux] Process cmdline() now takes into account
    misbehaving processes renaming the command line and using
    inappropriate chars to separate args.
    + 1616: use of Py_DECREF instead of Py_CLEAR will result in double
    free and segfault (CVE). (patch by Riccardo Schirone)
    + 1619: [OpenBSD] compilation fails due to C syntax error. (patch
    by Nathan Houghton)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Add pr_1665.patch: Future-proof disk_io_counters on Linux. Fixes
  tests with Linux 5.5.</changelog>
  <changelog author="tchvatal@suse.com" date="1584187200">- Update to 5.7.0:
  * Various fixes to build with updated kernel/etc.
- Remove merged patch pr_1665.patch and pr_1364.patch
- Update patch skip-obs.patch
- Remove skip-test-missing-warnings.patch as it can be fixed by
  properly calling the tests</changelog>
  <changelog author="mcepl@suse.com" date="1598011200">- Add skip_failing_tests.patch to skip tests failing because of
  incomplete emulation of the environment in osc build
  environment (gh#giampaolo/psutil#1635).</changelog>
  <changelog author="dmueller@suse.com" date="1600257600">- update to 5.7.2:
  * parallel tests on UNIX (make test-parallel). They're twice as fast!
  * 1741: "make build/install" is now run in parallel and it's about 15% faster on UNIX.
  * 1747: Process.wait() on POSIX returns an enum, showing the negative signal which was used to terminate the process
  * 1747: Process.wait() return value is cached so that the exit code can be retrieved on then next call.
  * 1747: Process provides more info about the process on str() and repr() (status and exit code):
  * 1757: memory leak tests are now stable.
  * 1768: [Windows] added support for Windows Nano Server. (contributed by Julien Lebot)
  * 1726: [Linux] cpu_freq() parsing should use spaces instead of tabs on ia64. (patch by Micha? Górny)
  * 1760: [Linux] Process.rlimit() does not handle long long type properly.
  * 1766: [macOS] NoSuchProcess may be raised instead of ZombieProcess.
  * 1781: fix signature of callback function for getloadavg(). (patch by Ammar Askar)
  - remove skip-flaky-i586.patch (obsolete)</changelog>
  <changelog author="code@bnavigator.de" date="1604404800">- Fix shebang replacement for multiple python flavors</changelog>
  <changelog author="dmueller@suse.com" date="1606824000">- update to 5.7.3:
  - 809_: [FreeBSD] add support for `Process.rlimit()`.
  - 893_: [BSD] add support for `Process.environ()` (patch by Armin Gruner)
  - 1830_: [UNIX] `net_if_stats()`'s `isup` also checks whether the NIC is
    running (meaning Wi-Fi or ethernet cable is connected).
  - 1837_: [Linux] improved battery detection and charge "secsleft" calculation
  - 1620_: [Linux] physical cpu_count() result is incorrect on systems with more
    than one CPU socket.
  - 1738_: [macOS] Process.exe() may raise FileNotFoundError if process is still
    alive but the exe file which launched it got deleted.
  - 1791_: [macOS] fix missing include for getpagesize().
  - 1823_: [Windows] Process.open_files() may cause a segfault due to a NULL
    pointer.
  - 1838_: [Linux] sensors_battery(): if `percent` can be determined but not
    the remaining values, still return a result instead of None.
- skip-obs.patch, skip_failing_tests.patch: rediff</changelog>
  <changelog author="asn@cryptomilk.org" date="1607688000">- Add missing BR for unittest2</changelog>
  <changelog author="code@bnavigator.de" date="1607688001">- Only require unittest2 for Leap.</changelog>
  <changelog author="alarrosa@suse.com" date="1611576000">- update to 5.8.0:
  * Enhancements:
  - 1863: disk_partitions() exposes 2 extra fields: maxfile and
    maxpath, which are the maximum file name and path name
    length.
  - 1872: [Windows] added support for PyPy 2.7.
  - 1879: provide pre-compiled wheels for Linux and macOS.
  - 1880: get rid of Travis and Cirrus CI services (they are no
    longer free). CI testing is now done by GitHub Actions on
    Linux, macOS and FreeBSD (yes). AppVeyor is still being used
    for Windows CI.
  * Bug fixes:
  - 1708: [Linux] get rid of sensors_temperatures() duplicates.
    (patch by Tim Schlueter).
  - 1839: [Windows] always raise AccessDenied when failing to
    query 64 processes from 32 bit ones (NtWoW64 APIs).
  - 1866: [Windows] process exe(), cmdline(), environ() may raise
    "invalid access to memory location" on Python 3.9.
  - 1874: [Solaris] wrong swap output given when encrypted column
    is present.
  - 1875: [Windows] process username() may raise
    ERROR_NONE_MAPPED if the SID has no corresponding account
    name. In this case AccessDenied is now raised.
  - 1877: [Windows] OpenProcess may fail with ERROR_SUCCESS.
    Turn it into AccessDenied or NoSuchProcess depending on
    whether the PID is alive.
  - 1886: [macOS] EIO error may be raised on cmdline() and
    environment(). Now it gets translated into AccessDenied.
  - 1891: [macOS] get rid of deprecated getpagesize().
- Rebase patch and skip three other tests that fail on obs
  * skip-obs.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Add patch to skip tests related to rlimit and zombie processes
  that fail when building for python2 on i586:
  * skip_rlimit_tests_on_python2.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1611921600">- Do not install tests (and change the way they're run since they
  were run from %{buildroot})</changelog>
  <changelog author="werner@suse.de" date="1655985600">- Add patch mem-used-bsc1181475.patch (bsc#1181475)
  * Adopt change of used memory calculation from upstream of procps</changelog>
</package>
<package pkgid="1867a56f65b166e68827822ae43175f15466a24fc695a0c97d67376516265adf" name="python3-psutil" arch="x86_64">
  <version epoch="0" ver="5.8.0" rel="150300.3.3.2"/>
  <changelog author="arun@gmx.de" date="1550318400">- update to version 5.5.1:
  * Enhancements
    + 1348: [Windows] on Windows &gt;= 8.1 if Process.cmdline() fails due
    to ERROR_ACCESS_DENIED attempt using NtQueryInformationProcess +
    ProcessCommandLineInformation. (patch by EccoTheFlintstone)
  * Bug fixes
    + 1394: [Windows] Process.exe() returns "[Error 0] The operation
    completed successfully" when Python process runs in "Virtual
    Secure Mode".
    + 1402: psutil exceptions' repr() show the internal private module
    path.
    + 1408: [AIX] psutil won't compile on AIX 7.1 due to missing
    header. (patch by Arnon Yaari)</changelog>
  <changelog author="arun@gmx.de" date="1552132800">- update to version 5.6.0:
  * Enhancements
    + 1379: [Windows] Process suspend() and resume() now use
    NtSuspendProcess and NtResumeProcess instead of
    stopping/resuming all threads of a process. This is faster and
    more reliable (aka this is what ProcessHacker does).
    + 1420: [Windows] in case of exception disk_usage() now also shows
    the path name.
    + 1422: [Windows] Windows APIs requiring to be dynamically loaded
    from DLL libraries are now loaded only once on startup (instead
    of on per function call) significantly speeding up different
    functions and methods.
    + 1426: [Windows] PAGESIZE and number of processors is now
    calculated on startup.
    + 1428: in case of error, the traceback message now shows the
    underlying C function called which failed.
    + 1433: new Process.parents() method. (idea by Ghislain Le Meur)
    + 1437: pids() are returned in sorted order.
    + 1442: python3 is now the default interpreter used by Makefile.
  * Bug fixes
    + 1353: process_iter() is now thread safe (it rarely raised
    TypeError).
    + 1394: [Windows] Process name() and exe() may erroneously return
    "Registry". QueryFullProcessImageNameW is now used instead of
    GetProcessImageFileNameW in order to prevent that.
    + 1411: [BSD] lack of Py_DECREF could cause segmentation fault on
    process instantiation.
    + 1419: [Windows] Process.environ() raises NotImplementedError
    when querying a 64-bit process in 32-bit-WoW mode. Now it raises
    AccessDenied.
    + 1427: [OSX] Process cmdline() and environ() may erroneously
    raise OSError on failed malloc().
    + 1429: [Windows] SE DEBUG was not properly set for current
    process. It is now, and it should result in less AccessDenied
    exceptions for low-pid processes.
    + 1432: [Windows] Process.memory_info_ex()'s USS memory is
    miscalculated because we're not using the actual system
    PAGESIZE.
    + 1439: [NetBSD] Process.connections() may return incomplete
    results if using oneshot().
    + 1447: original exception wasn't turned into NSP/AD exceptions
    when using Process.oneshot() ctx manager.
  * Incompatible API changes
    + 1291: [OSX] Process.memory_maps() was removed because inherently
    broken (segfault) for years.</changelog>
  <changelog author="jayvdb@gmail.com" date="1552910400">- Active test suite, using skip-test-missing-warnings.patch to
  explicitly skip 2 tests regarding warnings, skip-flaky-i586.patch
  to skip a flaky i586 test, and setting TRAVIS to skip tests which
  upstream doesnt run in their CI
- Add upstream pr_1364.patch to fix reading /sys/blocks on Linux 4.18+
- Remove tests from installed package
- Use URL https://github.com/giampaolo/psutil
- Use LANG=en_US.UTF-8 in %check to avoid failure in test_pmap
- update to version 5.6.1
  * No changes effecting Linux
  * Many checks added to tests to skip tests for missing features</changelog>
  <changelog author="tchvatal@suse.com" date="1558785600">- Update to 5.6.2:
  * 1404: [Linux] cpu_count(logical=False) uses a second method (read from /sys/devices/system/cpu/cpu[0-9]/topology/core_id) in order to determine the number of physical CPUs in case /proc/cpuinfo does not provide this info.
  * 1458: provide coloured test output. Also show failures on KeyboardInterrupt.
  * 1464: various docfixes (always point to python3 doc, fix links, etc.).
  * 1478: add make command to re-run tests failed on last run.
  * 1456: [Linux] cpu_freq() returns None instead of 0.0 when min/max not available (patch by Alex Manuskin)
  * 1462: [Linux] (tests) make tests invariant to LANG setting (patch by Benjamin Drung)
  * 1463: cpu_distribution.py script was broken.
  * 1470: [Linux] disk_partitions(): fix corner case when /etc/mtab doesn't exist. (patch by Cedric Lamoriniere)
  * 1472: [Linux] cpu_freq() does not return all CPUs on Rasbperry-pi 3.
  * 1493: [Linux] cpu_freq(): handle the case where /sys/devices/system/cpu/cpufreq/ exists but is empty.</changelog>
  <changelog author="tchvatal@suse.com" date="1563883200">- Update to 5.6.3:
  * 1494: [AIX] added support for Process.environ(). (patch by Arnon Yaari)
  * 1276: [AIX] can't get whole cmdline(). (patch by Arnon Yaari)
  * 1501_: [Windows] Process cmdline() and exe() raise unhandled "WinError 1168 element not found" exceptions for "Registry" and "Memory Compression" psuedo processes on Windows 10.
  * 1526_: [NetBSD] process cmdline() could raise MemoryError. (patch by Kamil Rytarowski)</changelog>
  <changelog author="tchvatal@suse.com" date="1568116800">- Add patch to skip more tests that won't work in OBS:
  * skip-obs.patch</changelog>
  <changelog author="arun@gmx.de" date="1573300800">- update to version 5.6.5:
  * Bug fixes
    + 1615: remove pyproject.toml as it was causing installation
    issues.
- changes from version 5.6.4:
  * Enhancements
    + 1527: [Linux] added Process.cpu_times().iowait counter, which is
    the time spent waiting for blocking I/O to complete.
    + 1565: add PEP 517/8 build backend and requirements specification
    for better pip integration. (patch by Bernát Gábor)
  * Bug fixes
    + 875: [Windows] Process' cmdline(), environ() or cwd() may
    occasionally fail with ERROR_PARTIAL_COPY which now gets
    translated to AccessDenied.
    + 1126: [Linux] cpu_affinity() segfaults on CentOS 5 /
    manylinux. cpu_affinity() support for CentOS 5 was removed.
    + 1528: [AIX] compilation error on AIX 7.2 due to 32 vs 64 bit
    differences. (patch by Arnon Yaari)
    + 1535: 'type' and 'family' fields returned by net_connections()
    are not always turned into enums.
    + 1536: [NetBSD] process cmdline() erroneously raise ZombieProcess
    error if cmdline has non encodable chars.
    + 1546: usage percent may be rounded to 0 on Python 2.
    + 1552: [Windows] getloadavg() math for calculating 5 and 15 mins
    values is incorrect.
    + 1568: [Linux] use CC compiler env var if defined.
    + 1570: [Windows] NtWow64* syscalls fail to raise the proper error
    code
    + 1585: [OSX] calling close() (in C) on possible negative
    integers. (patch by Athos Ribeiro)
    + 1606: [SunOS] compilation fails on SunOS 5.10. (patch by vser1)</changelog>
  <changelog author="arun@gmx.de" date="1574942400">- update to version 5.6.7:
  * Bug fixes
    + 1630: [Windows] can't compile source distribution due to C
    syntax error.
- changes from version 5.6.6:
  * Bug fixes
    + 1179: [Linux] Process cmdline() now takes into account
    misbehaving processes renaming the command line and using
    inappropriate chars to separate args.
    + 1616: use of Py_DECREF instead of Py_CLEAR will result in double
    free and segfault (CVE). (patch by Riccardo Schirone)
    + 1619: [OpenBSD] compilation fails due to C syntax error. (patch
    by Nathan Houghton)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Add pr_1665.patch: Future-proof disk_io_counters on Linux. Fixes
  tests with Linux 5.5.</changelog>
  <changelog author="tchvatal@suse.com" date="1584187200">- Update to 5.7.0:
  * Various fixes to build with updated kernel/etc.
- Remove merged patch pr_1665.patch and pr_1364.patch
- Update patch skip-obs.patch
- Remove skip-test-missing-warnings.patch as it can be fixed by
  properly calling the tests</changelog>
  <changelog author="mcepl@suse.com" date="1598011200">- Add skip_failing_tests.patch to skip tests failing because of
  incomplete emulation of the environment in osc build
  environment (gh#giampaolo/psutil#1635).</changelog>
  <changelog author="dmueller@suse.com" date="1600257600">- update to 5.7.2:
  * parallel tests on UNIX (make test-parallel). They're twice as fast!
  * 1741: "make build/install" is now run in parallel and it's about 15% faster on UNIX.
  * 1747: Process.wait() on POSIX returns an enum, showing the negative signal which was used to terminate the process
  * 1747: Process.wait() return value is cached so that the exit code can be retrieved on then next call.
  * 1747: Process provides more info about the process on str() and repr() (status and exit code):
  * 1757: memory leak tests are now stable.
  * 1768: [Windows] added support for Windows Nano Server. (contributed by Julien Lebot)
  * 1726: [Linux] cpu_freq() parsing should use spaces instead of tabs on ia64. (patch by Micha? Górny)
  * 1760: [Linux] Process.rlimit() does not handle long long type properly.
  * 1766: [macOS] NoSuchProcess may be raised instead of ZombieProcess.
  * 1781: fix signature of callback function for getloadavg(). (patch by Ammar Askar)
  - remove skip-flaky-i586.patch (obsolete)</changelog>
  <changelog author="code@bnavigator.de" date="1604404800">- Fix shebang replacement for multiple python flavors</changelog>
  <changelog author="dmueller@suse.com" date="1606824000">- update to 5.7.3:
  - 809_: [FreeBSD] add support for `Process.rlimit()`.
  - 893_: [BSD] add support for `Process.environ()` (patch by Armin Gruner)
  - 1830_: [UNIX] `net_if_stats()`'s `isup` also checks whether the NIC is
    running (meaning Wi-Fi or ethernet cable is connected).
  - 1837_: [Linux] improved battery detection and charge "secsleft" calculation
  - 1620_: [Linux] physical cpu_count() result is incorrect on systems with more
    than one CPU socket.
  - 1738_: [macOS] Process.exe() may raise FileNotFoundError if process is still
    alive but the exe file which launched it got deleted.
  - 1791_: [macOS] fix missing include for getpagesize().
  - 1823_: [Windows] Process.open_files() may cause a segfault due to a NULL
    pointer.
  - 1838_: [Linux] sensors_battery(): if `percent` can be determined but not
    the remaining values, still return a result instead of None.
- skip-obs.patch, skip_failing_tests.patch: rediff</changelog>
  <changelog author="asn@cryptomilk.org" date="1607688000">- Add missing BR for unittest2</changelog>
  <changelog author="code@bnavigator.de" date="1607688001">- Only require unittest2 for Leap.</changelog>
  <changelog author="alarrosa@suse.com" date="1611576000">- update to 5.8.0:
  * Enhancements:
  - 1863: disk_partitions() exposes 2 extra fields: maxfile and
    maxpath, which are the maximum file name and path name
    length.
  - 1872: [Windows] added support for PyPy 2.7.
  - 1879: provide pre-compiled wheels for Linux and macOS.
  - 1880: get rid of Travis and Cirrus CI services (they are no
    longer free). CI testing is now done by GitHub Actions on
    Linux, macOS and FreeBSD (yes). AppVeyor is still being used
    for Windows CI.
  * Bug fixes:
  - 1708: [Linux] get rid of sensors_temperatures() duplicates.
    (patch by Tim Schlueter).
  - 1839: [Windows] always raise AccessDenied when failing to
    query 64 processes from 32 bit ones (NtWoW64 APIs).
  - 1866: [Windows] process exe(), cmdline(), environ() may raise
    "invalid access to memory location" on Python 3.9.
  - 1874: [Solaris] wrong swap output given when encrypted column
    is present.
  - 1875: [Windows] process username() may raise
    ERROR_NONE_MAPPED if the SID has no corresponding account
    name. In this case AccessDenied is now raised.
  - 1877: [Windows] OpenProcess may fail with ERROR_SUCCESS.
    Turn it into AccessDenied or NoSuchProcess depending on
    whether the PID is alive.
  - 1886: [macOS] EIO error may be raised on cmdline() and
    environment(). Now it gets translated into AccessDenied.
  - 1891: [macOS] get rid of deprecated getpagesize().
- Rebase patch and skip three other tests that fail on obs
  * skip-obs.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Add patch to skip tests related to rlimit and zombie processes
  that fail when building for python2 on i586:
  * skip_rlimit_tests_on_python2.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1611921600">- Do not install tests (and change the way they're run since they
  were run from %{buildroot})</changelog>
  <changelog author="werner@suse.de" date="1655985600">- Add patch mem-used-bsc1181475.patch (bsc#1181475)
  * Adopt change of used memory calculation from upstream of procps</changelog>
</package>
<package pkgid="04a83d6f3b02a11872bb528c79ccfe7f6ed60eba0629026b87bc913655ee7f31" name="python3-py" arch="noarch">
  <version epoch="0" ver="1.10.0" rel="150100.5.12.1"/>
  <changelog author="jmatejek@suse.com" date="1475668800">- update for singlespec</changelog>
  <changelog author="jmatejek@suse.com" date="1487851200">- update to 1.4.32
  - fix issue70: added ability to copy all stat info in py.path.local.copy.
  - make TerminalWriter.fullwidth a property.  This results in the correct
    value when the terminal gets resized.
  - update supported html tags to include recent additions.
    Thanks Denis Afonso for the PR.
  - Remove internal code in ``Source.compile`` meant to support earlier Python 3 versions that produced the side effect
    of leaving ``None`` in ``sys.modules`` when called (see pytest-dev/pytest#2103).
    Thanks Bruno Oliveira for the PR.</changelog>
  <changelog author="aloisio@gmx.com" date="1498824000">- Update to 1.4.34
  * fix issue119 / pytest issue708 where tmpdir may fail to make
    numbered directories when the filesystem is case-insensitive.
  1.4.33:
  * avoid imports in calls to py.path.local().fnmatch(). Thanks
    Andreas Pelme for the PR.
  * fix issue106: Naive unicode encoding when calling fspath() in
    python2. Thanks Tiago Nobrega for the PR.
  * fix issue110: unittest.TestCase.assertWarns fails with py
    imported.</changelog>
  <changelog author="arun@gmx.de" date="1510747200">- update to version 1.5.0:
  * python 2.6 and 3.3 are no longer supported
  * deprecate py.std and remove all internal uses
  * fix #73 turn py.error into an actual module
  * path join to / no longer produces leading double slashes
  * fix #82 - remove unsupportable aliases
  * fix python37 compatibility of path.sysfind on windows by correctly
    replacing vars
  * turn iniconfig and apipkg into vendored packages and ease
    de-vendoring for distributions
  * fix #68 remove invalid py.test.ensuretemp references
  * fix #25 - deprecate path.listdir(sort=callable)
  * add TerminalWriter.chars_on_current_line read-only property that
    tracks how many characters have been written to the current line.</changelog>
  <changelog author="arun@gmx.de" date="1511092800">- specfile:
  * updated url
- update to version 1.5.2:
  * fix #169, #170: error importing py.log on Windows: no module named
    "syslog".
- changes from version 1.5.1:
  * fix #167 - prevent pip from installing py in unsupported Python
    versions.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1527768000">- update to version 1.5.3
  * - fix #179: ensure we can support 'from py.error import ...'</changelog>
  <changelog author="mimi.vx@gmail.com" date="1533211200">- update to 1.5.4
  * don't make assumptions about fs case sensitivity in ``make_numbered_dir``.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1540555200">- update to 1.7.0
  * use ``shutil.get_terminal_size()`` in Python 3.3+ to determine the size of the
  terminal, which produces more accurate results than the previous method.
  * introduce new ``PY_IGNORE_IMPORTMISMATCH`` environment variable
  that suppresses ``ImportMismatchError`` exceptions when set to ``1``.
  * add ``TerminalWriter.width_of_current_line`` (i18n version of
  ``TerminalWriter.chars_on_current_line``), a read-only property
  that tracks how wide the current line is, attempting to take
  into account international characters in the calculation.</changelog>
  <changelog author="tchvatal@suse.com" date="1549972800">- Drop the doc subpackage, no need for it really
- Make sure the tests are realy executed</changelog>
  <changelog author="tchvatal@suse.com" date="1550232000">- Make tests really pass on pytest 3.x series
- Add patch to operate better with serparators (from upstream git):
  * separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1550232001">- Make tests never fail as they are borked on pytest-4 with
  most probably no intention of being ever fixed</changelog>
  <changelog author="tchvatal@suse.com" date="1551268800">- Update to 1.8.0:
  * add ``"importlib"`` pyimport mode for python3.5+, allowing unimportable test suites
    to contain identically named modules.
  * fix ``LocalPath.as_cwd()`` not calling ``os.chdir()`` with ``None``, when
    being invoked from a non-existing directory.
- Drop merged patch separators.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1560945600">- Switch to multibuild to avoid cycle bsc#1138666</changelog>
  <changelog author="tchvatal@suse.com" date="1578312000">- Update to 1.8.1:
  - Handle ``FileNotFoundError`` when trying to import pathlib in
    ``path.common`` on Python 3.4 (#207).
  - ``py.path.local.samefile`` now works correctly in Python 3 on
    Windows when dealing with symlinks.</changelog>
  <changelog author="mcalabkova@suse.com" date="1593432000">- Update to 1.9.0
  * Add type annotation stubs</changelog>
  <changelog author="jayvdb@gmail.com" date="1602936000">- Devendor apipkg and iniconfig
- Add pr_222.patch to activate test suite</changelog>
  <changelog author="code@bnavigator.de" date="1613736000">- Update to 1.10.0
  * Fix a regular expression DoS vulnerability in the py.path.svnwc
    SVN blame functionality (CVE-2020-29651)</changelog>
  <changelog author="mmachova@suse.com" date="1620043200">- CVE-2020-29651.patch (bsc#1179805, CVE-2020-29651, bsc#1184505)
  * python-py: regular expression denial of service in svnwc.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1647259200">- Update in SLE-15 (bsc#1195916, bsc#1196696, jsc#PM-3356, jsc#SLE-23972)
- Drop CVE-2020-29651.patch, issue fixed upstream in 1.10.0</changelog>
  <changelog author="steven.kowalik@suse.com" date="1673956800">- Remove all traces of py._path.svn{url,wc}. (bsc#1204364, CVE-2022-42969)
- Add patch remove-svn-remants.patch to help with that goal.
- Refresh pr_222.patch as needed for above.</changelog>
</package>
<package pkgid="a3dd49010207d1f2655ac6329c0cbb34b25350dbbe64edcb8143345c57cfc4be" name="python3-rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="e707d51a8c72556e8fe2fa5154cc9d325683113607cef5c98344bafa35166c85" name="python3-rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="55864a15666b6e81fa54ecb39fb6cf7f5e650b7f17eef33d9d4b6dc04bdc9608" name="python3-rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="c58e2e6a7c527927fb153a50a6ee071199a01d93dd7fdf32c636f8e3294d7e98" name="python3-rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="34fe2bcd2dcb868afd91b7f725f323dc2f020cb62c28441c0ea29d2a5d29be7d" name="python3-rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="80253b50bb4a25c8e2ce019f722d61fac14c7cff409b8cf9e9ef16ab3a5d0899" name="python3-rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1373630400">- update to rpm-4.11.1</changelog>
  <changelog author="mls@suse.de" date="1384948800">- adapt to python-3.3, which no longer looks at XXXmodule.so</changelog>
  <changelog author="ngompa13@gmail.com" date="1508068800">- Unify rpm-python and python3-rpm into singlespec
- Switch the build to use setuptools-based build, so that
  the Python module is properly built with all its metadata</changelog>
  <changelog author="ngompa13@gmail.com" date="1508155200">- Properly quote the conditional for Obsoletes+Provides</changelog>
  <changelog author="ngompa13@gmail.com" date="1509192000">- Add a comment to note that prep and build stages come from rpm.spec</changelog>
  <changelog author="jengelh@inai.de" date="1513684800">- Update RPM groups</changelog>
  <changelog author="mls@suse.de" date="1517400000">- update to rpm-4.14.1</changelog>
  <changelog author="tchvatal@suse.com" date="1521547200">- Switch really to singlespec thus allowing us to build without
  python2-devel present in the distribution</changelog>
  <changelog author="mls@suse.de" date="1523016000">- remove rpmlint-Factory buildignore</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="3ce341c4979085744973c3944628e91c549168bc952e8c97a8ef25862310fec1" name="python3-rsa" arch="noarch">
  <version epoch="0" ver="3.4.2" rel="150000.3.7.1"/>
  <changelog author="p.drouand@gmail.com" date="1381492800">- Update to version 3.1.2
  + No changelog available
- Replace python-distribute with python-setuptools BuildRequires
- Remove rsa-use-system-setuptools.patch; merged upstream
- Implement update-alternatives</changelog>
  <changelog author="ledest@gmail.com" date="1415448000">- fix bashisms in pre script</changelog>
  <changelog author="benoit.monin@gmx.fr" date="1431432000">- update to version 3.1.4:
  * no changelog available
- add test dependency python-unittest2
- fix update-alternatives
- run the tests with run_tests.py
- add README.rst to the package documentation</changelog>
  <changelog author="rjschwei@suse.com" date="1443009600">- require coreutils (bsc#935595)
  + %pre section uses rm which is part of coreutils package</changelog>
  <changelog author="p.drouand@gmail.com" date="1448020800">- Fix coreutils requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1448971200">- Include version 3.1.4 in SLE 12 (FATE#319904, bsc#954690)</changelog>
  <changelog author="rjschwei@suse.com" date="1451995200">- Fix CVE 2016-1494 (bsc#960680)
  - Add patch cve_2016-1494.diff</changelog>
  <changelog author="toddrme2178@gmail.com" date="1493640000">- Update to Version 3.4.2
  * Fixed dates in CHANGELOG.txt
- Update to Version 3.4.1
  * Included tests/private.pem in MANIFEST.in
  * Included README.md and CHANGELOG.txt in MANIFEST.in
- Update to Version 3.4
  * Moved development to Github: https://github.com/sybrenstuvel/python-rsa
  * Solved side-channel vulnerability by implementing blinding, fixes #19
  * Deprecated the VARBLOCK format and rsa.bigfile module due to security issues, see
    https://github.com/sybrenstuvel/python-rsa/issues/13
  * Integration with Travis-CI, Coveralls and Code Climate
  * Deprecated the old rsa._version133 and rsa._version200 submodules, they will be
    completely removed in version 4.0.
  * Add an 'exponent' argument to key.newkeys()
  * Switched from Solovay-Strassen to Miller-Rabin primality testing, to
    comply with NIST FIPS 186-4 as probabilistic primality test
    (Appendix C, subsection C.3):
  * Fixed bugs #12, #14, #27, #30, #49
- Update to Version 3.3
  * Thanks to Filippo Valsorda: Fix BB'06 attack in verify() by
    switching from parsing to comparison.
  * Simplified Tox configuration and dropped Python 3.2 support. The
    coverage package uses a u'' prefix, which was reintroduced in 3.3
    for ease of porting.
- Update to Version 3.2.3
  * Added character encoding markers for Python 2.x
- Update to Version 3.2.1
  * Added per-file licenses
  * Added support for wheel packages
  * Made example code more consistent and up to date with Python 3.4
- Update to Version 3.2
  * Mentioned support for Python 3 in setup.py
- Implement single-spec version.
- Fix source URL.
- Remove cve_2016-1494.diff, fixed in latest version.</changelog>
  <changelog author="rjschwei@suse.com" date="1623412800">- Add cve_2020-13757.patch (CVE-2020-13757 bsc#1172389)
  + Handle leading '\0' bytes during decryption of ciphertext</changelog>
  <changelog author="rjschwei@suse.com" date="1666008000">- Add cve_2020-25658.patch (CVE-2020-25658 bsc#1178676)
  + Reduce timing sensitivity on devryption for false ciphers</changelog>
</package>
<package pkgid="5e8a78e42590f82fb9bf429aa129739468015b43f770303f5f813e7bc330e13f" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="57a554fa571e51ddc48c08b48d6ec8d799d15d3a2097b908f959fbee24e2f5a0" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="eb6e0dd0f78fb945c9c8ae59000cc44b1f980d4ca703a13ab6bc2ac685c26b42" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="ab567c9493cc42f2bf38aad506009a31e93c4d9910cd91c5ca6c8bcfb0935b34" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="572e9cc099273d4b4dc2d9a2306294736b0afe0dde7f8c7a0bc50f81e340286e" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="53bd1515696352ad63eaeac92a99d887cb2f61874a3ffdfbb8f212cab0accccb" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="396389132863d0feedf67e283e167476cc8541d41c0fd8f2fbc4d812dc9481b4" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="d71e679a583fea259730c7d00459772e8d218f7ae0c81ab626d75e2e73898c5a" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="c562d9badf3322146dded6c7dba26b93a5bbdaef773b229706765fe4a661866f" name="python3-salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="6994e111857edcebf08b04235e0a12c25009b23fedc5d8eb3968f9d0d20f87c0" name="python3-salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="82bb8d5a1160d5589e18f4b2911206875797f6758ca99ce749bb0ff330cd48e4" name="python3-setuptools" arch="noarch">
  <version epoch="0" ver="40.5.0" rel="150100.6.6.1"/>
  <changelog author="arun@gmx.de" date="1514721600">- update to version 38.2.5:
  * #1232: Fix trailing slash handling in pkg_resources.ZipProvider.</changelog>
  <changelog author="arun@gmx.de" date="1515240000">- specfile:
  * update copyright year
- update to version 38.4.0:
  * #1231: Removed warning when PYTHONDONTWRITEBYTECODE is enabled.
- changes from version 38.3.0:
  * #1210: Add support for PEP 345 Project-URL metadata.
  * #1207: Add support for long_description_type to setup.cfg
    declarative config as intended and documented.</changelog>
  <changelog author="arun@gmx.de" date="1517745600">- update to version 38.4.1:
  * #1257: In bdist_egg.scan_module, fix ValueError on Python 3.7.</changelog>
  <changelog author="arun@gmx.de" date="1517918400">- update to version 38.5.1:
  * #1271: Revert to Cython legacy build_ext behavior for
    compatibility.
- changes from version 38.5.0:
  * #1229: Expand imports in build_ext to refine detection of Cython
    availability.
  * #1270: When Cython is available, build_ext now uses the
    new_build_ext.</changelog>
  <changelog author="aplanas@suse.com" date="1519732800">- Recommends only for SUSE</changelog>
  <changelog author="aplanas@suse.com" date="1520424000">- Allows Recommends and Suggest in Fedora</changelog>
  <changelog author="arun@gmx.de" date="1520510400">- update to version 38.5.2:
  * #1285: Fixed RuntimeError in pkg_resources.parse_requirements on
    Python 3.7 (stemming from PEP 479).</changelog>
  <changelog author="arun@gmx.de" date="1521288000">- update to version 38.6.0:
  * #1286: Add support for Metadata 2.1 (PEP 566).</changelog>
  <changelog author="arun@gmx.de" date="1521288001">- update to version 39.0.0:
  * #1296: Setuptools now vendors its own direct dependencies, no
    longer relying on the dependencies as vendored by pkg_resources.
  * #296: Removed long-deprecated support for iteration on Version
    objects as returned by pkg_resources.parse_version. Removed the
    SetuptoolsVersion and SetuptoolsLegacyVersion names as well. They
    should not have been used, but if they were, replace with Version
    and LegacyVersion from packaging.version.
- changes from version 38.7.0:
  * #1288: Add support for maintainer in PKG-INFO.
- changes from version 38.6.1:
  * #1292: Avoid generating Provides-Extra in metadata when no extra
    is present (but environment markers are).</changelog>
  <changelog author="tchvatal@suse.com" date="1521460800">- Version update to 39.0.1:
  * Fix utf parsing with python2
  * Various other fixes</changelog>
  <changelog author="arun@gmx.de" date="1525608000">- update to version 39.1.0:
  * #1340: Update all PyPI URLs to reflect the switch to the new
    Warehouse codebase.
  * #1337: In pkg_resources, now support loading resources for modules
    loaded by the SourcelessFileLoader.
  * #1332: Silence spurious wheel related warnings on Windows.</changelog>
  <changelog author="arun@gmx.de" date="1526904000">- update to version 39.2.0:
  * #1359: Support using "file:" to load a PEP 440-compliant package
    version from a text file.
  * #1360: Fixed issue with a mismatch between the name of the package
    and the name of the .dist-info file in wheel files
  * #1364: Add __dir__() implementation to
    pkg_resources.Distribution() that includes the attributes in the
    _provider instance variable.
  * #1365: Take the package_dir option into account when loading the
    version from a module attribute.
  * #1353: Added coverage badge to README.
  * #1356: Made small fixes to the developer guide documentation.
  * #1357: Fixed warnings in documentation builds and started
    enforcing that the docs build without warnings in tox.
  * #1376: Updated release process docs.
  * #1343: The setuptools specific long_description_content_type,
    project_urls and provides_extras fields are now set consistently
    after any distutils setup_keywords calls, allowing them to
    override values.
  * #1352: Added tox environment for documentation builds.
  * #1354: Added towncrier for changelog managment.
  * #1355: Add PR template.
  * #1368: Fixed tests which failed without network connectivity.
  * #1369: Added unit tests for PEP 425 compatibility tags support.
  * #1372: Stop testing Python 3.3 in Travis CI, now that the latest
    version of wheel no longer installs on it.</changelog>
  <changelog author="arun@gmx.de" date="1531396800">- update to version 40.0.0:
  * #1342: Drop support for Python 3.3.
  * #1366: In package_index, fixed handling of encoded entities in
    URLs.
  * #1383: In pkg_resources VendorImporter, avoid removing packages
    imported from the root.
  * #1379: Minor doc fixes after actually using the new release
    process.
  * #1385: Removed section on non-package data files.
  * #1403: Fix developer's guide.
  * #1404: Fix PEP 518 configuration: set build requirements in
    pyproject.toml to ["wheel"].</changelog>
  <changelog author="arun@gmx.de" date="1534593600">- specfile:
  * removed devel for noarch package
- update to version 40.1.0:
  * #1410: Deprecated upload and register commands.
  * #1312: Introduced find_namespace_packages() to find PEP 420
    namespace packages.
  * #1420: Added find_namespace: directive to config parser.
  * #1418: Solved race in when creating egg cache directories.
  * #1450: Upgraded vendored PyParsing from 2.1.10 to 2.2.0.
  * #1451: Upgraded vendored appdirs from 1.4.0 to 1.4.3.
  * #1388: Fixed "Microsoft Visual C++ Build Tools" link in exception
    when Visual C++ not found.
  * #1389: Added support for scripts which have unicode content.
  * #1416: Moved several Python version checks over to using six.PY2
    and six.PY3.
  * #1441: Removed spurious executable permissions from files that
    don't need them.</changelog>
  <changelog author="jengelh@inai.de" date="1535198400">- Use noun phrase in summary.</changelog>
  <changelog author="arun@gmx.de" date="1535803200">- update to version 40.2.0:
  * #1466: Fix handling of Unicode arguments in PEP 517 backend
- changes from version 40.1.1:
  * #1465: Fix regression with egg_info command when tagging is used.</changelog>
  <changelog author="arun@gmx.de" date="1538308800">- update to version 40.4.3:
  * #1480: Bump vendored pyparsing in pkg_resources to 2.2.1.
- changes from version 40.4.2:
  * #1497: Updated gitignore in repo.
- changes from version 40.4.1:
  * #1480: Bump vendored pyparsing to 2.2.1.
- changes from version 40.4.0:
  * #1481: Join the sdist --dist-dir and the build_meta sdist
    directory argument to point to the same target (meaning the build
    frontend no longer needs to clean manually the dist dir to avoid
    multiple sdist presence, and setuptools no longer needs to handle
    conflicts between the two).
- changes from version 40.3.0:
  * #1402: Fixed a bug with namespace packages under Python 3.6 when
    one package in current directory hides another which is
    installed.
  * #1427: Set timestamp of .egg-info directory whenever egg_info
    command is run.
  * #1474: build_meta.get_requires_for_build_sdist now does not
    include the wheel package anymore.
  * #1486: Suppress warnings in pkg_resources.handle_ns.
  * #1479: Remove internal use of six.binary_type.</changelog>
  <changelog author="arun@gmx.de" date="1540900800">- update to version 40.5.0:
  * #1335: In pkg_resources.normalize_path, fix issue on Cygwin when
    cwd contains symlinks.
  * #1502: Deprecated support for downloads from Subversion in
    package_index/easy_install.
  * #1517: Dropped use of six.u in favor of u"" literals.
  * #1520: Added support for data_files in setup.cfg.
  * #1525: Fixed rendering of the deprecation warning in easy_install
    doc.</changelog>
  <changelog author="mcepl@suse.com" date="1605355200">- Add wheel subpackage with the generated wheel for this package
  (bsc#1176262, CVE-2019-20916).</changelog>
  <changelog author="daniel.garcia@suse.com" date="1673265600">- Add CVE-2022-40897-ReDos.patch to fix Regular Expression Denial of Service
  (ReDoS) in package_index.py.
  bsc#1206667</changelog>
</package>
<package pkgid="1c6ebd0be2fa71df5d26fea24ba655c636fc3983591319fca386267ce1d9405a" name="qemu" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="05436b4766614a0e8b3d9f82f1de010adf9092ae171ecc0ed49cbfa4e420a11a" name="qemu" arch="src">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="c6b14ca73f488d6dd6228a2d288310d718fe6d536e01202a10204f02a1750ef9" name="qemu" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="8cfbed0418619696a87acdd47c2762e8e93a0e3202793177154169bae545e8dd" name="qemu-arm" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="ff58b45c682c2664d92a75421e9385dd67e8176f613cfc49a5e1ac4b8e47cc73" name="qemu-audio-spice" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="8fa434dd393def9ef0d8118056a0a5f62f617bc6e0e88b20d98535eee1aae948" name="qemu-audio-spice" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="d5274aecb50d0b1f6dce3bb6b6bd4740c15f5107361a76c662aaeb796d4b5f0e" name="qemu-chardev-spice" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="a70d1b9b8e144ae1ca5f3959fa7b871778b5ff0b8f785bec0e03011b0218bb32" name="qemu-chardev-spice" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="9dba484cd0e8f05f190a8b7b6a18bf5ede670b9c7eb27df022457a2f5fb551c5" name="qemu-guest-agent" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="c60646313b8d93eadeb2b68c028d7edbaa32f084b82f2a07c3e3ee3e68523bb5" name="qemu-guest-agent" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="887d22518ef7831509914c2d479c0642e5b6f1c53b0391701b8403ee0864a63d" name="qemu-hw-display-qxl" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="74ae91aaa1835f44d76de568619c8ba31d552ed8d60e1531de752e18d194eadc" name="qemu-hw-display-qxl" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="7c20282af9047e4de7ee7c8a1f2ce419fe478dee4ab878e6e937eaac82258de6" name="qemu-hw-display-virtio-gpu" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="01e727be96d1a6f8768766d09ae9e68bbc710dd7d0e81ae319edcd16dd7e6b8b" name="qemu-hw-display-virtio-gpu" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="c5fad316a6079440ba0e602a2b3948b64d70aab44a720d55f396eea21dd63758" name="qemu-hw-display-virtio-vga" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="5d587be733503235032b09ba3dc3e939d7df756f0097e96b09627dba56a9ee47" name="qemu-hw-display-virtio-vga" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="b4017b44bff70d2fb42456ee1bdc362151f2ef770492a0cfbd7f41922bb5ff82" name="qemu-hw-usb-redirect" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="422530def4a52606e4a446b10ff27a5e4a40a678aa8cec9b70b37af09b66eef2" name="qemu-hw-usb-redirect" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="c4dd392bd139444af5b8525c76dd0b8a6e246c0998a0da1f0dc35c1cb2464ccb" name="qemu-ipxe" arch="noarch">
  <version epoch="0" ver="1.0.0+" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="4eb5d0c7c0dfb849e737099b14d04432f11f0828d1524af43d5cf4debb2a0143" name="qemu-ovmf-x86_64" arch="noarch">
  <version epoch="0" ver="202008" rel="150300.10.17.1"/>
  <changelog author="glin@suse.com" date="1580731200">- Build the unified firmware with preloaded keys for backward
  compatibility (bsc#1159793)</changelog>
  <changelog author="glin@suse.com" date="1582027200">- Add ovmf-bsc1163959-PiDxeS3BootScriptLib-fix-numeric-truncation.patch
  to fix the numeric truncation to avoid the potential memory
  corruption (bsc#1163959, CVE-2019-14563)</changelog>
  <changelog author="glin@suse.com" date="1582545600">- Add ovmf-bsc1163969-fix-DxeImageVerificationHandler.patch to fix
  dbx signature check (bsc#1163969, CVE-2019-14575)
  + Also change the order of several patches to distinguish the
    openssl patch
- Add ovmf-bsc1163927-fix-ip4dxe-and-arpdxe.patch to fix memory
  leakage in Ip4Dxe and ArpDxe (bsc#1163927, CVE-2019-14559)</changelog>
  <changelog author="glin@suse.com" date="1586174400">- Add ovmf-bsc1163927-fix-ping-and-ip6dxe.patch to fix crash and
  hang in ShellPkg and Ip6Dxe (bsc#1163927, CVE-2019-14559)</changelog>
  <changelog author="glin@suse.com" date="1595246400">- Add ovmf-bsc1119454-additional-scsi-drivers.patch to support more
  SCSI drivers (PvScsi, MptScsi, and LsiScsi) (bsc#1119454)
  + Enable LsiScsi explicitly since it's disabled by default</changelog>
  <changelog author="glin@suse.com" date="1599134400">- Add ovmf-bsc1175476-fix-DxeImageVerificationLib-overflow.patch
  to fix overflow in DxeImageVerificationHandler
  (bsc#1175476, CVE-2019-14562)</changelog>
  <changelog author="glin@suse.com" date="1599652800">- Update to edk2-stable202008
  + MdeModulePkg/Library: add PEIM and SEC module type to
    TpmMeasurementLibNull
  + SecurityPkg/DxeImageVerificationLib: catch alignment overflow
    (CVE-2019-14562) (bsc#1175476)
  + OvmfPkg/CpuHotplugSmm: fix CPU hotplug race before and after
    SMI broadcast
  + SecurityPkg/Tcg2: handle PRE HASH and LOG ONLY
  + MdePkg/Include: Add missing definition of SMBIOS type 42h in
    SmBios.h
  + MdePkg: UefiFileHandleLib: fix buffer overrun in
    FileHandleReadLine()
  + OvmfPkg: Add SEV-ES support (jsc#SLE-16075)
  + MdeModulePkg/PartitionDxe: Fix the incorrect LBA size in child
    hander
  + MdeModulePkg/PartitionDxe: Revert changes for the special MBR
  + MdeModulePkg/PartitionDxe: Put the UDF check ahead of MBR
  + ShellPkg: smbiosview - Change some type 17 field values format
  + CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g
  + MdeModulePkg: Upon BootOption failure, Destroy RamDisk memory
    before RSC.
  + OvmfPkg/LsiScsiDxe: Add support for LSI 53C895A
  + MdeModulePkg/DisplayEngine: Add Debug message to show mismatch
    menu info
  + Add New Memory Attributes
  + MdeModulePkg/PartitionDxe: Add already start check for child
    hanldes
  + MdeModulePkg/PartitionDxe: Skip the MBR that add for CD-ROM
  + MdeModulePkg/PartitionDxe: Correct the MBR last block value
  + MdeModulePkg/Variable/RuntimeDxe: Fix return status from
    Reclaim()
  + SecurityPkg/Tcg2Pei: Add missing PCRIndex in FvBlob event.
  + SecurityPkg/Tcg2Dxe: Add PcdTcgPfpMeasurementRevision in
    SpecId event.
  + CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated
    SHA1 and MD5
  + ArmVirtPkg/NorFlashQemuLib: disable NOR flash DT nodes upon
    discovery
  + UefiCpuPkg/SecCore: Add pre-memory AP vector
  + OvmfPkg: End timer interrupt later to avoid stack overflow
    under load
  + ArmPkg/PlatformBootManagerLib: regenerate boot options on
    boot failure
  + MdeModulePkg/StatusCodeHandler: do not output \n\r for string
    data
  + Revert "OvmfPkg: use generic QEMU image loader for secure boot
    enabled ..."
  + ArmVirtPkg/PrePi: use standard PeCoff routines for
    self-relocation
  + ArmVirtPkg: add FDF rule for self-relocating PrePi
  + ArmPkg/ArmExceptionLib: use static buffer for sp_el0
  + MdeModulePkg/SetupBrowserDxe: Do not reconnect driver with
    form-update
  + OvmfPkg/X86QemuLoadImageLib: handle EFI_ACCESS_DENIED from
    LoadImage()
  + OvmfPkg/Tcg2ConfigPei: generalize TPM2-only file-top comments
  + ArmPkg: only attempt buildin MmCommunicationDxe for AArch64
  + ArmPkg/PlatformBootManagerLib: don't connect all devices on
    each boot
  + ArmPkg/PlatformBootManagerLib: hide UEFI Shell as a regular
    boot option
  + MdeModulePkg/BootManagerUiLib: show inactive boot options
  + ArmPkg/PlatformBootManagerLib: fall back to the UiApp on
    boot failure
  + ArmPkg/PlatformBootManagerLib: register 's' as UEFI Shell
    hotkey
  + ArmPkg/PlatformBootManagerLib: connect non-discoverable USB
    hosts
  + ArmPkg/ArmSvcLib: prevent speculative execution beyond svc
  + ArmPkg/PlatformBootManagerLib: reject 'default' parity and
    stop bit count
  + ArmPkg/PlatformBootManagerLib: use static assertion for
    console type
  + RegularExpressionDxe: Use submodule way to access third party
    Oniguruma
  + BrotliCustomDecompressLib: Use submodule way to access third
    party brotli
  + BaseTools: Use submodule way to access third party brotli
  + RISC-V architecture on EDK2
  + Disabling safe string constraint assertions
  + ArmVirtPkg Implement support for TPM2 measured boot
  + OVMF Implement support for Linux v5.7+ initrd and mixed mode
    loading
  + OVMF Use loadimage/startimage for loading the kernel passed
    via the QEMU command line
  + OVMF Support booting from Fusion-MPT SCSI controllers
  + OVMF Support booting from VMware PVSCSI controllers
  + OVMF RFE: VCPU hotplug with SMM
  + OVMF PEI phase variable driver / MemoryTypeInfo tracking
  + ArmVirtPkg, OvmfPkg: Pass parameter from QEMU to control PXE
    IPv4/v6 boot
  + Remove deprecate APIs in BaseCryptLib
  + Add UEFI 2.8/2.8a definition in MdePkg
  + Add PI1.7/PI1.7a definition into MdePkg
  + BaseCryptoLib MD4, ARC4, TDES, AES ECB MODE, HMAC MD5, HMAC
    SHA1 API have been deprecated.
  + SecurityPkg Tcg2PhysicalPresenceLib library class removes two
    macros TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and
    TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT.
- Update openssl to 1.1.1g
- Add 2 reduced source tarballs from the submodules of edk2:
  + brotli-v1.0.7-17-g666c328-c.tar.xz
  - We only need the "c" directory, not the whole tarball.
  + oniguruma-v6.9.4_mark1-src.tar.xz
  - We only need the "src" directory, not the whole tarball.
- Build all non-native firmware files on x86_64 and aarch64 with
  cross-compilers (bsc#1159134)
  + Exclude i586 and armv7hl due to the availability of
    cross-compilers
  + Move some bash functions to ovmf-build-funcs.sh
- Clean up PKG_TO_REMOVE
  + Only EmulatorPkg still exists.
- Add ovmf-build-funcs.sh for building the variable templates
- Drop upstreamed patches
  + ovmf-bsc1163927-fix-ip4dxe-and-arpdxe.patch
  + ovmf-bsc1175476-fix-DxeImageVerificationLib-overflow.patch
  + ovmf-bsc1119454-additional-scsi-drivers.patch
  + ovmf-bsc1163927-fix-ping-and-ip6dxe.patch
  + ovmf-bsc1163969-fix-DxeImageVerificationHandler.patch
  + ovmf-bsc1163959-PiDxeS3BootScriptLib-fix-numeric-truncation.patch
  + openssl-fix-syntax-error.patch
- Refresh patches
  + ovmf-disable-ia32-firmware-piepic.patch
  + ovmf-gdb-symbols.patch
  + ovmf-pie.patch</changelog>
  <changelog author="glin@suse.com" date="1604059200">- Add _constraints to request at least 6GB disk (bsc#1178244)
- Remove the build files after finishing the build to reduce the
  disk usage (bsc#1178244)</changelog>
  <changelog author="glin@suse.com" date="1604577600">- Update the json descriptors to address all x86_64 firmware files
  (jsc#SLE-15915)
- Remove the executable bit from brotli source code files</changelog>
  <changelog author="glin@suse.com" date="1605614400">- Add ovmf-jscSLE-16075-SEV-ES-fixes.patch to merge upstream SEV-ES
  fixes (jsc#SLE-16075)</changelog>
  <changelog author="glin@suse.com" date="1606910400">- Add ovmf-bsc1177789-cryptopkg-fix-null-dereference.patch to fix
  the potential NULL dereference in AuthenticodeVerify()
  (bsc#1177789, CVE-2019-14584)</changelog>
  <changelog author="glin@suse.com" date="1610452800">- Add ovmf-bsc1180079-amd-sev-es-mitigation.patch to mitigate the
  potential AMD SEV-ES security issues (bsc#1180079)
- Add the json descriptor for xen-hvm (bsc#1180050)</changelog>
  <changelog author="glin@suse.com" date="1611921600">- Add ovmf-jscSLE-16075-SEV-ES-use-physical-address.patch as the
  follow-up patch for SEV-ES to fix the flash writing
  (jsc#SLE-16075)
- Update 50-xen-hvm-x86_64.json to add "nvram-template" and change
  the firmware file to ovmf-x86_64-ms-4m.bin
  (bsc#1180050, bsc#1181264)
- Refresh ovmf-bsc1180079-amd-sev-es-mitigation.patch
  + Use "git format-patch --no-renames" to generate the patch to
    avoid confusing quilt with the renamed files</changelog>
  <changelog author="glin@suse.com" date="1616068800">- Add ovmf-bsc1183578-lzma-catch-4GB.patch to fix the possible
  heap corruption (bsc#1183578, CVE-2021-28211)
- Add ovmf-bsc1183579-fix-fv-recursion.patch to fix unlimited FV
  recursion (bsc#1183579, CVE-2021-28210)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Build ovmf-x86_64-smm against Ia32X64 to enable S3 support
  (bsc#1184938)
- Update ovmf-add-exclude-shell-flag.patch to include Ia32X64</changelog>
  <changelog author="glin@suse.com" date="1620129600">- Update the descriptors to add "acpi-s4" tag to allow libvirt
  enable hibernation (bsc#1182886#c31)</changelog>
  <changelog author="glin@suse.com" date="1623067200">- Add ovmf-bsc1186151-fix-iscsi-overflows.patch to fix the possible
  overflows in IScsiDxe (bsc#1186151)</changelog>
  <changelog author="jlee@suse.com" date="1640088000">- Add ovmf-bsc1192126-OvmfPkg-PlatformPei-Always-reserve-the-SEV-ES-work-a.patch
  to fix unlimited reset. (bsc#1192126)</changelog>
  <changelog author="fvogt@suse.com" date="1649851200">- Set TPM2_ENABLE and TPM2_CONFIG_ENABLE as well, needed for Arm
  (boo#1197458)</changelog>
  <changelog author="jlee@suse.com" date="1671796800">- Add ovmf-bsc1188371-UefiCpuPkg-Move-MigrateGdt-from-DiscoverMemory-to-Te.patch
  to fix insufficient input validation in MdeModulePkg.
  (bsc#1188371, CVE-2019-11098)</changelog>
</package>
<package pkgid="7d4babf898b96761a20ef4b49dc6684fde246f5655da82f6e9ae8b62983cac77" name="qemu-seabios" arch="noarch">
  <version epoch="0" ver="1.14.0_0_g155821a" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="1e0e3748304fd823a12a621dc2bc8edb89bf2344ff3a6f373401b0e786d66d2c" name="qemu-sgabios" arch="noarch">
  <version epoch="0" ver="8" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="bd0ad210dfb7450cf2a0f6569c64c633a2bc31ede3c8f7a4812c35ea429481f5" name="qemu-tools" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="03127eb48939a607d09b2552259436cb52831aa67bfd2b67aba0ab91d1eb06c7" name="qemu-tools" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="bc383282d8456eaf5d4f841496b84e0b36750d3d1fee96d2df9e893a3e037a5d" name="qemu-uefi-aarch64" arch="noarch">
  <version epoch="0" ver="202008" rel="150300.10.17.1"/>
  <changelog author="glin@suse.com" date="1580731200">- Build the unified firmware with preloaded keys for backward
  compatibility (bsc#1159793)</changelog>
  <changelog author="glin@suse.com" date="1582027200">- Add ovmf-bsc1163959-PiDxeS3BootScriptLib-fix-numeric-truncation.patch
  to fix the numeric truncation to avoid the potential memory
  corruption (bsc#1163959, CVE-2019-14563)</changelog>
  <changelog author="glin@suse.com" date="1582545600">- Add ovmf-bsc1163969-fix-DxeImageVerificationHandler.patch to fix
  dbx signature check (bsc#1163969, CVE-2019-14575)
  + Also change the order of several patches to distinguish the
    openssl patch
- Add ovmf-bsc1163927-fix-ip4dxe-and-arpdxe.patch to fix memory
  leakage in Ip4Dxe and ArpDxe (bsc#1163927, CVE-2019-14559)</changelog>
  <changelog author="glin@suse.com" date="1586174400">- Add ovmf-bsc1163927-fix-ping-and-ip6dxe.patch to fix crash and
  hang in ShellPkg and Ip6Dxe (bsc#1163927, CVE-2019-14559)</changelog>
  <changelog author="glin@suse.com" date="1595246400">- Add ovmf-bsc1119454-additional-scsi-drivers.patch to support more
  SCSI drivers (PvScsi, MptScsi, and LsiScsi) (bsc#1119454)
  + Enable LsiScsi explicitly since it's disabled by default</changelog>
  <changelog author="glin@suse.com" date="1599134400">- Add ovmf-bsc1175476-fix-DxeImageVerificationLib-overflow.patch
  to fix overflow in DxeImageVerificationHandler
  (bsc#1175476, CVE-2019-14562)</changelog>
  <changelog author="glin@suse.com" date="1599652800">- Update to edk2-stable202008
  + MdeModulePkg/Library: add PEIM and SEC module type to
    TpmMeasurementLibNull
  + SecurityPkg/DxeImageVerificationLib: catch alignment overflow
    (CVE-2019-14562) (bsc#1175476)
  + OvmfPkg/CpuHotplugSmm: fix CPU hotplug race before and after
    SMI broadcast
  + SecurityPkg/Tcg2: handle PRE HASH and LOG ONLY
  + MdePkg/Include: Add missing definition of SMBIOS type 42h in
    SmBios.h
  + MdePkg: UefiFileHandleLib: fix buffer overrun in
    FileHandleReadLine()
  + OvmfPkg: Add SEV-ES support (jsc#SLE-16075)
  + MdeModulePkg/PartitionDxe: Fix the incorrect LBA size in child
    hander
  + MdeModulePkg/PartitionDxe: Revert changes for the special MBR
  + MdeModulePkg/PartitionDxe: Put the UDF check ahead of MBR
  + ShellPkg: smbiosview - Change some type 17 field values format
  + CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g
  + MdeModulePkg: Upon BootOption failure, Destroy RamDisk memory
    before RSC.
  + OvmfPkg/LsiScsiDxe: Add support for LSI 53C895A
  + MdeModulePkg/DisplayEngine: Add Debug message to show mismatch
    menu info
  + Add New Memory Attributes
  + MdeModulePkg/PartitionDxe: Add already start check for child
    hanldes
  + MdeModulePkg/PartitionDxe: Skip the MBR that add for CD-ROM
  + MdeModulePkg/PartitionDxe: Correct the MBR last block value
  + MdeModulePkg/Variable/RuntimeDxe: Fix return status from
    Reclaim()
  + SecurityPkg/Tcg2Pei: Add missing PCRIndex in FvBlob event.
  + SecurityPkg/Tcg2Dxe: Add PcdTcgPfpMeasurementRevision in
    SpecId event.
  + CryptoPkg/BaseCryptLib: Add MARCO to disable the deprecated
    SHA1 and MD5
  + ArmVirtPkg/NorFlashQemuLib: disable NOR flash DT nodes upon
    discovery
  + UefiCpuPkg/SecCore: Add pre-memory AP vector
  + OvmfPkg: End timer interrupt later to avoid stack overflow
    under load
  + ArmPkg/PlatformBootManagerLib: regenerate boot options on
    boot failure
  + MdeModulePkg/StatusCodeHandler: do not output \n\r for string
    data
  + Revert "OvmfPkg: use generic QEMU image loader for secure boot
    enabled ..."
  + ArmVirtPkg/PrePi: use standard PeCoff routines for
    self-relocation
  + ArmVirtPkg: add FDF rule for self-relocating PrePi
  + ArmPkg/ArmExceptionLib: use static buffer for sp_el0
  + MdeModulePkg/SetupBrowserDxe: Do not reconnect driver with
    form-update
  + OvmfPkg/X86QemuLoadImageLib: handle EFI_ACCESS_DENIED from
    LoadImage()
  + OvmfPkg/Tcg2ConfigPei: generalize TPM2-only file-top comments
  + ArmPkg: only attempt buildin MmCommunicationDxe for AArch64
  + ArmPkg/PlatformBootManagerLib: don't connect all devices on
    each boot
  + ArmPkg/PlatformBootManagerLib: hide UEFI Shell as a regular
    boot option
  + MdeModulePkg/BootManagerUiLib: show inactive boot options
  + ArmPkg/PlatformBootManagerLib: fall back to the UiApp on
    boot failure
  + ArmPkg/PlatformBootManagerLib: register 's' as UEFI Shell
    hotkey
  + ArmPkg/PlatformBootManagerLib: connect non-discoverable USB
    hosts
  + ArmPkg/ArmSvcLib: prevent speculative execution beyond svc
  + ArmPkg/PlatformBootManagerLib: reject 'default' parity and
    stop bit count
  + ArmPkg/PlatformBootManagerLib: use static assertion for
    console type
  + RegularExpressionDxe: Use submodule way to access third party
    Oniguruma
  + BrotliCustomDecompressLib: Use submodule way to access third
    party brotli
  + BaseTools: Use submodule way to access third party brotli
  + RISC-V architecture on EDK2
  + Disabling safe string constraint assertions
  + ArmVirtPkg Implement support for TPM2 measured boot
  + OVMF Implement support for Linux v5.7+ initrd and mixed mode
    loading
  + OVMF Use loadimage/startimage for loading the kernel passed
    via the QEMU command line
  + OVMF Support booting from Fusion-MPT SCSI controllers
  + OVMF Support booting from VMware PVSCSI controllers
  + OVMF RFE: VCPU hotplug with SMM
  + OVMF PEI phase variable driver / MemoryTypeInfo tracking
  + ArmVirtPkg, OvmfPkg: Pass parameter from QEMU to control PXE
    IPv4/v6 boot
  + Remove deprecate APIs in BaseCryptLib
  + Add UEFI 2.8/2.8a definition in MdePkg
  + Add PI1.7/PI1.7a definition into MdePkg
  + BaseCryptoLib MD4, ARC4, TDES, AES ECB MODE, HMAC MD5, HMAC
    SHA1 API have been deprecated.
  + SecurityPkg Tcg2PhysicalPresenceLib library class removes two
    macros TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and
    TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT.
- Update openssl to 1.1.1g
- Add 2 reduced source tarballs from the submodules of edk2:
  + brotli-v1.0.7-17-g666c328-c.tar.xz
  - We only need the "c" directory, not the whole tarball.
  + oniguruma-v6.9.4_mark1-src.tar.xz
  - We only need the "src" directory, not the whole tarball.
- Build all non-native firmware files on x86_64 and aarch64 with
  cross-compilers (bsc#1159134)
  + Exclude i586 and armv7hl due to the availability of
    cross-compilers
  + Move some bash functions to ovmf-build-funcs.sh
- Clean up PKG_TO_REMOVE
  + Only EmulatorPkg still exists.
- Add ovmf-build-funcs.sh for building the variable templates
- Drop upstreamed patches
  + ovmf-bsc1163927-fix-ip4dxe-and-arpdxe.patch
  + ovmf-bsc1175476-fix-DxeImageVerificationLib-overflow.patch
  + ovmf-bsc1119454-additional-scsi-drivers.patch
  + ovmf-bsc1163927-fix-ping-and-ip6dxe.patch
  + ovmf-bsc1163969-fix-DxeImageVerificationHandler.patch
  + ovmf-bsc1163959-PiDxeS3BootScriptLib-fix-numeric-truncation.patch
  + openssl-fix-syntax-error.patch
- Refresh patches
  + ovmf-disable-ia32-firmware-piepic.patch
  + ovmf-gdb-symbols.patch
  + ovmf-pie.patch</changelog>
  <changelog author="glin@suse.com" date="1604059200">- Add _constraints to request at least 6GB disk (bsc#1178244)
- Remove the build files after finishing the build to reduce the
  disk usage (bsc#1178244)</changelog>
  <changelog author="glin@suse.com" date="1604577600">- Update the json descriptors to address all x86_64 firmware files
  (jsc#SLE-15915)
- Remove the executable bit from brotli source code files</changelog>
  <changelog author="glin@suse.com" date="1605614400">- Add ovmf-jscSLE-16075-SEV-ES-fixes.patch to merge upstream SEV-ES
  fixes (jsc#SLE-16075)</changelog>
  <changelog author="glin@suse.com" date="1606910400">- Add ovmf-bsc1177789-cryptopkg-fix-null-dereference.patch to fix
  the potential NULL dereference in AuthenticodeVerify()
  (bsc#1177789, CVE-2019-14584)</changelog>
  <changelog author="glin@suse.com" date="1610452800">- Add ovmf-bsc1180079-amd-sev-es-mitigation.patch to mitigate the
  potential AMD SEV-ES security issues (bsc#1180079)
- Add the json descriptor for xen-hvm (bsc#1180050)</changelog>
  <changelog author="glin@suse.com" date="1611921600">- Add ovmf-jscSLE-16075-SEV-ES-use-physical-address.patch as the
  follow-up patch for SEV-ES to fix the flash writing
  (jsc#SLE-16075)
- Update 50-xen-hvm-x86_64.json to add "nvram-template" and change
  the firmware file to ovmf-x86_64-ms-4m.bin
  (bsc#1180050, bsc#1181264)
- Refresh ovmf-bsc1180079-amd-sev-es-mitigation.patch
  + Use "git format-patch --no-renames" to generate the patch to
    avoid confusing quilt with the renamed files</changelog>
  <changelog author="glin@suse.com" date="1616068800">- Add ovmf-bsc1183578-lzma-catch-4GB.patch to fix the possible
  heap corruption (bsc#1183578, CVE-2021-28211)
- Add ovmf-bsc1183579-fix-fv-recursion.patch to fix unlimited FV
  recursion (bsc#1183579, CVE-2021-28210)</changelog>
  <changelog author="glin@suse.com" date="1618833600">- Build ovmf-x86_64-smm against Ia32X64 to enable S3 support
  (bsc#1184938)
- Update ovmf-add-exclude-shell-flag.patch to include Ia32X64</changelog>
  <changelog author="glin@suse.com" date="1620129600">- Update the descriptors to add "acpi-s4" tag to allow libvirt
  enable hibernation (bsc#1182886#c31)</changelog>
  <changelog author="glin@suse.com" date="1623067200">- Add ovmf-bsc1186151-fix-iscsi-overflows.patch to fix the possible
  overflows in IScsiDxe (bsc#1186151)</changelog>
  <changelog author="jlee@suse.com" date="1640088000">- Add ovmf-bsc1192126-OvmfPkg-PlatformPei-Always-reserve-the-SEV-ES-work-a.patch
  to fix unlimited reset. (bsc#1192126)</changelog>
  <changelog author="fvogt@suse.com" date="1649851200">- Set TPM2_ENABLE and TPM2_CONFIG_ENABLE as well, needed for Arm
  (boo#1197458)</changelog>
  <changelog author="jlee@suse.com" date="1671796800">- Add ovmf-bsc1188371-UefiCpuPkg-Move-MigrateGdt-from-DiscoverMemory-to-Te.patch
  to fix insufficient input validation in MdeModulePkg.
  (bsc#1188371, CVE-2019-11098)</changelog>
</package>
<package pkgid="39eb2e3271679d17f7be453c9f97d1f5f739d283a2ecfd0969eb140be4db3c80" name="qemu-ui-opengl" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="139b1ce8a349a55ca6d87b8f94e0b44f5aaac1927228eeadec66996c4d8fc70e" name="qemu-ui-opengl" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="bff69695fe2eb26496984b4a74101e80a27a2b67173076ec08c2cc8a6ff96b57" name="qemu-ui-spice-core" arch="aarch64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="ddc04472b2c9b162db21bcfdba000c4e32dcd180766ef4362b2a1a4cab7a04cf" name="qemu-ui-spice-core" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="1bf6fe61a7ceb8ec23649016baf2491ccaacea2ad38aa57cc600c8bbd102bd1e" name="qemu-vgabios" arch="noarch">
  <version epoch="0" ver="1.14.0_0_g155821a" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="eb077e390de0b1d4f31c15c2cf769510e874b1b79767a21de17d311da1054c03" name="qemu-x86" arch="x86_64">
  <version epoch="0" ver="5.2.0" rel="150300.118.3"/>
  <changelog author="jose.ziviani@suse.com" date="1628251200">- usbredir: free call on invalid pointer in bufp_alloc
  (bsc#1189145, CVE-2021-3682)
  usbredir-fix-free-call.patch</changelog>
  <changelog author="lma@suse.com" date="1630670400">- Fix qemu crash while deleting xen-block (bsc#1189234)
  * Patches added:
  xen-remove-BlockBackend-object-reference.patch</changelog>
  <changelog author="lma@suse.com" date="1631620800">- Add transfer length item in block limits page of scsi vpd (bsc#1190425)
  * Patches added:
  block-add-max_hw_transfer-to-BlockLimits.patch
  block-backend-align-max_transfer-to-requ.patch
  file-posix-fix-max_iov-for-dev-sg-device.patch
  file-posix-try-BLKSECTGET-on-block-devic.patch
  osdep-provide-ROUND_DOWN-macro.patch
  scsi-generic-pass-max_segments-via-max_i.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633003200">- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation
  (bsc#1189702, CVE-2021-3713)
  uas-add-stream-number-sanity-checks.patch
- Fix heap use-after-free in virtio_net_receive_rcu
  (bsc#1189938, CVE-2021-3748)
  virtio-net-fix-use-after-unmap-free-for-.patch</changelog>
  <changelog author="jose.ziviani@suse.com" date="1633435200">- Fix QEMU upgrade from 15-SP2 to 15-SP3.</changelog>
  <changelog author="lma@suse.com" date="1634731200">- Introduce max_hw_iov for use in scsi-generic (bsc#1190425)
  * Patches added:
  block-introduce-max_hw_iov-for-use-in-sc.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1637928000">- update_git.sh: make sure special directories are defined and created
  before they're used</changelog>
  <changelog author="dfaggioli@suse.com" date="1640174400">- Rename the Guest Agent service qemu-guest-agent, like in other
  distros (and upstream). bsc#1185543</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260800">- Amend .changes file: avoid declaring a still unfixed CVE, as
  fixed (bsc#1187529)</changelog>
  <changelog author="dfaggioli@suse.com" date="1640260801">- Fix "block/fdc: null pointer dereference may lead to guest crash"
  (CVE 2021-20196, bsc#1181361)
  * Patches added:
    hw-block-fdc-Kludge-missing-floppy-drive.patch
    hw-block-fdc-Extract-blk_create_empty_dr.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235200">- Fix "kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c"
  (bsc#1192525, CVE-2021-3930)
  * Patches added:
  hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-all.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1644235201">- Fix "qemu,kvm: potential privilege escalation via virtiofsd"
  (bsc#1195161, CVE-2022-0358)
  * Patches added:
  virtiofsd-Drop-membership-of-all-supplem.patch</changelog>
  <changelog author="lma@suse.com" date="1644408000">- Add the qemu patches in bsc#1178049(sles 15 sp2) to qemu v5.2.
  (bsc#1178049, bsc#1194938)
  * Patches added:
  scsi-add-tracing-for-SG_IO-commands.patch
  scsi-disk-fold-SG_IO-errors-back-into-re.patch
  scsi-disk-set-default-I-O-timeout-to-30-.patch
  scsi-disk-trace-rw-errors.patch
  scsi-generic-check-for-additional-SG_IO-.patch
  scsi-make-io_timeout-settable.patch
  virtio-scsi-change-DID-TIMEOUT-handling.patch
  virtio-scsi-trace-events.patch
  virtio-scsi-translate-SG_IO-host-status.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827200">- Build PPC firmwares from sources on non-PPC builds as well
  (bsc#1193545)
- Build RiscV firmwares on non-RiscV builds as well
- While there, refactor (and simplify!) the firmware building
  logic and code
- Include vmxcap in the qemu-tools package (is being very useful
  for debugging bsc#1193364)
- The qemu package should require qemu-x86, qemu-arm, etc, as there's
  no point installing it without _any_ of them. Additionally, right
  now, the user does not get a working qemu, if recommended packages
  are disabled (e.g., on MicroOS or SLE Micro). bsc#1196087
- Give clearer instructions on how to modify the package patches
  from the output of update_git.sh (docs change only, no functional
  change)
  * Patches added:
  Makefile-define-endianess-for-cross-buil.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1646827201">- Fix "QEMU direct kernel boot cmdline can corrupt guest kernel data"
  (bsc#1196737)
  * Patches added:
  s390x-ipl-check-kernel-command-line-size.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1652443200">- Backport SeaBIOS patches for fixing bsc#1199018
  * Patches added:
  pci-let-firmware-reserve-IO-for-pcie-pci.patch
  pci-reserve-resources-for-pcie-pci-bridg.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257600">- Fix bsc#1199924 and bsc#1197084
  * Patches added:
  hostmem-default-the-amount-of-prealloc-t.patch
  pci-fix-overflow-in-snprintf-string-form.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1654257601">- Fix bsc#1198037, CVE-2021-4207
- Fix bsc#1198035, CVE-2021-4206
- Fix bsc#1198712, CVE-2022-26354
  * Patches added:
  display-qxl-render-fix-race-condition-in.patch
  ui-cursor-fix-integer-overflow-in-cursor.patch
  vhost-vsock-detach-the-virqueue-element-.patch</changelog>
  <changelog author="lma@suse.com" date="1656676800">- Fix usb ehci boot failure (bsc#1192115)
  * Patches added:
  hw-usb-hcd-ehci-fix-writeback-order.patch</changelog>
  <changelog author="dfaggioli@suse.com" date="1657886400">- Fix bsc#1198038, CVE-2022-0216
- Fix bsc#1201367, CVE-2022-35414
  * Patches added:
  scsi-lsi53c895a-fix-use-after-free-in-ls.patch
  softmmu-Always-initialize-xlat-in-addres.patch</changelog>
</package>
<package pkgid="7f52cf6c398b1453bf82350da6f31549366668a7bae50110f3725098dd82dc76" name="rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1576152000">- Consolidate beecrypt patches into 'beecrypt.diff'
  old patches: beecrypt-4.1.2.diff beecrypt-4.1.2-build.diff
- Use libgcrypt as crypto library for SP2 [jsc#SLE-9552]
  new patch: libgcrypt.diff
- Backport ndb fixes and enable ndb support [jsc#SLE-7272]
  new patch: ndb-backport.diff
- Allow to disable bdb database support [jsc#SLE-7272]
  new patch: disable-bdb.diff
- Rewrite rpmqpack to use rpm's database interface
  modified patch: rpmqpack.diff</changelog>
  <changelog author="mls@suse.de" date="1579176000">- Backport more ndb fixes from upstram
  modified patch: ndb-backport.diff
- Build with zstd support in openSUSE Leap 15
  and SLE-15-SP2 [bnc#1162668]</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Remove ocaml-find-provides.sh, ocaml-find-requires.sh, fileattrs/ocaml.attr
  ocaml(NAME) = HASH is now handled in ocaml-rpm-macros (bsc#1154874)</changelog>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608724800">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618488000">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors ?-whatobsoletes and ?-whatconflicts
  * add support for sorting caret (?^?) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
</package>
<package pkgid="4ad854b19193bb291daab17bc50b52cafb0c59416c7ff34aa2a39a5963304e1c" name="rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1576152000">- Consolidate beecrypt patches into 'beecrypt.diff'
  old patches: beecrypt-4.1.2.diff beecrypt-4.1.2-build.diff
- Use libgcrypt as crypto library for SP2 [jsc#SLE-9552]
  new patch: libgcrypt.diff
- Backport ndb fixes and enable ndb support [jsc#SLE-7272]
  new patch: ndb-backport.diff
- Allow to disable bdb database support [jsc#SLE-7272]
  new patch: disable-bdb.diff
- Rewrite rpmqpack to use rpm's database interface
  modified patch: rpmqpack.diff</changelog>
  <changelog author="mls@suse.de" date="1579176000">- Backport more ndb fixes from upstram
  modified patch: ndb-backport.diff
- Build with zstd support in openSUSE Leap 15
  and SLE-15-SP2 [bnc#1162668]</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Remove ocaml-find-provides.sh, ocaml-find-requires.sh, fileattrs/ocaml.attr
  ocaml(NAME) = HASH is now handled in ocaml-rpm-macros (bsc#1154874)</changelog>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608724800">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618488000">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors ?-whatobsoletes and ?-whatconflicts
  * add support for sorting caret (?^?) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
</package>
<package pkgid="a4e8c65cb33a0bcd7bc9d33bcc052dde29ef85b0c57101284adba0c43d38771d" name="rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1576152000">- Consolidate beecrypt patches into 'beecrypt.diff'
  old patches: beecrypt-4.1.2.diff beecrypt-4.1.2-build.diff
- Use libgcrypt as crypto library for SP2 [jsc#SLE-9552]
  new patch: libgcrypt.diff
- Backport ndb fixes and enable ndb support [jsc#SLE-7272]
  new patch: ndb-backport.diff
- Allow to disable bdb database support [jsc#SLE-7272]
  new patch: disable-bdb.diff
- Rewrite rpmqpack to use rpm's database interface
  modified patch: rpmqpack.diff</changelog>
  <changelog author="mls@suse.de" date="1579176000">- Backport more ndb fixes from upstram
  modified patch: ndb-backport.diff
- Build with zstd support in openSUSE Leap 15
  and SLE-15-SP2 [bnc#1162668]</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Remove ocaml-find-provides.sh, ocaml-find-requires.sh, fileattrs/ocaml.attr
  ocaml(NAME) = HASH is now handled in ocaml-rpm-macros (bsc#1154874)</changelog>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608724800">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618488000">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors ?-whatobsoletes and ?-whatconflicts
  * add support for sorting caret (?^?) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
</package>
<package pkgid="c5a3e978dab877b1d1424def3288a33dc7afae369aa5b2ea5b66d21201e4f34a" name="rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Backport more ndb fixes from upstram
  modified patch: ndb-backport.diff
- Build with zstd support in openSUSE Leap 15
  and SLE-15-SP2 [bnc#1162668]</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Remove ocaml-find-provides.sh, ocaml-find-requires.sh, fileattrs/ocaml.attr
  ocaml(NAME) = HASH is now handled in ocaml-rpm-macros (bsc#1154874)</changelog>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608724800">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618488000">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors ?-whatobsoletes and ?-whatconflicts
  * add support for sorting caret (?^?) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
</package>
<package pkgid="c412885dc0a697ac91b3c12a1a91f5463eb9b364ac2928b26164a19f6f2ec022" name="rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Backport more ndb fixes from upstram
  modified patch: ndb-backport.diff
- Build with zstd support in openSUSE Leap 15
  and SLE-15-SP2 [bnc#1162668]</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Remove ocaml-find-provides.sh, ocaml-find-requires.sh, fileattrs/ocaml.attr
  ocaml(NAME) = HASH is now handled in ocaml-rpm-macros (bsc#1154874)</changelog>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608724800">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618488000">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors ?-whatobsoletes and ?-whatconflicts
  * add support for sorting caret (?^?) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
</package>
<package pkgid="f19d87d60f44cd485734b239880949e14cdb7bb83185d7bc717fb6e2f712cf45" name="rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Backport more ndb fixes from upstram
  modified patch: ndb-backport.diff
- Build with zstd support in openSUSE Leap 15
  and SLE-15-SP2 [bnc#1162668]</changelog>
  <changelog author="ohering@suse.de" date="1582200000">- Remove ocaml-find-provides.sh, ocaml-find-requires.sh, fileattrs/ocaml.attr
  ocaml(NAME) = HASH is now handled in ocaml-rpm-macros (bsc#1154874)</changelog>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608724800">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618488000">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors ?-whatobsoletes and ?-whatconflicts
  * add support for sorting caret (?^?) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
</package>
<package pkgid="26a00e07db13916a6a5317fe5e33fe15bb29abe4de881c8dbc716ecccbd2aaa8" name="rpm" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608638400">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors –-whatobsoletes and –-whatconflicts
  * add support for sorting caret (‘^’) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
  <changelog author="dmueller@suse.com" date="1674129600">- add pythondeps-python310.diff
  and add match-python-version-if-minor.diff:
  * fix missing python(abi) for 3.XX versions (bsc#1207294)</changelog>
  <changelog author="daniel.garcia@suse.com" date="1674129601">- update pythondeps-python310.diff: replace with minimal fix to
  support python 3.xx (bsc#1207294)</changelog>
</package>
<package pkgid="fd86090d5968b53c29914077252fc7ccf8b78fef44b00df345fb89b1fe620aaa" name="rpm" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608638400">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors –-whatobsoletes and –-whatconflicts
  * add support for sorting caret (‘^’) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
  <changelog author="dmueller@suse.com" date="1674129600">- add pythondeps-python310.diff
  and add match-python-version-if-minor.diff:
  * fix missing python(abi) for 3.XX versions (bsc#1207294)</changelog>
  <changelog author="daniel.garcia@suse.com" date="1674129601">- update pythondeps-python310.diff: replace with minimal fix to
  support python 3.xx (bsc#1207294)</changelog>
</package>
<package pkgid="11c10c40a77e3d3032a28cf4e04ad33fbd7c7a2d9ef0dd8e92166bfdf23c9a45" name="rpm" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1586347200">- Fix verification of DSA2 signatures with libgrcypt [bnc#1165731]
  * new patch: gcryptdsa2.diff</changelog>
  <changelog author="mls@suse.de" date="1586865600">- Do not map the index database read-write all the time [bnc#1168735]
  * new patch: ndb_backport2.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1590321600">- Add reproducible-debuginfo.patch to generate debuginfo
  in a reproducible way [bsc#1172173]</changelog>
  <changelog author="lpechacek@suse.com" date="1603800000">- Backport support for compressed kernel modules (jsc#SLE-10886)
  * added patch: compressed-kernel-modules.diff
  * modified file: find-requires.ksyms
  * modified file: find-provides.ksyms
- Fix obvious bugs in find-provides.ksyms
  * https://github.com/openSUSE/rpm-config-SUSE/pull/34</changelog>
  <changelog author="mls@suse.de" date="1607428800">- Handle xz compressed kernels in find-provides.ksyms [bsc#1179251]
  * modified file: find-requires.ksyms</changelog>
  <changelog author="mls@suse.de" date="1607515200">- Backport FA_TOUCH fixes from upsteam [bnc#1175025] [bnc#1177428]
  * new patch: touch_backport.diff
- Backport read-only berkeley db support and enable it if we
  disable berkeley db [jsc#SLE-7272]
  * new patch: bdb_ro_backport.diff</changelog>
  <changelog author="mls@suse.de" date="1608638400">- Finish split of SUSE macros and some helpers into rpm-config-SUSE
  [jsc#SLE-17074]
  * new patch: findsupplements.diff
  * modified patches: fileattrs.diff, brp.diff, macrosin.diff,
    enable-postin-scripts-error.diff
  * dropped files: rpm-suse_macros
  * dropped patches: firmware.diff, initscriptsprov.diff,
    modalias-encode.diff, modalias.diff,
    compressed-kernel-modules.diff, findksyms.diff</changelog>
  <changelog author="mls@suse.de" date="1611921600">- Increase the maximum size of the signature header so that rpms
  containing file signatures can be queried [bsc#1181568]
  * new patch: sigheadersize.diff</changelog>
  <changelog author="mls@suse.de" date="1612958400">- Do not require the signature header to be in a contiguous
  region when signing [bnc#1181805]
  * new patch: signbadregion.diff</changelog>
  <changelog author="bwiedemann@suse.com" date="1613995200">- Add rpm-4.14.1-initialize-verifyflags.diff [bsc#1180279]</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3 [jsc#SLE-17817]
  * add support for enforcing signature policy and payload
    verification step to transactions
  * add :humansi and :hmaniec query formatters for human readable output
  * add query selectors –-whatobsoletes and –-whatconflicts
  * add support for sorting caret (‘^’) higher than base version
- refreshed patches:
  * checksepwarn.diff
  * dbrointerruptable.diff
  * finddebuginfo.diff
  * ndb-backport.diff
  * pythondistdeps.diff
  * remove-brp-strips.diff
  * whatrequires-doc.diff
- dropped patches:
  * debugedit-bnc1076819.diff
  * debugedit-riscv.patch
  * disttag-macro.diff
  * hardlinks.diff
  * reproducible-debuginfo.patch
  * rpm-4.14.1-initialize-verifyflags.diff
  * safesymlinks.diff
  * signbadregion.diff
  * verifynodup.diff</changelog>
  <changelog author="mls@suse.de" date="1619006400">- set default package verification level to 'none' to be compatible
  to rpm-4.14.1
  new patch: verifylevel_none.diff
- make illegal obsoletes a warning
  new patch: badobsoletewarn.diff
- backport header check security fixes from upstream [CVE-2021-3421]
  [CVE-2021-20271] [CVE-2021-20266]
  [bsc#1183543] [bsc#1183545]
  new patch: headerchk3.diff
- fix potential access of freed mem in ndb's glue code [bnc#1179416]
  new patch: ndbglue.diff
- permit secondary index open to fail for bdb_ro
  new patch: bdbro_missingidx.diff</changelog>
  <changelog author="mls@suse.de" date="1633521600">- backport zstd detection fix [bsc#1187670]
  new patch: zstddetection.diff
- backport ndb rofs support [bsc#1188548]
  new patch: ndbrofs.diff
- backport pgp hardening changes from upstream [bsc#1185299]
  new patch: pgpharden.diff
- fix deadlock when multiple rpm processes try tp acquire the
  database lock [bsc#1183659]
  new patch: deadlock.diff</changelog>
  <changelog author="mcepl@suse.com" date="1639483200">- Add explicit requirement on python-rpm-macros to avoid widespread
  breakage by package mistakenly ignoring their requirement of
  python-rpm-macros (bsc#1180125, bsc#1193711).</changelog>
  <changelog author="mls@suse.de" date="1640174400">- Backport header check changes so that old rpms get no longer
  rejected [bsc#1190824]
  updated patch: headerchk3.diff</changelog>
  <changelog author="mls@suse.de" date="1642680000">- Revert unwanted /usr/bin/python -&gt; /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff</changelog>
  <changelog author="mls@suse.de" date="1657627200">- Support Ed25519 signatures [jsc#SLE-24714]
  * new patch: ed25519.diff</changelog>
  <changelog author="mls@suse.de" date="1666699200">- Strip critical bit in signature subpackage parsing
  * modified patch: pgpharden.diff
- Add workaround to make newer dnf versions no longer deadlock
  after it imported a pubkey [bnc#1202750]
  * new patch: keyimportdeadlock.diff</changelog>
  <changelog author="dmueller@suse.com" date="1674129600">- add pythondeps-python310.diff
  and add match-python-version-if-minor.diff:
  * fix missing python(abi) for 3.XX versions (bsc#1207294)</changelog>
  <changelog author="daniel.garcia@suse.com" date="1674129601">- update pythondeps-python310.diff: replace with minimal fix to
  support python 3.xx (bsc#1207294)</changelog>
</package>
<package pkgid="878bb798592189670245d8f3b70e402ab07a777f9622d073fbc127ebd1106a7a" name="rpm-ndb" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="5bf2a890d69c21377304853ab766246de83f44e8a2031428d2d53b57282487c1" name="rpm-ndb" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="a53218027f4429b5c424ea53cea1e2223f7b407a54e0229dcacb36d40a0b359e" name="rpm-ndb" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.49.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="e619df826a99136a4ceb3e89f093892fc2a21cca5b7986381f348b3d2adb250a" name="rpm-ndb" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="fe98adc533c92d6ba162405e09207b2bda16b4d88fb9ef5cfef5c6721e5d36d6" name="rpm-ndb" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="601fbedb4437b25a8ffe4527375c8c28f26ad78bc4f7d4812abf4747db7790f3" name="rpm-ndb" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.52.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="3a8ce6f2d5c78e29eaf845985aa69500ad71339647a7092f6780966c45599ae7" name="rpm-ndb" arch="aarch64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="c1c2f2f4e3afb8ee5e73ee160809edc8e7787741756f933b066d4f24ddc051bf" name="rpm-ndb" arch="src">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="fe254b90ec4a31c8972fe06b6b816c70bde0234bce2863cfea3e5ba28567a567" name="rpm-ndb" arch="x86_64">
  <version epoch="0" ver="4.14.3" rel="150300.55.1"/>
  <changelog author="mls@suse.de" date="1579176000">- Initial revision</changelog>
  <changelog author="ngompa13@gmail.com" date="1618401600">- update to rpm-4.14.3</changelog>
</package>
<package pkgid="49a6513cbc021922a5af83ad5a8e985689a033fbc0428bce1ca8f3ecc5a9168e" name="rsync" arch="aarch64">
  <version epoch="0" ver="3.1.3" rel="150000.4.13.1"/>
  <changelog author="vcizek@suse.com" date="1439294400">- reintroduce "use slp" directive (bsc#922710)
  * added rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444132800">- add a compatibility flag to avoid checksum collisions (bsc#900914)
  * fixes rsync equivalent of librsync's CVE-2014-8242
  * added rsync-equivalent_of_CVE-2014-8242.patch
- modify rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444219200">- better disable slp by default, it doesn't seem to be used much
  and it often caused problems (eg boo#898513, bsc#922710)
  * set "use slp" in rsyncd.conf to enable
  * modified rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="hsk@imb-jena.de" date="1452081600">- update to 3.1.2
- drop patches rsync-CVE-2014-9512.patch,
  rsync-equivalent_of_CVE-2014-8242.patch (applied upstream)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- We no longer need to inject the pid in post as we do not use
  the iniscript relying on it
- Add socket activation service instead of the xinetd service
- Verify in services the configuration to run actually exist
- Drop sle11 support as it does not autoreconf anymore
- Drop patch system-zlib.diff that was never applied
- Switch to system popt and zlib:
  * This should not cause issues now because upstream states the
    underlying issue why we used the bundled one was fixed by
    using more safeguarded error detection</changelog>
  <changelog author="tchvatal@suse.com" date="1499947200">- Add patch to build with both bundled and external zlib to support
  both compression methods at once bsc#1046197:
  * rsync-both-compressions.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1500897600">- Refresh patch rsync-both-compressions.patch to include
  fix when using old-compress on new zlib on server too</changelog>
  <changelog author="tchvatal@suse.com" date="1500897601">- Execute tests to ensure the basics are still working</changelog>
  <changelog author="tchvatal@suse.com" date="1500984000">- Try more in supporting all scenarios bsc#1046197#c24
  * rsync-both-compressions.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1511870400">- Security fix [bsc#1066644, CVE-2017-16548]
  * Missing trailing '\0' character check could lead to remote DoS
  * Added rsync-CVE-2017-16548.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515499200">- Fix: Stop file upload after errors [bsc#1062063]
- Added patches:
  * rsync-send_error_to_sender.patch
  * rsync-avoid-uploading-after-error.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1516276800">- Security fix: Ignore --protect-args when already sent by client
  [bsc#1076503, CVE-2018-5764]
  * Added patch rsync-3.1.2-CVE-2018-5764.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1517227200">- Update to version 3.1.3 [bsc#1076503]:
  Protocol: 31 (unchanged)
- SECURITY FIXES:
  * Fixed a buffer overrun in the protocol's handling of xattr names and
    ensure that the received name is null terminated.
  * Fix an issue with --protect-args where the user could specify the arg
    in the protected-arg list and short-circuit some of the arg-sanitizing
    code.
- BUG FIXES:
  * Don't output about a new backup dir without appropriate info verbosity.
  * Fixed some issues with the sort functions in support/rsyncstats script.
  * Added a way to specify daemon config lists (e.g. users, groups, etc)
  * that contain spaces (see "auth users" in the latest rsyncd.conf manpage).
  * If a backup fails (e.g. full disk) rsync exits with an error.
  * Fixed a problem with a doubled --fuzzy option combined with --link-dest.
  * Avoid invalid output in the summary if either the start or end time had
    an error.
  * We don't allow a popt alias to affect the --daemon or --server options.
  * Fix daemon exclude code to disallow attribute changes in addition to
    disallowing transfers.
  * Don't force nanoseconds to match if a non-transferred, non-checksummed
    file only passed the quick-check w/o comparing nanosecods.
- ENHANCEMENTS:
  * Added the ability for rsync to compare nanosecond times in its
    file-check
    comparisons, and added support nanosecond times on Mac OS X.
  * Added a short-option (-@) for --modify-window.
  * Added the --checksum-choice=NAME[,NAME] option to choose the checksum
    algorithms.
  * Added hashing of xattr names (with using -X) to improve the handling of
    files with large numbers of xattrs.
  * Added a way to filter xattr names using include/exclude/filter rules
    (see the --xattrs option in the manpage for details).
  * Added "daemon chroot|uid|gid" to the daemon config (in addition to the
    old chroot|uid|gid settings that affect the daemon's transfer process).
  * Added "syslog tag" to the daemon configuration.
  * Some manpage improvements.
- DEVELOPER RELATED:
  * Tweak the "make" output when yodl isn't around to create the man pages.
  * Changed an obsolete autoconf compile macro.
  * Support newer yodl versions when converting man pages.
- Dropped patches fixed upstream:
  * rsync-CVE-2017-16548.patch
  * rsync-3.1.2-CVE-2018-5764.patch
- Refreshed patches:
  * rsync-send_error_to_sender.patch</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kukuk@suse.de" date="1531310400">- Don't require systemd explicit, spec file can handle both cases
  correct and in containers we don't have systemd [bsc#1100786].</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1555156800">- Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1555329600">- Fixed bug numbers in spec file</changelog>
  <changelog author="pmonreal@suse.com" date="1631793600">- Fix a segmentation fault in iconv [bsc#1188258]
  * Add rsync-iconv-segfault.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637064000">- Fixed an error when using the external compression library
  where files larger that 1GB would not be transferred completely
  and failing with error:
  - deflate on token returned 0 (XXX bytes left)
  - rsync error: error in rsync protocol data stream (code 12)
  * Add rsync-fix-external-compression.patch [bsc#1190828]</changelog>
  <changelog author="psimons@suse.com" date="1660564800">- Apply "rsync-CVE-2022-29154.patch" to fix a security vulnerability
  in the do_server_recv() function. [bsc#1201840, CVE-2022-29154]</changelog>
</package>
<package pkgid="11d54b5bb20a64ee796d321c3447568b09d6e899141292f0e0110a51908c72ca" name="rsync" arch="src">
  <version epoch="0" ver="3.1.3" rel="150000.4.13.1"/>
  <changelog author="vcizek@suse.com" date="1439294400">- reintroduce "use slp" directive (bsc#922710)
  * added rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444132800">- add a compatibility flag to avoid checksum collisions (bsc#900914)
  * fixes rsync equivalent of librsync's CVE-2014-8242
  * added rsync-equivalent_of_CVE-2014-8242.patch
- modify rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444219200">- better disable slp by default, it doesn't seem to be used much
  and it often caused problems (eg boo#898513, bsc#922710)
  * set "use slp" in rsyncd.conf to enable
  * modified rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="hsk@imb-jena.de" date="1452081600">- update to 3.1.2
- drop patches rsync-CVE-2014-9512.patch,
  rsync-equivalent_of_CVE-2014-8242.patch (applied upstream)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- We no longer need to inject the pid in post as we do not use
  the iniscript relying on it
- Add socket activation service instead of the xinetd service
- Verify in services the configuration to run actually exist
- Drop sle11 support as it does not autoreconf anymore
- Drop patch system-zlib.diff that was never applied
- Switch to system popt and zlib:
  * This should not cause issues now because upstream states the
    underlying issue why we used the bundled one was fixed by
    using more safeguarded error detection</changelog>
  <changelog author="tchvatal@suse.com" date="1499947200">- Add patch to build with both bundled and external zlib to support
  both compression methods at once bsc#1046197:
  * rsync-both-compressions.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1500897600">- Refresh patch rsync-both-compressions.patch to include
  fix when using old-compress on new zlib on server too</changelog>
  <changelog author="tchvatal@suse.com" date="1500897601">- Execute tests to ensure the basics are still working</changelog>
  <changelog author="tchvatal@suse.com" date="1500984000">- Try more in supporting all scenarios bsc#1046197#c24
  * rsync-both-compressions.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1511870400">- Security fix [bsc#1066644, CVE-2017-16548]
  * Missing trailing '\0' character check could lead to remote DoS
  * Added rsync-CVE-2017-16548.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515499200">- Fix: Stop file upload after errors [bsc#1062063]
- Added patches:
  * rsync-send_error_to_sender.patch
  * rsync-avoid-uploading-after-error.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1516276800">- Security fix: Ignore --protect-args when already sent by client
  [bsc#1076503, CVE-2018-5764]
  * Added patch rsync-3.1.2-CVE-2018-5764.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1517227200">- Update to version 3.1.3 [bsc#1076503]:
  Protocol: 31 (unchanged)
- SECURITY FIXES:
  * Fixed a buffer overrun in the protocol's handling of xattr names and
    ensure that the received name is null terminated.
  * Fix an issue with --protect-args where the user could specify the arg
    in the protected-arg list and short-circuit some of the arg-sanitizing
    code.
- BUG FIXES:
  * Don't output about a new backup dir without appropriate info verbosity.
  * Fixed some issues with the sort functions in support/rsyncstats script.
  * Added a way to specify daemon config lists (e.g. users, groups, etc)
  * that contain spaces (see "auth users" in the latest rsyncd.conf manpage).
  * If a backup fails (e.g. full disk) rsync exits with an error.
  * Fixed a problem with a doubled --fuzzy option combined with --link-dest.
  * Avoid invalid output in the summary if either the start or end time had
    an error.
  * We don't allow a popt alias to affect the --daemon or --server options.
  * Fix daemon exclude code to disallow attribute changes in addition to
    disallowing transfers.
  * Don't force nanoseconds to match if a non-transferred, non-checksummed
    file only passed the quick-check w/o comparing nanosecods.
- ENHANCEMENTS:
  * Added the ability for rsync to compare nanosecond times in its
    file-check
    comparisons, and added support nanosecond times on Mac OS X.
  * Added a short-option (-@) for --modify-window.
  * Added the --checksum-choice=NAME[,NAME] option to choose the checksum
    algorithms.
  * Added hashing of xattr names (with using -X) to improve the handling of
    files with large numbers of xattrs.
  * Added a way to filter xattr names using include/exclude/filter rules
    (see the --xattrs option in the manpage for details).
  * Added "daemon chroot|uid|gid" to the daemon config (in addition to the
    old chroot|uid|gid settings that affect the daemon's transfer process).
  * Added "syslog tag" to the daemon configuration.
  * Some manpage improvements.
- DEVELOPER RELATED:
  * Tweak the "make" output when yodl isn't around to create the man pages.
  * Changed an obsolete autoconf compile macro.
  * Support newer yodl versions when converting man pages.
- Dropped patches fixed upstream:
  * rsync-CVE-2017-16548.patch
  * rsync-3.1.2-CVE-2018-5764.patch
- Refreshed patches:
  * rsync-send_error_to_sender.patch</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kukuk@suse.de" date="1531310400">- Don't require systemd explicit, spec file can handle both cases
  correct and in containers we don't have systemd [bsc#1100786].</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1555156800">- Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1555329600">- Fixed bug numbers in spec file</changelog>
  <changelog author="pmonreal@suse.com" date="1631793600">- Fix a segmentation fault in iconv [bsc#1188258]
  * Add rsync-iconv-segfault.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637064000">- Fixed an error when using the external compression library
  where files larger that 1GB would not be transferred completely
  and failing with error:
  - deflate on token returned 0 (XXX bytes left)
  - rsync error: error in rsync protocol data stream (code 12)
  * Add rsync-fix-external-compression.patch [bsc#1190828]</changelog>
  <changelog author="psimons@suse.com" date="1660564800">- Apply "rsync-CVE-2022-29154.patch" to fix a security vulnerability
  in the do_server_recv() function. [bsc#1201840, CVE-2022-29154]</changelog>
</package>
<package pkgid="02bfdc78a6df60162ae67656c0f2d1dbfacdf6dfa3736268988fc5b26621da80" name="rsync" arch="x86_64">
  <version epoch="0" ver="3.1.3" rel="150000.4.13.1"/>
  <changelog author="vcizek@suse.com" date="1439294400">- reintroduce "use slp" directive (bsc#922710)
  * added rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444132800">- add a compatibility flag to avoid checksum collisions (bsc#900914)
  * fixes rsync equivalent of librsync's CVE-2014-8242
  * added rsync-equivalent_of_CVE-2014-8242.patch
- modify rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444219200">- better disable slp by default, it doesn't seem to be used much
  and it often caused problems (eg boo#898513, bsc#922710)
  * set "use slp" in rsyncd.conf to enable
  * modified rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="hsk@imb-jena.de" date="1452081600">- update to 3.1.2
- drop patches rsync-CVE-2014-9512.patch,
  rsync-equivalent_of_CVE-2014-8242.patch (applied upstream)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- We no longer need to inject the pid in post as we do not use
  the iniscript relying on it
- Add socket activation service instead of the xinetd service
- Verify in services the configuration to run actually exist
- Drop sle11 support as it does not autoreconf anymore
- Drop patch system-zlib.diff that was never applied
- Switch to system popt and zlib:
  * This should not cause issues now because upstream states the
    underlying issue why we used the bundled one was fixed by
    using more safeguarded error detection</changelog>
  <changelog author="tchvatal@suse.com" date="1499947200">- Add patch to build with both bundled and external zlib to support
  both compression methods at once bsc#1046197:
  * rsync-both-compressions.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1500897600">- Refresh patch rsync-both-compressions.patch to include
  fix when using old-compress on new zlib on server too</changelog>
  <changelog author="tchvatal@suse.com" date="1500897601">- Execute tests to ensure the basics are still working</changelog>
  <changelog author="tchvatal@suse.com" date="1500984000">- Try more in supporting all scenarios bsc#1046197#c24
  * rsync-both-compressions.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1511870400">- Security fix [bsc#1066644, CVE-2017-16548]
  * Missing trailing '\0' character check could lead to remote DoS
  * Added rsync-CVE-2017-16548.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515499200">- Fix: Stop file upload after errors [bsc#1062063]
- Added patches:
  * rsync-send_error_to_sender.patch
  * rsync-avoid-uploading-after-error.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1516276800">- Security fix: Ignore --protect-args when already sent by client
  [bsc#1076503, CVE-2018-5764]
  * Added patch rsync-3.1.2-CVE-2018-5764.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1517227200">- Update to version 3.1.3 [bsc#1076503]:
  Protocol: 31 (unchanged)
- SECURITY FIXES:
  * Fixed a buffer overrun in the protocol's handling of xattr names and
    ensure that the received name is null terminated.
  * Fix an issue with --protect-args where the user could specify the arg
    in the protected-arg list and short-circuit some of the arg-sanitizing
    code.
- BUG FIXES:
  * Don't output about a new backup dir without appropriate info verbosity.
  * Fixed some issues with the sort functions in support/rsyncstats script.
  * Added a way to specify daemon config lists (e.g. users, groups, etc)
  * that contain spaces (see "auth users" in the latest rsyncd.conf manpage).
  * If a backup fails (e.g. full disk) rsync exits with an error.
  * Fixed a problem with a doubled --fuzzy option combined with --link-dest.
  * Avoid invalid output in the summary if either the start or end time had
    an error.
  * We don't allow a popt alias to affect the --daemon or --server options.
  * Fix daemon exclude code to disallow attribute changes in addition to
    disallowing transfers.
  * Don't force nanoseconds to match if a non-transferred, non-checksummed
    file only passed the quick-check w/o comparing nanosecods.
- ENHANCEMENTS:
  * Added the ability for rsync to compare nanosecond times in its
    file-check
    comparisons, and added support nanosecond times on Mac OS X.
  * Added a short-option (-@) for --modify-window.
  * Added the --checksum-choice=NAME[,NAME] option to choose the checksum
    algorithms.
  * Added hashing of xattr names (with using -X) to improve the handling of
    files with large numbers of xattrs.
  * Added a way to filter xattr names using include/exclude/filter rules
    (see the --xattrs option in the manpage for details).
  * Added "daemon chroot|uid|gid" to the daemon config (in addition to the
    old chroot|uid|gid settings that affect the daemon's transfer process).
  * Added "syslog tag" to the daemon configuration.
  * Some manpage improvements.
- DEVELOPER RELATED:
  * Tweak the "make" output when yodl isn't around to create the man pages.
  * Changed an obsolete autoconf compile macro.
  * Support newer yodl versions when converting man pages.
- Dropped patches fixed upstream:
  * rsync-CVE-2017-16548.patch
  * rsync-3.1.2-CVE-2018-5764.patch
- Refreshed patches:
  * rsync-send_error_to_sender.patch</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kukuk@suse.de" date="1531310400">- Don't require systemd explicit, spec file can handle both cases
  correct and in containers we don't have systemd [bsc#1100786].</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1555156800">- Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1555329600">- Fixed bug numbers in spec file</changelog>
  <changelog author="pmonreal@suse.com" date="1631793600">- Fix a segmentation fault in iconv [bsc#1188258]
  * Add rsync-iconv-segfault.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637064000">- Fixed an error when using the external compression library
  where files larger that 1GB would not be transferred completely
  and failing with error:
  - deflate on token returned 0 (XXX bytes left)
  - rsync error: error in rsync protocol data stream (code 12)
  * Add rsync-fix-external-compression.patch [bsc#1190828]</changelog>
  <changelog author="psimons@suse.com" date="1660564800">- Apply "rsync-CVE-2022-29154.patch" to fix a security vulnerability
  in the do_server_recv() function. [bsc#1201840, CVE-2022-29154]</changelog>
</package>
<package pkgid="ff02f5c4e4e902951e2bda815aef9c741c47c99532e3efc9998dc410304acbf3" name="rsync" arch="aarch64">
  <version epoch="0" ver="3.1.3" rel="150000.4.18.1"/>
  <changelog author="vcizek@suse.com" date="1444132800">- add a compatibility flag to avoid checksum collisions (bsc#900914)
  * fixes rsync equivalent of librsync's CVE-2014-8242
  * added rsync-equivalent_of_CVE-2014-8242.patch
- modify rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444219200">- better disable slp by default, it doesn't seem to be used much
  and it often caused problems (eg boo#898513, bsc#922710)
  * set "use slp" in rsyncd.conf to enable
  * modified rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="hsk@imb-jena.de" date="1452081600">- update to 3.1.2
- drop patches rsync-CVE-2014-9512.patch,
  rsync-equivalent_of_CVE-2014-8242.patch (applied upstream)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- We no longer need to inject the pid in post as we do not use
  the iniscript relying on it
- Add socket activation service instead of the xinetd service
- Verify in services the configuration to run actually exist
- Drop sle11 support as it does not autoreconf anymore
- Drop patch system-zlib.diff that was never applied
- Switch to system popt and zlib:
  * This should not cause issues now because upstream states the
    underlying issue why we used the bundled one was fixed by
    using more safeguarded error detection</changelog>
  <changelog author="tchvatal@suse.com" date="1499947200">- Add patch to build with both bundled and external zlib to support
  both compression methods at once bsc#1046197:
  * rsync-both-compressions.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1500897600">- Refresh patch rsync-both-compressions.patch to include
  fix when using old-compress on new zlib on server too</changelog>
  <changelog author="tchvatal@suse.com" date="1500897601">- Execute tests to ensure the basics are still working</changelog>
  <changelog author="tchvatal@suse.com" date="1500984000">- Try more in supporting all scenarios bsc#1046197#c24
  * rsync-both-compressions.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1511870400">- Security fix [bsc#1066644, CVE-2017-16548]
  * Missing trailing '\0' character check could lead to remote DoS
  * Added rsync-CVE-2017-16548.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515499200">- Fix: Stop file upload after errors [bsc#1062063]
- Added patches:
  * rsync-send_error_to_sender.patch
  * rsync-avoid-uploading-after-error.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1516276800">- Security fix: Ignore --protect-args when already sent by client
  [bsc#1076503, CVE-2018-5764]
  * Added patch rsync-3.1.2-CVE-2018-5764.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1517227200">- Update to version 3.1.3 [bsc#1076503]:
  Protocol: 31 (unchanged)
- SECURITY FIXES:
  * Fixed a buffer overrun in the protocol's handling of xattr names and
    ensure that the received name is null terminated.
  * Fix an issue with --protect-args where the user could specify the arg
    in the protected-arg list and short-circuit some of the arg-sanitizing
    code.
- BUG FIXES:
  * Don't output about a new backup dir without appropriate info verbosity.
  * Fixed some issues with the sort functions in support/rsyncstats script.
  * Added a way to specify daemon config lists (e.g. users, groups, etc)
  * that contain spaces (see "auth users" in the latest rsyncd.conf manpage).
  * If a backup fails (e.g. full disk) rsync exits with an error.
  * Fixed a problem with a doubled --fuzzy option combined with --link-dest.
  * Avoid invalid output in the summary if either the start or end time had
    an error.
  * We don't allow a popt alias to affect the --daemon or --server options.
  * Fix daemon exclude code to disallow attribute changes in addition to
    disallowing transfers.
  * Don't force nanoseconds to match if a non-transferred, non-checksummed
    file only passed the quick-check w/o comparing nanosecods.
- ENHANCEMENTS:
  * Added the ability for rsync to compare nanosecond times in its
    file-check
    comparisons, and added support nanosecond times on Mac OS X.
  * Added a short-option (-@) for --modify-window.
  * Added the --checksum-choice=NAME[,NAME] option to choose the checksum
    algorithms.
  * Added hashing of xattr names (with using -X) to improve the handling of
    files with large numbers of xattrs.
  * Added a way to filter xattr names using include/exclude/filter rules
    (see the --xattrs option in the manpage for details).
  * Added "daemon chroot|uid|gid" to the daemon config (in addition to the
    old chroot|uid|gid settings that affect the daemon's transfer process).
  * Added "syslog tag" to the daemon configuration.
  * Some manpage improvements.
- DEVELOPER RELATED:
  * Tweak the "make" output when yodl isn't around to create the man pages.
  * Changed an obsolete autoconf compile macro.
  * Support newer yodl versions when converting man pages.
- Dropped patches fixed upstream:
  * rsync-CVE-2017-16548.patch
  * rsync-3.1.2-CVE-2018-5764.patch
- Refreshed patches:
  * rsync-send_error_to_sender.patch</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kukuk@suse.de" date="1531310400">- Don't require systemd explicit, spec file can handle both cases
  correct and in containers we don't have systemd [bsc#1100786].</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1555156800">- Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1555329600">- Fixed bug numbers in spec file</changelog>
  <changelog author="pmonreal@suse.com" date="1631793600">- Fix a segmentation fault in iconv [bsc#1188258]
  * Add rsync-iconv-segfault.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637064000">- Fixed an error when using the external compression library
  where files larger that 1GB would not be transferred completely
  and failing with error:
  - deflate on token returned 0 (XXX bytes left)
  - rsync error: error in rsync protocol data stream (code 12)
  * Add rsync-fix-external-compression.patch [bsc#1190828]</changelog>
  <changelog author="psimons@suse.com" date="1660564800">- Apply "rsync-CVE-2022-29154.patch" to fix a security vulnerability
  in the do_server_recv() function. [bsc#1201840, CVE-2022-29154]</changelog>
  <changelog author="david.anes@suse.com" date="1665057600">- Add support for --trust-sender parameter (patch by Jie Gong in
  bsc#1202970). (related to CVE-2022-29154, bsc#1201840)
  * Added patch rsync-CVE-2022-29154-trust-sender-1.patch
  * Added patch rsync-CVE-2022-29154-trust-sender-2.patch</changelog>
</package>
<package pkgid="dd09ad03a8ea20aa99b5ae73e05893fdcf09aa4d328ae21cb7d3e401ecd103c6" name="rsync" arch="src">
  <version epoch="0" ver="3.1.3" rel="150000.4.18.1"/>
  <changelog author="vcizek@suse.com" date="1444132800">- add a compatibility flag to avoid checksum collisions (bsc#900914)
  * fixes rsync equivalent of librsync's CVE-2014-8242
  * added rsync-equivalent_of_CVE-2014-8242.patch
- modify rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444219200">- better disable slp by default, it doesn't seem to be used much
  and it often caused problems (eg boo#898513, bsc#922710)
  * set "use slp" in rsyncd.conf to enable
  * modified rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="hsk@imb-jena.de" date="1452081600">- update to 3.1.2
- drop patches rsync-CVE-2014-9512.patch,
  rsync-equivalent_of_CVE-2014-8242.patch (applied upstream)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- We no longer need to inject the pid in post as we do not use
  the iniscript relying on it
- Add socket activation service instead of the xinetd service
- Verify in services the configuration to run actually exist
- Drop sle11 support as it does not autoreconf anymore
- Drop patch system-zlib.diff that was never applied
- Switch to system popt and zlib:
  * This should not cause issues now because upstream states the
    underlying issue why we used the bundled one was fixed by
    using more safeguarded error detection</changelog>
  <changelog author="tchvatal@suse.com" date="1499947200">- Add patch to build with both bundled and external zlib to support
  both compression methods at once bsc#1046197:
  * rsync-both-compressions.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1500897600">- Refresh patch rsync-both-compressions.patch to include
  fix when using old-compress on new zlib on server too</changelog>
  <changelog author="tchvatal@suse.com" date="1500897601">- Execute tests to ensure the basics are still working</changelog>
  <changelog author="tchvatal@suse.com" date="1500984000">- Try more in supporting all scenarios bsc#1046197#c24
  * rsync-both-compressions.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1511870400">- Security fix [bsc#1066644, CVE-2017-16548]
  * Missing trailing '\0' character check could lead to remote DoS
  * Added rsync-CVE-2017-16548.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515499200">- Fix: Stop file upload after errors [bsc#1062063]
- Added patches:
  * rsync-send_error_to_sender.patch
  * rsync-avoid-uploading-after-error.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1516276800">- Security fix: Ignore --protect-args when already sent by client
  [bsc#1076503, CVE-2018-5764]
  * Added patch rsync-3.1.2-CVE-2018-5764.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1517227200">- Update to version 3.1.3 [bsc#1076503]:
  Protocol: 31 (unchanged)
- SECURITY FIXES:
  * Fixed a buffer overrun in the protocol's handling of xattr names and
    ensure that the received name is null terminated.
  * Fix an issue with --protect-args where the user could specify the arg
    in the protected-arg list and short-circuit some of the arg-sanitizing
    code.
- BUG FIXES:
  * Don't output about a new backup dir without appropriate info verbosity.
  * Fixed some issues with the sort functions in support/rsyncstats script.
  * Added a way to specify daemon config lists (e.g. users, groups, etc)
  * that contain spaces (see "auth users" in the latest rsyncd.conf manpage).
  * If a backup fails (e.g. full disk) rsync exits with an error.
  * Fixed a problem with a doubled --fuzzy option combined with --link-dest.
  * Avoid invalid output in the summary if either the start or end time had
    an error.
  * We don't allow a popt alias to affect the --daemon or --server options.
  * Fix daemon exclude code to disallow attribute changes in addition to
    disallowing transfers.
  * Don't force nanoseconds to match if a non-transferred, non-checksummed
    file only passed the quick-check w/o comparing nanosecods.
- ENHANCEMENTS:
  * Added the ability for rsync to compare nanosecond times in its
    file-check
    comparisons, and added support nanosecond times on Mac OS X.
  * Added a short-option (-@) for --modify-window.
  * Added the --checksum-choice=NAME[,NAME] option to choose the checksum
    algorithms.
  * Added hashing of xattr names (with using -X) to improve the handling of
    files with large numbers of xattrs.
  * Added a way to filter xattr names using include/exclude/filter rules
    (see the --xattrs option in the manpage for details).
  * Added "daemon chroot|uid|gid" to the daemon config (in addition to the
    old chroot|uid|gid settings that affect the daemon's transfer process).
  * Added "syslog tag" to the daemon configuration.
  * Some manpage improvements.
- DEVELOPER RELATED:
  * Tweak the "make" output when yodl isn't around to create the man pages.
  * Changed an obsolete autoconf compile macro.
  * Support newer yodl versions when converting man pages.
- Dropped patches fixed upstream:
  * rsync-CVE-2017-16548.patch
  * rsync-3.1.2-CVE-2018-5764.patch
- Refreshed patches:
  * rsync-send_error_to_sender.patch</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kukuk@suse.de" date="1531310400">- Don't require systemd explicit, spec file can handle both cases
  correct and in containers we don't have systemd [bsc#1100786].</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1555156800">- Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1555329600">- Fixed bug numbers in spec file</changelog>
  <changelog author="pmonreal@suse.com" date="1631793600">- Fix a segmentation fault in iconv [bsc#1188258]
  * Add rsync-iconv-segfault.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637064000">- Fixed an error when using the external compression library
  where files larger that 1GB would not be transferred completely
  and failing with error:
  - deflate on token returned 0 (XXX bytes left)
  - rsync error: error in rsync protocol data stream (code 12)
  * Add rsync-fix-external-compression.patch [bsc#1190828]</changelog>
  <changelog author="psimons@suse.com" date="1660564800">- Apply "rsync-CVE-2022-29154.patch" to fix a security vulnerability
  in the do_server_recv() function. [bsc#1201840, CVE-2022-29154]</changelog>
  <changelog author="david.anes@suse.com" date="1665057600">- Add support for --trust-sender parameter (patch by Jie Gong in
  bsc#1202970). (related to CVE-2022-29154, bsc#1201840)
  * Added patch rsync-CVE-2022-29154-trust-sender-1.patch
  * Added patch rsync-CVE-2022-29154-trust-sender-2.patch</changelog>
</package>
<package pkgid="613db84741c9abd7fa5f201a75e980ab58f7e1ff821e0d82014216ec28ae41fe" name="rsync" arch="x86_64">
  <version epoch="0" ver="3.1.3" rel="150000.4.18.1"/>
  <changelog author="vcizek@suse.com" date="1444132800">- add a compatibility flag to avoid checksum collisions (bsc#900914)
  * fixes rsync equivalent of librsync's CVE-2014-8242
  * added rsync-equivalent_of_CVE-2014-8242.patch
- modify rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="vcizek@suse.com" date="1444219200">- better disable slp by default, it doesn't seem to be used much
  and it often caused problems (eg boo#898513, bsc#922710)
  * set "use slp" in rsyncd.conf to enable
  * modified rsync-add_back_use_slp_directive.patch</changelog>
  <changelog author="hsk@imb-jena.de" date="1452081600">- update to 3.1.2
- drop patches rsync-CVE-2014-9512.patch,
  rsync-equivalent_of_CVE-2014-8242.patch (applied upstream)</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- We no longer need to inject the pid in post as we do not use
  the iniscript relying on it
- Add socket activation service instead of the xinetd service
- Verify in services the configuration to run actually exist
- Drop sle11 support as it does not autoreconf anymore
- Drop patch system-zlib.diff that was never applied
- Switch to system popt and zlib:
  * This should not cause issues now because upstream states the
    underlying issue why we used the bundled one was fixed by
    using more safeguarded error detection</changelog>
  <changelog author="tchvatal@suse.com" date="1499947200">- Add patch to build with both bundled and external zlib to support
  both compression methods at once bsc#1046197:
  * rsync-both-compressions.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1500897600">- Refresh patch rsync-both-compressions.patch to include
  fix when using old-compress on new zlib on server too</changelog>
  <changelog author="tchvatal@suse.com" date="1500897601">- Execute tests to ensure the basics are still working</changelog>
  <changelog author="tchvatal@suse.com" date="1500984000">- Try more in supporting all scenarios bsc#1046197#c24
  * rsync-both-compressions.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1511870400">- Security fix [bsc#1066644, CVE-2017-16548]
  * Missing trailing '\0' character check could lead to remote DoS
  * Added rsync-CVE-2017-16548.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1515499200">- Fix: Stop file upload after errors [bsc#1062063]
- Added patches:
  * rsync-send_error_to_sender.patch
  * rsync-avoid-uploading-after-error.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1516276800">- Security fix: Ignore --protect-args when already sent by client
  [bsc#1076503, CVE-2018-5764]
  * Added patch rsync-3.1.2-CVE-2018-5764.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1517227200">- Update to version 3.1.3 [bsc#1076503]:
  Protocol: 31 (unchanged)
- SECURITY FIXES:
  * Fixed a buffer overrun in the protocol's handling of xattr names and
    ensure that the received name is null terminated.
  * Fix an issue with --protect-args where the user could specify the arg
    in the protected-arg list and short-circuit some of the arg-sanitizing
    code.
- BUG FIXES:
  * Don't output about a new backup dir without appropriate info verbosity.
  * Fixed some issues with the sort functions in support/rsyncstats script.
  * Added a way to specify daemon config lists (e.g. users, groups, etc)
  * that contain spaces (see "auth users" in the latest rsyncd.conf manpage).
  * If a backup fails (e.g. full disk) rsync exits with an error.
  * Fixed a problem with a doubled --fuzzy option combined with --link-dest.
  * Avoid invalid output in the summary if either the start or end time had
    an error.
  * We don't allow a popt alias to affect the --daemon or --server options.
  * Fix daemon exclude code to disallow attribute changes in addition to
    disallowing transfers.
  * Don't force nanoseconds to match if a non-transferred, non-checksummed
    file only passed the quick-check w/o comparing nanosecods.
- ENHANCEMENTS:
  * Added the ability for rsync to compare nanosecond times in its
    file-check
    comparisons, and added support nanosecond times on Mac OS X.
  * Added a short-option (-@) for --modify-window.
  * Added the --checksum-choice=NAME[,NAME] option to choose the checksum
    algorithms.
  * Added hashing of xattr names (with using -X) to improve the handling of
    files with large numbers of xattrs.
  * Added a way to filter xattr names using include/exclude/filter rules
    (see the --xattrs option in the manpage for details).
  * Added "daemon chroot|uid|gid" to the daemon config (in addition to the
    old chroot|uid|gid settings that affect the daemon's transfer process).
  * Added "syslog tag" to the daemon configuration.
  * Some manpage improvements.
- DEVELOPER RELATED:
  * Tweak the "make" output when yodl isn't around to create the man pages.
  * Changed an obsolete autoconf compile macro.
  * Support newer yodl versions when converting man pages.
- Dropped patches fixed upstream:
  * rsync-CVE-2017-16548.patch
  * rsync-3.1.2-CVE-2018-5764.patch
- Refreshed patches:
  * rsync-send_error_to_sender.patch</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kukuk@suse.de" date="1531310400">- Don't require systemd explicit, spec file can handle both cases
  correct and in containers we don't have systemd [bsc#1100786].</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1555156800">- Add patch: rsync-fix-prealloc-to-keep-file-size-0-when-possible.patch (boo#1108562)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1555329600">- Fixed bug numbers in spec file</changelog>
  <changelog author="pmonreal@suse.com" date="1631793600">- Fix a segmentation fault in iconv [bsc#1188258]
  * Add rsync-iconv-segfault.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1637064000">- Fixed an error when using the external compression library
  where files larger that 1GB would not be transferred completely
  and failing with error:
  - deflate on token returned 0 (XXX bytes left)
  - rsync error: error in rsync protocol data stream (code 12)
  * Add rsync-fix-external-compression.patch [bsc#1190828]</changelog>
  <changelog author="psimons@suse.com" date="1660564800">- Apply "rsync-CVE-2022-29154.patch" to fix a security vulnerability
  in the do_server_recv() function. [bsc#1201840, CVE-2022-29154]</changelog>
  <changelog author="david.anes@suse.com" date="1665057600">- Add support for --trust-sender parameter (patch by Jie Gong in
  bsc#1202970). (related to CVE-2022-29154, bsc#1201840)
  * Added patch rsync-CVE-2022-29154-trust-sender-1.patch
  * Added patch rsync-CVE-2022-29154-trust-sender-2.patch</changelog>
</package>
<package pkgid="7ce49997e2b12472f7d66bccae27414eac540d7688720598cdeb90bac6f0d667" name="runc" arch="aarch64">
  <version epoch="0" ver="1.1.4" rel="150000.33.4"/>
  <changelog author="asarai@suse.com" date="1593691200">- Upgrade to runc v1.0.0~rc91. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91
  * This release of runc has experimental support for cgroupv2-only systems.
- Remove upstreamed patches:
  - bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
  - bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch</changelog>
  <changelog author="rhafer@suse.com" date="1598616000">- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available
  from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  * Updates to CRIU support.
  * Improvements to cgroupfs performance and correctness.</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal. bsc#1181677
- Modernise go building for runc now that it has go.mod.</changelog>
  <changelog author="asarai@suse.com" date="1612353600">- Update to runc v1.0.0~rc93. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93
  bsc#1182451 bsc#1184962
  * Cgroupv2 support is no longer considered experimental.
  * Mountinfo parsing code has been reworked significantly.
  * Special ENOSYS handling for seccomp profiles to avoid making new
    syscalls unusable for glibc.
  * Various rootless containers improvements.
  * The "selinux" and "apparmor" buildtags have been removed, and now all runc
    builds will have SELinux and AppArmor support enabled.</changelog>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has?exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
</package>
<package pkgid="250593fb20d03378cc990b81ef195d2138cd98c592acbd33338d17fc63c67245" name="runc" arch="src">
  <version epoch="0" ver="1.1.4" rel="150000.33.4"/>
  <changelog author="asarai@suse.com" date="1593691200">- Upgrade to runc v1.0.0~rc91. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91
  * This release of runc has experimental support for cgroupv2-only systems.
- Remove upstreamed patches:
  - bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
  - bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch</changelog>
  <changelog author="rhafer@suse.com" date="1598616000">- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available
  from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  * Updates to CRIU support.
  * Improvements to cgroupfs performance and correctness.</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal. bsc#1181677
- Modernise go building for runc now that it has go.mod.</changelog>
  <changelog author="asarai@suse.com" date="1612353600">- Update to runc v1.0.0~rc93. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93
  bsc#1182451 bsc#1184962
  * Cgroupv2 support is no longer considered experimental.
  * Mountinfo parsing code has been reworked significantly.
  * Special ENOSYS handling for seccomp profiles to avoid making new
    syscalls unusable for glibc.
  * Various rootless containers improvements.
  * The "selinux" and "apparmor" buildtags have been removed, and now all runc
    builds will have SELinux and AppArmor support enabled.</changelog>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has?exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
</package>
<package pkgid="10936b0021f842837f44e096e01853defab57478ad5df5d99ad70474be0ccfce" name="runc" arch="x86_64">
  <version epoch="0" ver="1.1.4" rel="150000.33.4"/>
  <changelog author="asarai@suse.com" date="1593691200">- Upgrade to runc v1.0.0~rc91. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc91
  * This release of runc has experimental support for cgroupv2-only systems.
- Remove upstreamed patches:
  - bsc1149954-0001-sd-notify-do-not-hang-when-NOTIFY_SOCKET-is-used-wit.patch
  - bsc1168481-0001-cgroup-devices-major-cleanups-and-minimal-transition.patch</changelog>
  <changelog author="rhafer@suse.com" date="1598616000">- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available
  from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  * Updates to CRIU support.
  * Improvements to cgroupfs performance and correctness.</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal. bsc#1181677
- Modernise go building for runc now that it has go.mod.</changelog>
  <changelog author="asarai@suse.com" date="1612353600">- Update to runc v1.0.0~rc93. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93
  bsc#1182451 bsc#1184962
  * Cgroupv2 support is no longer considered experimental.
  * Mountinfo parsing code has been reworked significantly.
  * Special ENOSYS handling for seccomp profiles to avoid making new
    syscalls unusable for glibc.
  * Various rootless containers improvements.
  * The "selinux" and "apparmor" buildtags have been removed, and now all runc
    builds will have SELinux and AppArmor support enabled.</changelog>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has?exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
</package>
<package pkgid="136bd19888457f174303c66ef1770a28b4c80c5ddb4fee3f6ea08f793e5bdf0e" name="runc" arch="aarch64">
  <version epoch="0" ver="1.1.4" rel="150000.36.1"/>
  <changelog author="rhafer@suse.com" date="1598616000">- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available
  from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  * Updates to CRIU support.
  * Improvements to cgroupfs performance and correctness.</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal. bsc#1181677
- Modernise go building for runc now that it has go.mod.</changelog>
  <changelog author="asarai@suse.com" date="1612353600">- Update to runc v1.0.0~rc93. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93
  bsc#1182451 bsc#1184962
  * Cgroupv2 support is no longer considered experimental.
  * Mountinfo parsing code has been reworked significantly.
  * Special ENOSYS handling for seccomp profiles to avoid making new
    syscalls unusable for glibc.
  * Various rootless containers improvements.
  * The "selinux" and "apparmor" buildtags have been removed, and now all runc
    builds will have SELinux and AppArmor support enabled.</changelog>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has?exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="fvogt@suse.com" date="1661947201">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
</package>
<package pkgid="a1507a6a946771fa207276993090be987522d2e71d3cfb6605c9da01999c6702" name="runc" arch="src">
  <version epoch="0" ver="1.1.4" rel="150000.36.1"/>
  <changelog author="rhafer@suse.com" date="1598616000">- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available
  from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  * Updates to CRIU support.
  * Improvements to cgroupfs performance and correctness.</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal. bsc#1181677
- Modernise go building for runc now that it has go.mod.</changelog>
  <changelog author="asarai@suse.com" date="1612353600">- Update to runc v1.0.0~rc93. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93
  bsc#1182451 bsc#1184962
  * Cgroupv2 support is no longer considered experimental.
  * Mountinfo parsing code has been reworked significantly.
  * Special ENOSYS handling for seccomp profiles to avoid making new
    syscalls unusable for glibc.
  * Various rootless containers improvements.
  * The "selinux" and "apparmor" buildtags have been removed, and now all runc
    builds will have SELinux and AppArmor support enabled.</changelog>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has?exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="fvogt@suse.com" date="1661947201">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
</package>
<package pkgid="e1764a30d562c6276b241b449334eb25a274a20dc059d9755108f7351b2afe4e" name="runc" arch="x86_64">
  <version epoch="0" ver="1.1.4" rel="150000.36.1"/>
  <changelog author="rhafer@suse.com" date="1598616000">- Upgrade to runc v1.0.0~rc92 (bsc#1175821). Upstream changelog is available
  from https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  * Updates to CRIU support.
  * Improvements to cgroupfs performance and correctness.</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal. bsc#1181677
- Modernise go building for runc now that it has go.mod.</changelog>
  <changelog author="asarai@suse.com" date="1612353600">- Update to runc v1.0.0~rc93. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc93
  bsc#1182451 bsc#1184962
  * Cgroupv2 support is no longer considered experimental.
  * Mountinfo parsing code has been reworked significantly.
  * Special ENOSYS handling for seccomp profiles to avoid making new
    syscalls unusable for glibc.
  * Various rootless containers improvements.
  * The "selinux" and "apparmor" buildtags have been removed, and now all runc
    builds will have SELinux and AppArmor support enabled.</changelog>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has?exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="fvogt@suse.com" date="1661947201">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
</package>
<package pkgid="73e2694405deec5c225af8cb80644a54cf46b3055766ea778b1e1097503ff39a" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="07c417f4cf4f7b04c9bdbf679d673268c032dde14f3a89eb5bdbd89607d61bf7" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="582cd74772bfb6ea74402e1d48ba6737b3ce0135b1521787f1aaa164b27ec0dd" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="dc45b67866a300407a24650b7f88e4a3c9637933b455199a7d7225fc3d056156" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="a726304c5cae587c7af161dc22114b4df22fa87cdffdba5a1ecc07489faafe3d" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="55c010d039e331714530458f9f15127c3707df6bd7e4b8e8baa4a2eeda161dee" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="d599f218a07c5d7912f7b44254f84ab4ce9233f8db921ecf008708d4d27e9d31" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="c9edfae7df51cbf8484a8c85a1f465eb7ff52f03d9ca70e7819a75ba0b699eed" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="54274a3341328b3e6f86806b1b9dcc0473e9c4081dc278d34f1a1e9fe440016a" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="4bf7ef325a8c663a261b8d4c58c1139ec548dd213e9fb67d0fa7a8e0359f04e8" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="587c13a42e968275275582c3197b2642eb8eb11644bbda2767e0c08cb41d5774" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="9ee6c3b295f4376c9f02a9bc265af2e9bac32c290239fbf91e8e11e8bc9d92e7" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="02b3a8aba129a64088faa3e16ed880adae4effbcd4b204fdcf819ac3279db78f" name="salt" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="35df751719c3eb923ad6b3b1f3b62c2a2e9c4acaa068d0d37e7e120d768b7975" name="salt" arch="src">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="cc2663bea357e68e27c6078521cc0c2781f281251027bf9aba8c76a6cbc10acc" name="salt" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="4046f78850cac3870ed283c8ebcf65bf9e207df7934283bd1cf4586ff43db0c7" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="874c4c8b53a6016d23a24ffd46b28f38e12eb9628294ee27fbcdcde69804897b" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="bca3ce8374961c73c1087e92b284ef5f3d85b853e25b178bbc68ae4721407b0c" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="32d3bb4961af829ee9f278abb219c2504211e4ef4148fd3567bd3fa16aaddc6e" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="1e9151328de5d513a23b0db8af7a40c7a66e5a27067f490b2ccd6b5da911c73a" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="33c40c74c728b0f55d94d99366b1052af1ca7e0c21c0d60a0c5f503370d4696d" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="f78832da573a5a1378a222ed27ffb6032bb2fd8db2fa8cf5d4c0328dbd4ac09e" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="ea677d467eef89b424c70dd16f28c9a8943a7e5b30d689ecb2cf702b79ab2037" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="f6fcc51e1722fb6f4c69e1b1a8961156808f84dec6fd8c53a047b72cb295139a" name="salt-minion" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="dfefa769075f20fc9e820331649df3cb7a4df25b81680f99f15b32eac82e7782" name="salt-minion" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="18f8d4ea5ed90070aaa7c0f14ce54575efd52c9c4cf14bfe90162efb7ecdd69a" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="8ccdf5b0b28661a676aefec67c4988c9a12c76ea2e40085af71c8390cdb55136" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.24.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Revert wrong zypper patch to support vendorchanges flags on pkg.install
- Added:
  * revert-add-patch-support-for-allow-vendor-change-opt.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539201">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix for CVE-2022-22967 (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
</package>
<package pkgid="c954045d04d08a15b0233c31e959d4f680ead907f29bb0eed52aef2a21c1e7f8" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="b673bd424f8dc9f39c09dac6ed38fb9e615a885ead0108b7d843ef0dbf8825dd" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.27.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1610539200">- Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing
- Added:
  * remove-deprecated-warning-that-breaks-miniion-execut.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
</package>
<package pkgid="473a99194909f70f5b8bc5e3dfe4189355684398474f2e2b70c68a729f4340cb" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="c9e2fe267ebc9bfce3440cfc4596bca975953bd034d7c071021dc5360acc1d8f" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.30.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1613131200">- virt: search for grub.xen path
- Xen spicevmc, DNS SRV records backports:
  Fix virtual network generated DNS XML for SRV records
  Don't add spicevmc channel to xen VMs
- virt UEFI fix: virt.update when efi=True
- Do not crash when unexpected cmd output at listing patches (bsc#1181290)
- Fix behavior for "onlyif/unless" when multiple conditions (bsc#1180818)
- Added:
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * open-suse-3002.2-xen-grub-316.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * virt-uefi-fix-backport-312.patch</changelog>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
</package>
<package pkgid="bcfe7a7daa92ae3443902f6f3843e3deac6cc6f1b96f62e42243037f28c87566" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="541ef9872b262ad6b83de298460ed560aef5fd85638a516c7c6a5ee352bec95f" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.33.6"/>
  <changelog author="alexander.graul@suse.com" date="1614600000">- Allow extra_filerefs as sanitized kwargs for SSH client
- Fix regression on cmd.run when passing tuples as cmd (bsc#1182740)
- Fix for multiple for security issues
  (CVE-2020-28243) (CVE-2020-28972) (CVE-2020-35662) (CVE-2021-3148) (CVE-2021-3144)
  (CVE-2021-25281) (CVE-2021-25282) (CVE-2021-25283) (CVE-2021-25284) (CVE-2021-3197)
  (bsc#1181550) (bsc#1181556) (bsc#1181557) (bsc#1181558) (bsc#1181559) (bsc#1181560)
  (bsc#1181561) (bsc#1181562) (bsc#1181563) (bsc#1181564) (bsc#1181565)
- Implementation of suse_ip execution module to prevent issues with network.managed (bsc#1099976)
- Add sleep on exception handling on minion connection attempt to the master (bsc#1174855)
- Allows for the VMware provider to handle CPU and memory hot-add in newer versions of the software. (bsc#1181347)
- Always require python-certifi (used by salt.ext.tornado)
- Bring missing part of async batch implementation back (bsc#1182382) (CVE-2021-25315)
- Always require python3-distro (bsc#1182293)
- Added:
  * async-batch-implementation-fix-320.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * fix-for-some-cves-bsc1181550.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * add-sleep-on-exception-handling-on-minion-connection.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
</package>
<package pkgid="a55c8f896e17bd2fca2d77c5ae30aeef2133ce667f79e4f1f4c8a8175a1860a0" name="salt-transactional-update" arch="aarch64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="f00dfbbda12f7a95b56705b4160a7b9c407296eb88fd4383b9a6df18828f7ea5" name="salt-transactional-update" arch="x86_64">
  <version epoch="0" ver="3004" rel="150300.53.36.1"/>
  <changelog author="pablo.suarezhernandez@suse.com" date="1615377600">- virt.network_update: handle missing ipv4 netmask attribute
- Set distro requirement to oldest supported version in requirements/base.txt
- Do not monkey patch yaml loaders: Prevent breaking Ansible filter modules (bsc#1177474)
- Don't require python3-certifi
- Fix race conditions for corner cases when handling SIGTERM by minion (bsc#1172110)
- Added:
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618315200">- Regression fix of salt-ssh on processing some targets
- Add support for Alibaba Cloud Linux 2 (Aliyun Linux)
- Update target fix for salt-ssh to process targets list (bsc#1179831)
- Add notify beacon for Debian/Ubuntu systems
- Add core grains support for AlmaLinux and Alibaba Could Linux
- Allow vendor change option with zypper
- Added:
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * notify-beacon-for-debian-ubuntu-systems-347.patch
  * allow-vendor-change-option-with-zypper-313.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1618920000">- Improvements on "ansiblegate" module (bsc#1185092):
  * New methods: ansible.targets / ansible.discover_playbooks
  * General bugfixes
- Added:
  * improvements-on-ansiblegate-module-354.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1620734400">- Drop support for Python2. Obsoletes "python2-salt" package (jsc#SLE-18033)
- Fix issue parsing errors in ansiblegate state module
- Prevent command injection in the snapper module (bsc#1185281) (CVE-2021-31607)
- transactional_update: detect recursion in the executor
- Add subpackage salt-transactional-update (jsc#SLE-18028)
- Remove duplicate directories
- Added:
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * transactional_update-detect-recursion-in-the-executo.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1622548800">- Check if dpkgnotify is executable (bsc#1186674)
- Added:
  * check-if-dpkgnotify-is-executable-bsc-1186674-376.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1626868800">- Do noop for services states when running systemd in offline mode (bsc#1187787)
- transactional_updates: do not execute states in parallel but use a queue (bsc#1188170)
- Handle "master tops" data when states are applied by "transactional_update" (bsc#1187787)
- Enhance openscap module: add "xccdf_eval" call
- virt: pass emulator when getting domain capabilities from libvirt
- Adding preliminary support for Rocky Linux
- Implementation of held/unheld functions for state pkg (bsc#1187813)
- Replace deprecated Thread.isAlive() with Thread.is_alive()
- Fix exception in yumpkg.remove for not installed package
- Fix save for iptables state module (bsc#1185131)
- virt: use /dev/kvm to detect KVM
- zypperpkg: improve logic for handling vendorchange flags
- Add bundled provides for tornado to the spec file
- Enhance logging when inotify beacon is missing pyinotify (bsc#1186310)
- Add "python3-pyinotify" as a recommended package for Salt in SUSE/OpenSUSE distros
- Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
- Detect Python version to use inside container (bsc#1167586) (bsc#1164192)
- Handle volumes on stopped pools in virt.vm_info (bsc#1186287)
- grains.extra: support old non-intel kernels (bsc#1180650)
- Fix missing minion returns in batch mode (bsc#1184659)
- Parsing Epoch out of version provided during pkg remove (bsc#1173692)
- Added:
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * backport-thread.is_alive-fix-390.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * enhance-logging-when-inotify-beacon-is-missing-pyino.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * fix-missing-minion-returns-in-batch-mode-360.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch</changelog>
  <changelog author="victor.zhestkov@suse.com" date="1630497600">- Fix wrong relative paths resolution with Jinja renderer when importing subdirectories
- Don't pass shell="/sbin/nologin" to onlyif/unless checks (bsc#1188259)
- Add missing aarch64 to rpm package architectures
- Backport of upstream PR#59492
- Fix failing unit test for systemd
- Fix error handling in openscap module (bsc#1188647)
- Better handling of bad public keys from minions (bsc#1189040)
- Define license macro as doc in spec file if not existing
- Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327)
- Added:
  * fix-failing-unit-tests-for-systemd.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * don-t-use-shell-sbin-nologin-in-requisites.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1633694400">- Support querying for JSON data in external sql pillar
- Exclude the full path of a download URL to prevent injection of
  malicious code (bsc#1190265) (CVE-2021-21996)
- Added:
  * 3002.2-postgresql-json-support-in-pillar-424.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1637150400">- Use dnfnotify instead yumnotify for relevant distros
- Remove wrong _parse_cpe_name from grains.core
- dnfnotify pkgset plugin implementation
- Add rpm_vercmp python library support for version comparison
- Prevent pkg plugins errors on missing cookie path (bsc#1186738)
- Fix ip6_interface grain to not leak secondary IPv4 aliases (bsc#1191412)
- Make "salt-api" package to require python3-cherrypy on RHEL systems
- tar is required by minion on transactional-update system
- Do not consider skipped targets as failed for ansible.playbooks state (bsc#1190446)
- Fix traceback.*_exc() calls
- Added:
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * fix-traceback.-_exc-calls-429.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1643889600">- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "transactional_update" module to not use SSH wrapper and allow more flexible execution
- Add "--no-return-event" option to salt-call to prevent sending return event back to master.
- Make "state.highstate" to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648036800">- Fix multiple security issues (bsc#1197417)
  * Sign authentication replies to prevent MiTM (CVE-2022-22935)
  * Sign pillar data to prevent MiTM attacks. (CVE-2022-22934)
  * Prevent job and fileserver replays (CVE-2022-22936)
  * Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941)
- Added:
  * patch_for_cve_bsc1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1648814400">- Fix salt-ssh opts poisoning (bsc#1197637)
- Clear network interfaces cache on grains request (bsc#1196050)
- Add salt-ssh with Salt Bundle support (venv-salt-minion)
- (bsc#1182851, bsc#1196432)
- Remove duplicated method definitions in salt.netapi
- Restrict "state.orchestrate_single" to pass a pillar value if it exists (bsc#1194632)
- Added:
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
- Renamed:
  * patch_for_cve_bsc1197417.patch -&gt; fix-multiple-security-issues-bsc-1197417.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1649764800">- Fix regression preventing bootstrapping new clients caused by
  redundant dependency on psutil (bsc#1197533)
- Prevent data pollution between actions proceesed at the same time (bsc#1197637)
- Added:
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1651665600">- Update to version 3004 (jsc#SLE-24223) (jsc#SLE-23672)
  * See release notes: https://docs.saltproject.io/en/master/topics/releases/3004.html
- Expose missing "ansible" module functions in Salt 3004 (bsc#1195625)
- Fixes for Python 3.10
- Fix issues found around pre_flight_script_args
- Fix salt-call event.send with pillar or grains
- Fix exception in batch_async caused by a bad function call
- Fix print regression for yumnotify plugin
- Fix issues with salt-ssh's extra-filerefs
- Fix crash when calling manage.not_alive runners
- Added:
  * add-missing-ansible-module-functions-to-whitelist-in.patch
  * drop-serial-from-event.unpack-in-cli.batch_async.patch
  * fix-crash-when-calling-manage.not_alive-runners.patch
  * fix-issues-with-salt-ssh-s-extra-filerefs.patch
  * fix-salt-call-event.send-call-with-grains-and-pillar.patch
  * fix-the-regression-for-yumnotify-plugin-456.patch
  * fixes-for-python-3.10-502.patch
  * prevent-shell-injection-via-pre_flight_script_args-4.patch
- Modified:
  * add-custom-suse-capabilities-as-grains.patch
  * add-environment-variable-to-know-if-yum-is-invoked-f.patch
  * add-migrated-state-and-gpg-key-management-functions-.patch
  * add-rpm_vercmp-python-library-for-version-comparison.patch
  * adds-explicit-type-cast-for-port.patch
  * async-batch-implementation.patch
  * debian-info_installed-compatibility-50453.patch
  * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch
  * do-not-crash-when-unexpected-cmd-output-at-listing-p.patch
  * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch
  * early-feature-support-config.patch
  * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch
  * enhance-openscap-module-add-xccdf_eval-call-386.patch
  * fix-bsc-1065792.patch
  * fix-exception-in-yumpkg.remove-for-not-installed-pac.patch
  * fix-ip6_interface-grain-to-not-leak-secondary-ipv4-a.patch
  * fix-multiple-security-issues-bsc-1197417.patch
  * fix-regression-with-depending-client.ssh-on-psutil-b.patch
  * fix-wrong-test_mod_del_repo_multiline_values-test-af.patch
  * fixes-56144-to-enable-hotadd-profile-support.patch
  * implementation-of-held-unheld-functions-for-state-pk.patch
  * implementation-of-suse_ip-execution-module-bsc-10999.patch
  * improvements-on-ansiblegate-module-354.patch
  * include-aliases-in-the-fqdns-grains.patch
  * info_installed-works-without-status-attr-now.patch
  * make-aptpkg.list_repos-compatible-on-enabled-disable.patch
  * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch
  * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch
  * refactor-and-improvements-for-transactional-updates-.patch
  * restore-default-behaviour-of-pkg-list-return.patch
  * return-the-expected-powerpc-os-arch-bsc-1117995.patch
  * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch
  * run-salt-master-as-dedicated-salt-user.patch
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * switch-firewalld-state-to-use-change_interface.patch
  * temporary-fix-extend-the-whitelist-of-allowed-comman.patch
  * update-target-fix-for-salt-ssh-to-process-targets-li.patch
  * use-adler32-algorithm-to-compute-string-checksums.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * x509-fixes-111.patch
  * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch
- Removed:
  * 3002-set-distro-requirement-to-oldest-supported-vers.patch
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-xen-spicevmc-dns-srv-records-backports-314.patch
  * accumulated-changes-from-yomi-167.patch
  * accumulated-changes-required-for-yomi-165.patch
  * add-alibaba-cloud-linux-2-by-backporting-upstream-s-.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * add-all_versions-parameter-to-include-all-installed-.patch
  * add-almalinux-and-alibaba-cloud-linux-to-the-os-fami.patch
  * add-astra-linux-common-edition-to-the-os-family-list.patch
  * add-batch_presence_ping_timeout-and-batch_presence_p.patch
  * add-cpe_name-for-osversion-grain-parsing-u-49946.patch
  * add-docker-logout-237.patch
  * add-hold-unhold-functions.patch
  * add-missing-aarch64-to-rpm-package-architectures-405.patch
  * add-multi-file-support-and-globbing-to-the-filetree-.patch
  * add-new-custom-suse-capability-for-saltutil-state-mo.patch
  * add-patch-support-for-allow-vendor-change-option-wit.patch
  * add-pkg.services_need_restart-302.patch
  * add-saltssh-multi-version-support-across-python-inte.patch
  * add-supportconfig-module-for-remote-calls-and-saltss.patch
  * add-virt.all_capabilities.patch
  * adding-preliminary-support-for-rocky.-59682-391.patch
  * allow-extra_filerefs-as-sanitized-kwargs-for-ssh-cli.patch
  * allow-passing-kwargs-to-pkg.list_downloaded-bsc-1140.patch
  * ansiblegate-take-care-of-failed-skipped-and-unreacha.patch
  * apply-patch-from-upstream-to-support-python-3.8.patch
  * async-batch-implementation-fix-320.patch
  * avoid-traceback-when-http.query-request-cannot-be-pe.patch
  * backport-a-few-virt-prs-272.patch
  * backport-of-upstream-pr59492-to-3002.2-404.patch
  * backport-thread.is_alive-fix-390.patch
  * backport-virt-patches-from-3001-256.patch
  * batch-async-catch-exceptions-and-safety-unregister-a.patch
  * batch_async-avoid-using-fnmatch-to-match-event-217.patch
  * better-handling-of-bad-public-keys-from-minions-bsc-.patch
  * calculate-fqdns-in-parallel-to-avoid-blockings-bsc-1.patch
  * changed-imports-to-vendored-tornado.patch
  * clear-network-interface-cache-when-grains-are-reques.patch
  * do-noop-for-services-states-when-running-systemd-in-.patch
  * do-not-break-repo-files-with-multiple-line-values-on.patch
  * do-not-crash-when-there-are-ipv6-established-connect.patch
  * do-not-make-ansiblegate-to-crash-on-python3-minions.patch
  * do-not-monkey-patch-yaml-bsc-1177474.patch
  * do-not-raise-streamclosederror-traceback-but-only-lo.patch
  * don-t-call-zypper-with-more-than-one-no-refresh.patch
  * drop-wrong-mock-from-chroot-unit-test.patch
  * drop-wrong-virt-capabilities-code-after-rebasing-pat.patch
  * ensure-virt.update-stop_on_reboot-is-updated-with-it.patch
  * exclude-the-full-path-of-a-download-url-to-prevent-i.patch
  * fall-back-to-pymysql.patch
  * figure-out-python-interpreter-to-use-inside-containe.patch
  * fix-__mount_device-wrapper-254.patch
  * fix-a-test-and-some-variable-names-229.patch
  * fix-a-wrong-rebase-in-test_core.py-180.patch
  * fix-aptpkg-systemd-call-bsc-1143301.patch
  * fix-aptpkg.normalize_name-when-package-arch-is-all.patch
  * fix-async-batch-multiple-done-events.patch
  * fix-async-batch-race-conditions.patch
  * fix-batch_async-obsolete-test.patch
  * fix-cve-2020-25592-and-add-tests-bsc-1178319.patch
  * fix-error-handling-in-openscap-module-bsc-1188647-40.patch
  * fix-failing-unit-tests-for-batch-async.patch
  * fix-failing-unit-tests-for-systemd.patch
  * fix-for-log-checking-in-x509-test.patch
  * fix-for-some-cves-bsc1181550.patch
  * fix-for-temp-folder-definition-in-loader-unit-test.patch
  * fix-git_pillar-merging-across-multiple-__env__-repos.patch
  * fix-grains.test_core-unit-test-277.patch
  * fix-ipv6-scope-bsc-1108557.patch
  * fix-issue-parsing-errors-in-ansiblegate-state-module.patch
  * fix-memory-leak-produced-by-batch-async-find_jobs-me.patch
  * fix-novendorchange-option-284.patch
  * fix-onlyif-unless-when-multiple-conditions-bsc-11808.patch
  * fix-regression-on-cmd.run-when-passing-tuples-as-cmd.patch
  * fix-save-for-iptables-state-module-bsc-1185131-372.patch
  * fix-the-removed-six.itermitems-and-six.-_type-262.patch
  * fix-unit-test-for-grains-core.patch
  * fix-unit-tests-for-batch-async-after-refactor.patch
  * fix-virt.update-with-cpu-defined-263.patch
  * fix-zypper-pkg.list_pkgs-expectation-and-dpkg-mockin.patch
  * fix-zypper.list_pkgs-to-be-aligned-with-pkg-state.patch
  * fixed-bug-lvm-has-no-parttion-type.-the-scipt-later-.patch
  * fixes-cve-2018-15750-cve-2018-15751.patch
  * fixing-streamclosed-issue.patch
  * get-os_arch-also-without-rpm-package-installed.patch
  * grains-master-can-read-grains.patch
  * grains.extra-support-old-non-intel-kernels-bsc-11806.patch
  * handle-master-tops-data-when-states-are-applied-by-t.patch
  * handle-volumes-on-stopped-pools-in-virt.vm_info-373.patch
  * implement-network.fqdns-module-function-bsc-1134860-.patch
  * improve-batch_async-to-release-consumed-memory-bsc-1.patch
  * integration-of-msi-authentication-with-azurearm-clou.patch
  * invalidate-file-list-cache-when-cache-file-modified-.patch
  * loop-fix-variable-names-for-until_no_eval.patch
  * loosen-azure-sdk-dependencies-in-azurearm-cloud-driv.patch
  * make-profiles-a-package.patch
  * move-server_id-deprecation-warning-to-reduce-log-spa.patch
  * move-vendor-change-logic-to-zypper-class-355.patch
  * open-suse-3002.2-bigvm-310.patch
  * open-suse-3002.2-virt-network-311.patch
  * open-suse-3002.2-xen-grub-316.patch
  * opensuse-3000-libvirt-engine-fixes-251.patch
  * opensuse-3000-virt-defined-states-222.patch
  * opensuse-3000.2-virt-backports-236-257.patch
  * opensuse-3000.3-spacewalk-runner-parse-command-250.patch
  * option-to-en-disable-force-refresh-in-zypper-215.patch
  * parsing-epoch-out-of-version-provided-during-pkg-rem.patch
  * path-replace-functools.wraps-with-six.wraps-bsc-1177.patch
  * pkgrepo-support-python-2.7-function-call-295.patch
  * prevent-ansiblegate-unit-tests-to-fail-on-ubuntu.patch
  * prevent-command-injection-in-the-snapper-module-bsc-.patch
  * prevent-import-errors-when-running-test_btrfs-unit-t.patch
  * prevent-logging-deadlock-on-salt-api-subprocesses-bs.patch
  * prevent-race-condition-on-sigterm-for-the-minion-bsc.patch
  * prevent-systemd-run-description-issue-when-running-a.patch
  * prevent-test_mod_del_repo_multiline_values-to-fail.patch
  * provide-the-missing-features-required-for-yomi-yet-o.patch
  * python3.8-compatibility-pr-s-235.patch
  * re-adding-function-to-test-for-root.patch
  * regression-fix-of-salt-ssh-on-processing-targets-353.patch
  * reintroducing-reverted-changes.patch
  * remove-arch-from-name-when-pkg.list_pkgs-is-called-w.patch
  * remove-deprecated-usage-of-no_mock-and-no_mock_reaso.patch
  * remove-deprecated-warning-that-breaks-miniion-execut.patch
  * remove-duplicated-method-definitions-in-salt.netapi-.patch
  * remove-msgpack-1.0.0-requirement-in-the-installed-me.patch
  * remove-unnecessary-yield-causing-badyielderror-bsc-1.patch
  * remove-vendored-backports-abc-from-requirements.patch
  * remove-wrong-_parse_cpe_name-from-grains.core-452.patch
  * revert-add-patch-support-for-allow-vendor-change-opt.patch
  * sanitize-grains-loaded-from-roster_grains.json.patch
  * strip-trailing-from-repo.uri-when-comparing-repos-in.patch
  * support-config-non-root-permission-issues-fixes-u-50.patch
  * support-for-btrfs-and-xfs-in-parted-and-mkfs.patch
  * support-transactional-systems-microos-271.patch
  * templates-move-the-globals-up-to-the-environment-jin.patch
  * transactional_update-detect-recursion-in-the-executo.patch
  * transactional_update-unify-with-chroot.call.patch
  * use-current-ioloop-for-the-localclient-instance-of-b.patch
  * use-threadpool-from-multiprocessing.pool-to-avoid-le.patch
  * vendor-stateresult.patch
  * virt-adding-kernel-boot-parameters-to-libvirt-xml-55.patch
  * virt-pass-emulator-when-getting-domain-capabilities-.patch
  * virt-uefi-fix-backport-312.patch
  * virt-use-dev-kvm-to-detect-kvm-383.patch
  * virt._get_domain-don-t-raise-an-exception-if-there-i.patch
  * virt.network_update-handle-missing-ipv4-netmask-attr.patch
  * xen-disk-fixes-264.patch
  * xfs-do-not-fails-if-type-is-not-present.patch
  * zypperpkg-filter-patterns-that-start-with-dot-244.patch
- Renamed and modified:
  * 3002.2-do-not-consider-skipped-targets-as-failed-for.patch -&gt; 3003.3-do-not-consider-skipped-targets-as-failed-for.patch
  * 3002.2-postgresql-json-support-in-pillar-424.patch -&gt; 3003.3-postgresql-json-support-in-pillar-423.patch
  * add-salt-ssh-support-with-venv-salt-minion-3002.2-47.patch -&gt; add-salt-ssh-support-with-venv-salt-minion-3004-493.patch
  * allow-vendor-change-option-with-zypper-313.patch -&gt; allow-vendor-change-option-with-zypper.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch -&gt; fix-inspector-module-export-function-bsc-1097531-481.patch
  * fix-salt-ssh-opts-poisoning-bsc-1197637-3002.2-500.patch -&gt; fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch
  * fix-state.orchestrate_single-to-not-pass-pillar-none.patch -&gt; state.orchestrate_single-does-not-pass-pillar-none-4.patch
  * fix-traceback.-_exc-calls-429.patch -&gt; fix-traceback.print_exc-calls-for-test_pip_state-432.patch
  * mock-ip_addrs-in-utils-minions.py-unit-test-444.patch -&gt; mock-ip_addrs-in-utils-minions.py-unit-test-443.patch
  * support-transactional-systems-microos-271.patch -&gt; support-transactional-systems-microos.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1653307200">- Make sure SaltCacheLoader use correct fileclient (bsc#1199149)
- Added:
  * make-sure-saltcacheloader-use-correct-fileclient-519.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1655380800">- Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566)
- Added:
  * fix-for-cve-2022-22967-bsc-1200566.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1659960000">- Add support for gpgautoimport in zypperpkg module
- Update Salt to work with Jinja &gt;= and &lt;= 3.1.0 (bsc#1198744)
- Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372)
- Make Salt 3004 compatible with pyzmq &gt;= 23.0.0 (bsc#1201082)
- Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489)
- Fix ownership of salt thin directory when using the Salt Bundle
- Set default target for pip from VENV_PIP_TARGET environment variable
- Normalize package names once with pkg.installed/removed using yum (bsc#1195895)
- Save log to logfile with docker.build
- Use Salt Bundle in dockermod
- Ignore erros on reading license files with dpkg_lowpkg (bsc#1197288)
- Added:
  * fix-ownership-of-salt-thin-directory-when-using-the-.patch
  * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch
  * save-log-to-logfile-with-docker.build.patch
  * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch
  * fix-salt.states.file.managed-for-follow_symlinks-tru.patch
  * normalize-package-names-once-with-pkg.installed-remo.patch
  * set-default-target-for-pip-from-venv_pip_target-envi.patch
  * fix-jinja2-contextfuntion-base-on-version-bsc-119874.patch
  * use-salt-bundle-in-dockermod.patch
  * fix-62092-catch-zmq.error.zmqerror-to-set-hwm-for-zm.patch
  * add-support-for-gpgautoimport-539.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1664193600">- Handle non-UTF-8 bytes in core grains generation (bsc#1202165)
- Fix Syndic authentication errors (bsc#1199562)
- Add Amazon EC2 detection for virtual grains (bsc#1195624)
- Fix the regression in schedule module releasded in 3004 (bsc#1202631)
- Fix state.apply in test mode with file state module on user/group checking (bsc#1202167)
- Change the delimeters to prevent possible tracebacks on some packages with dpkg_lowpkg
- Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596)
- Fix test_ipc unit test
- Added:
  * fix-the-regression-in-schedule-module-releasded-in-3.patch
  * ignore-non-utf8-characters-while-reading-files-with-.patch
  * backport-syndic-auth-fixes.patch
  * retry-if-rpm-lock-is-temporarily-unavailable-547.patch
  * change-the-delimeters-to-prevent-possible-tracebacks.patch
  * fix-state.apply-in-test-mode-with-file-state-module-.patch
  * fix-test_ipc-unit-tests.patch
  * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1668686400">- Pass the context to pillar ext modules
- Align Amazon EC2 (Nitro) grains with upstream (bsc#1203685)
- Detect module run syntax version
- Implement automated patches alignment for the Salt Bundle
- Ignore extend declarations from excluded SLS files (bsc#1203886)
- Clarify pkg.installed pkg_verify documentation
- Enhance capture of error messages for Zypper calls in zypperpkg module
- Make pass renderer configurable and fix detected issues
- Workaround fopen line buffering for binary mode (bsc#1203834)
- Added:
  * clarify-pkg.installed-pkg_verify-documentation.patch
  * make-pass-renderer-configurable-other-fixes-532.patch
  * fopen-workaround-bad-buffering-for-binary-mode-563.patch
  * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch
  * detect-module.run-syntax.patch
  * ignore-extend-declarations-from-excluded-sls-files.patch
  * include-stdout-in-error-message-for-zypperpkg-559.patch
  * pass-the-context-to-pillar-ext-modules.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1673524800">- Control the collection of lvm grains via config (bsc#1204939)
- Added:
  * control-the-collection-of-lvm-grains-via-config.patch</changelog>
</package>
<package pkgid="16c826446b8dfce773ddbdb2f9c399135e70ef474d73a7052d56a36f218f1af4" name="samba" arch="src">
  <version epoch="0" ver="4.15.12+git.535.7750e5c95ef" rel="150300.3.43.1"/>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
</package>
<package pkgid="5819086e17a5f670591187bdbddb001f549c5e23cf0aee4b159303bb75b707c2" name="samba" arch="src">
  <version epoch="0" ver="4.15.13+git.540.fab3b2a46c6" rel="150300.3.46.1"/>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Remove the systemd drop-in file for named service to allow
  read/write access to the DLZ directory as bind is not using
  systemd filesystem namespaces but bind-chrootenv; (bsc#1205946);</changelog>
</package>
<package pkgid="23699c4b31a62a5325deaddc1ccf7bccf44d78ddb8e9aab49d3fb7afd48bd6cd" name="samba" arch="src">
  <version epoch="0" ver="4.15.13+git.591.ab36624310c" rel="150300.3.49.1"/>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Remove the systemd drop-in file for named service to allow
  read/write access to the DLZ directory as bind is not using
  systemd filesystem namespaces but bind-chrootenv; (bsc#1205946);</changelog>
  <changelog author="nopower@suse.com" date="1673265600">- CVE-2021-20251: samba: Bad password count not incremented
  atomically; (bso#14611); (bsc#1206546).</changelog>
  <changelog author="scabrero@suse.de" date="1673352000">- CVE-2022-38023 Additional patches for the PDC role's netlogon
  server; (bso#15240); (bsc#1206504);</changelog>
</package>
<package pkgid="039b223c20452e92b7e0ad48e7b1e9d4780c303d0d1aa2df92ccfa6faaefa8c4" name="samba" arch="src">
  <version epoch="0" ver="4.15.8+git.500.d5910280cc7" rel="150300.3.37.1"/>
  <changelog author="scabrero@suse.de" date="1642075200">- Update to version 4.15.3; (jsc#SLE-23329);
  + CVE-2021-43566: Symlink race error can allow directory creation
    outside of the exported share; (bso#13979); (bsc#1139519);
  + CVE-2021-20316: Symlink race error can allow metadata read and
    modify outside of the exported share; (bso#14842); (bsc#1191227);
- Reorganize libs packages. Split samba-libs into samba-client-libs,
  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba
  public libraries depending on internal samba libraries into these
  packages as there were dependency problems everytime one of these
  public libraries changed its version (bsc#1192684). The devel
  packages are merged into samba-devel.
- Rename package samba-core-devel to samba-devel
- Add python-rpm-macros to build requirements
- Update the symlink create by samba-dsdb-modules to private samba
  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to
  /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="dimstar@opensuse.org" date="1642507200">- Use pkgconfig(krb5) as dependency for the -devel package: allow
  OBS to pick the right flavor of krb5-devel (full vs mini).
- Do not require the 'krb5' symbol by samba-client-libs: this
  package has an automatic dependency due to linkage on
  libgssapi_krb5.so.2. Automatic deps are always better.
- Do not require the 'krb5' symbol from samba-libs: samba-libs
  requires samba-client-libs, which in turn requires krb5
  libraries. Samba-libs itself has no need for krb5 (but get it
  indirectly anyway).</changelog>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="83f9ca3259315d56e8f677a800492cfa07724f467dfae9a2466b46eeeb3f617a" name="samba" arch="src">
  <version epoch="0" ver="4.15.8+git.527.8d0c05d313e" rel="150300.3.40.2"/>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
</package>
<package pkgid="5f383f84895a1e327c90a4c8bcc36679586143f2af6d592835f7b39869781c48" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.15.12+git.535.7750e5c95ef" rel="150300.3.43.1"/>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
</package>
<package pkgid="0db565b11b6460cac080d5987a1e8fecf79fb0c8f765a7537cd1f8ab760102c9" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.15.12+git.535.7750e5c95ef" rel="150300.3.43.1"/>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
</package>
<package pkgid="26122c31976ff9d2acb643f155134f3153036c7e88693b536f6c6fbe31047229" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.15.13+git.540.fab3b2a46c6" rel="150300.3.46.1"/>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Remove the systemd drop-in file for named service to allow
  read/write access to the DLZ directory as bind is not using
  systemd filesystem namespaces but bind-chrootenv; (bsc#1205946);</changelog>
</package>
<package pkgid="c40bd02b1d7f4d5c8bef64546aa6de52523cdfa6bb42cfb191194df301702c96" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.15.13+git.540.fab3b2a46c6" rel="150300.3.46.1"/>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Remove the systemd drop-in file for named service to allow
  read/write access to the DLZ directory as bind is not using
  systemd filesystem namespaces but bind-chrootenv; (bsc#1205946);</changelog>
</package>
<package pkgid="7d2f2dca6bc11da0be6d59976db523a9480dfcd1cdf675f963450a04b9b130d3" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.15.13+git.591.ab36624310c" rel="150300.3.49.1"/>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Remove the systemd drop-in file for named service to allow
  read/write access to the DLZ directory as bind is not using
  systemd filesystem namespaces but bind-chrootenv; (bsc#1205946);</changelog>
  <changelog author="nopower@suse.com" date="1673265600">- CVE-2021-20251: samba: Bad password count not incremented
  atomically; (bso#14611); (bsc#1206546).</changelog>
  <changelog author="scabrero@suse.de" date="1673352000">- CVE-2022-38023 Additional patches for the PDC role's netlogon
  server; (bso#15240); (bsc#1206504);</changelog>
</package>
<package pkgid="e2b2dcab6e0774daf0d72b2df31fb145d6d707e941535a764ff972b98773012d" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.15.13+git.591.ab36624310c" rel="150300.3.49.1"/>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="scabrero@suse.de" date="1671451200">- Update to 4.15.13
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237); (bsc#1205385);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231); (bsc#1205386);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240); (bsc#1206504);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
- Remove the systemd drop-in file for named service to allow
  read/write access to the DLZ directory as bind is not using
  systemd filesystem namespaces but bind-chrootenv; (bsc#1205946);</changelog>
  <changelog author="nopower@suse.com" date="1673265600">- CVE-2021-20251: samba: Bad password count not incremented
  atomically; (bso#14611); (bsc#1206546).</changelog>
  <changelog author="scabrero@suse.de" date="1673352000">- CVE-2022-38023 Additional patches for the PDC role's netlogon
  server; (bso#15240); (bsc#1206504);</changelog>
</package>
<package pkgid="284db9b9940733b1df60ccabb1ab4f93d0fa6b17c4d212c7d185d2863ef844a0" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.15.8+git.500.d5910280cc7" rel="150300.3.37.1"/>
  <changelog author="scabrero@suse.de" date="1642075200">- Update to version 4.15.3; (jsc#SLE-23329);
  + CVE-2021-43566: Symlink race error can allow directory creation
    outside of the exported share; (bso#13979); (bsc#1139519);
  + CVE-2021-20316: Symlink race error can allow metadata read and
    modify outside of the exported share; (bso#14842); (bsc#1191227);
- Reorganize libs packages. Split samba-libs into samba-client-libs,
  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba
  public libraries depending on internal samba libraries into these
  packages as there were dependency problems everytime one of these
  public libraries changed its version (bsc#1192684). The devel
  packages are merged into samba-devel.
- Rename package samba-core-devel to samba-devel
- Add python-rpm-macros to build requirements
- Update the symlink create by samba-dsdb-modules to private samba
  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to
  /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="dimstar@opensuse.org" date="1642507200">- Use pkgconfig(krb5) as dependency for the -devel package: allow
  OBS to pick the right flavor of krb5-devel (full vs mini).
- Do not require the 'krb5' symbol by samba-client-libs: this
  package has an automatic dependency due to linkage on
  libgssapi_krb5.so.2. Automatic deps are always better.
- Do not require the 'krb5' symbol from samba-libs: samba-libs
  requires samba-client-libs, which in turn requires krb5
  libraries. Samba-libs itself has no need for krb5 (but get it
  indirectly anyway).</changelog>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="58851ccf168135cdd51559acec9e3387928371bbd874b367aa0fb96e4ac8198f" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.15.8+git.500.d5910280cc7" rel="150300.3.37.1"/>
  <changelog author="scabrero@suse.de" date="1642075200">- Update to version 4.15.3; (jsc#SLE-23329);
  + CVE-2021-43566: Symlink race error can allow directory creation
    outside of the exported share; (bso#13979); (bsc#1139519);
  + CVE-2021-20316: Symlink race error can allow metadata read and
    modify outside of the exported share; (bso#14842); (bsc#1191227);
- Reorganize libs packages. Split samba-libs into samba-client-libs,
  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba
  public libraries depending on internal samba libraries into these
  packages as there were dependency problems everytime one of these
  public libraries changed its version (bsc#1192684). The devel
  packages are merged into samba-devel.
- Rename package samba-core-devel to samba-devel
- Add python-rpm-macros to build requirements
- Update the symlink create by samba-dsdb-modules to private samba
  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to
  /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="dimstar@opensuse.org" date="1642507200">- Use pkgconfig(krb5) as dependency for the -devel package: allow
  OBS to pick the right flavor of krb5-devel (full vs mini).
- Do not require the 'krb5' symbol by samba-client-libs: this
  package has an automatic dependency due to linkage on
  libgssapi_krb5.so.2. Automatic deps are always better.
- Do not require the 'krb5' symbol from samba-libs: samba-libs
  requires samba-client-libs, which in turn requires krb5
  libraries. Samba-libs itself has no need for krb5 (but get it
  indirectly anyway).</changelog>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
</package>
<package pkgid="e7d2b835be55e56952082e7b6d7d374a951f45b959a47d5ba69132d14966c340" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.15.8+git.527.8d0c05d313e" rel="150300.3.40.2"/>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
</package>
<package pkgid="5cf2e8aefe8ebf4796a3b7136b91b89472758886a210d92daf3228726424877d" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.15.8+git.527.8d0c05d313e" rel="150300.3.40.2"/>
  <changelog author="scabrero@suse.de" date="1642766400">- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "client max protocol" to NT1 before
    calling the "Reconnecting with SMB1 for workgroup listing"
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
    (bso#14940);
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
    (bso#14944);
  * "smbd --build-options" no longer works without an smb.conf file;
    (bso#14945);</changelog>
  <changelog author="scabrero@suse.de" date="1643198400">- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
  (bsc#1193690);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
  (bsc#1194859);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
  (bsc#1195048);</changelog>
  <changelog author="nopower@suse.com" date="1643630400">- Update to 4.15.5
  * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the
    outside target of a symlink exists; (bso#14911);
    (bsc#1193690).
  * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit
    module; (bso#14914); (bsc#1194859).
  * CVE-2022-0336:  Re-adding an SPN skips subsequent SPN
    conflict checks; bso#14950); (bsc#1195048).</changelog>
  <changelog author="dmulder@suse.com" date="1644235200">- libldb version mismatch in Samba dsdb component; (bsc#1118508);</changelog>
  <changelog author="dmulder@suse.com" date="1644840000">- Fix samba-ad-dc status warning notification message by disabling
  systemd notifications in bgqd; (bsc#1195896); (bso#14947).</changelog>
  <changelog author="nopower@suse.com" date="1645617600">- Fix ntlm authentications with "winbind use default domain = yes";
  (bso#13126); (bsc#1173429); (bsc#1196308).</changelog>
  <changelog author="ddiss@suse.com" date="1646395200">- Drop obsolete Samba fsrvp v0-&gt;v1 state upgrade functionality;
  (bsc#1080338).</changelog>
  <changelog author="dmulder@suse.com" date="1646654400">- Fix mismatched version of libldb2; (bsc#1196788).
- Drop obsolete SuSEfirewall2 service files.</changelog>
  <changelog author="scabrero@suse.de" date="1647345600">- Update to 4.15.6
  * Renaming file on DFS root fails with
    NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169);
  * Samba does not response STATUS_INVALID_PARAMETER when opening 2
    objects with same lease key; (bso#14737);
  * NT error code is not set when overwriting a file during rename
    in libsmbclient; (bso#14938);
  * Fix ldap simple bind with TLS auditing; (bso#14996);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * pam_winbind will not allow gdm login if password about to
    expire; (bso#8691);
  * virusfilter_vfs_openat: Not scanned: Directory or special file;
    (bso#14971);
  * DFS fix for AIX broken; (bso#13631);
  * Solaris and AIX acl modules: wrong function arguments;
    (bso#14974);
  * Function aixacl_sys_acl_get_file not declared / coredump;
    (bso#7239);
  * Regression: Samba 4.15.2 on macOS segfaults intermittently
    during strcpy in tdbsam_getsampwnam; (bso#14900);
  * Fix a use-after-free in SMB1 server; (bso#14989);
  * smb2_signing_decrypt_pdu() may not decrypt with
    gnutls_aead_cipher_decrypt() from gnutls before 3.5.2;
    (bso#14968);
  * Changing the machine password against an RODC likely destroys
    the domain join; (bso#14984);
  * authsam_make_user_info_dc() steals memory from its struct
    ldb_message *msg argument; (bso#14993);
  * Use Heimdal 8.0 (pre) rather than an earlier snapshot;
    (bso#14995);
  * Samba autorid fails to map AD users if id rangesize fits in the
    id range only once; (bso#14967);</changelog>
  <changelog author="scabrero@suse.de" date="1649678400">- Add missing samba-libs requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1651060800">- Add provides to samba-client-libs package to fix upgrades from
  previous versions; (bsc#1197995);</changelog>
  <changelog author="scabrero@suse.de" date="1651060801">- Update to 4.15.7
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written
    to; (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES
    in SMBC_server_internal; (bso#14983);
  * Simple bind doesn't work against an RODC (with non-preloaded users);
    (bso#13879);
  * Crash of winbind on RODC; (bso#14641);
  * uncached logon on RODC always fails once; (bso#14865);
  * KVNO off by 100000; (bso#14951);
  * LDAP simple binds should honour "old password allowed period";
    (bso#15001);
  * wbinfo -a doesn't work reliable with upn names; (bso#15003);
  * Simple bind doesn't work against an RODC (with non-preloaded
    users); (bso#13879);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * Regression: create krb5 conf = yes doesn't work with a single KDC;
    (bso#15016);</changelog>
  <changelog author="scabrero@suse.de" date="1651233600">- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);</changelog>
  <changelog author="scabrero@suse.de" date="1652702400">- Revert NIS support removal; (bsc#1199247);</changelog>
  <changelog author="nopower@suse.com" date="1655726400">- Fix  smbclient commands del &amp; deltree failing with
  NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
  (bsc#1200556).</changelog>
  <changelog author="scabrero@suse.de" date="1657281600">- Update to 4.15.8
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * Setting fruit:resource = stream in vfs_fruit causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work; (bso#15076);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * netgroups support removed; (bso#15087); (bsc#1199247);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674); (bsc#1199734);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);</changelog>
  <changelog author="nopower@suse.com" date="1657800000">- CVE-2022-32746: samba: Use-after-free occurring in database
  audit logging; (bso#15009); (bso#15096); (bsc#1201490).
- CVE-2022-32745: samba: ldb: AD users can crash the server
  process with an LDAP add or modify request; (bso#15008);
  (bso#15096); (bsc#1201492).
- CVE-2022-2031: samba, ldb: AD users can bypass certain
  restrictions associated with changing passwords; (bso#15047);
  (bsc#1201495);
- CVE-2022-32742:SMB1 code does not correct verify SMB1write,
  SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
  (bsc#1201496).
- CVE-2022-32744: samba, ldb: AD users can forge password change
  requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1660737600">- Fix Use after free when iterating
  smbd_server_connection-&gt;connections after tree disconnect
  failure; (bso#15128); (bsc#1200102).</changelog>
  <changelog author="scabrero@suse.de" date="1661947200">- CVE-2022-1615: Do not ignore errors in random number generation;
  (bso#15103); (bsc#1202976);
- CVE-2022-32743: Implement validated dnsHostName write rights;
  (bso#14833); (bsc#1202803);</changelog>
</package>
<package pkgid="9323b09a984a3cb5217c85a9b22ea6ece7dbff6b67c96606d93103e4a7e04d36" name="selinux-policy" arch="noarch">
  <version epoch="0" ver="20210716" rel="150300.13.8.1"/>
  <changelog author="jsegitz@suse.com" date="1618833600">- Update to version 20210419
- Refreshed:
  * fix_dbus.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_unprivuser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619179200">- Transition unconfined users to ldconfig type (bsc#1183121).
  Extended fix_unconfineduser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619438400">- Added Recommends for selinux-autorelabel (bsc#1181837)
- Prevent libreoffice fonts from changing types on every relabel
  (bsc#1185265). Added fix_libraries.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619524800">- Updated fix_networkmanager.patch to allow NetworkManager to watch
  its configuration directories
- Added fix_dovecot.patch to fix dovecot authentication (bsc#1182207)</changelog>
  <changelog author="lnussel@suse.de" date="1619611200">- allow cockpit socket to bind nodes (fix_cockpit.patch)
- use %autosetup to get rid of endless patch lines</changelog>
  <changelog author="lnussel@suse.de" date="1621339200">- allow systemd to watch /usr, /usr/lib, /etc, /etc/pki as we have path units
  that trigger on changes in those.
  Added fix_systemd_watch.patch
- own /usr/share/selinux/packages/$SELINUXTYPE/ and
  /var/lib/selinux/$SELINUXTYPE/active/modules/* to allow packages to install
  files there</changelog>
  <changelog author="jsegitz@suse.com" date="1624881600">- Update to version 20210419
- Dropped fix_gift.patch, module was removed
- Updated wicked.te to removed dropped interface
- Refreshed:
  * fix_cockpit.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_logging.patch
  * fix_logrotate.patch
  * fix_networkmanager.patch
  * fix_nscd.patch
  * fix_rpm.patch
  * fix_selinuxutil.patch
  * fix_systemd.patch
  * fix_systemd_watch.patch
  * fix_thunderbird.patch
  * fix_unconfined.patch
  * fix_unconfineduser.patch
  * fix_unprivuser.patch
  * fix_xserver.patch</changelog>
  <changelog author="aplanas@suse.com" date="1625572800">- Add tabrmd SELinux modules from upstream (bsc#1187925)
  https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux
- Automatic spec-cleaner to fix ordering and misaligned spaces</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
  here</changelog>
  <changelog author="jsegitz@suse.com" date="1626436800">- Update to version 20210716
- Remove interfaces for container module before building the package
  (bsc#1188184)
- Updated
  * fix_init.patch
  * fix_systemd_watch.patch
  to adapt to upstream changes</changelog>
  <changelog author="lnussel@suse.de" date="1628596800">- Fix quoting in postInstall macro</changelog>
  <changelog author="lnussel@suse.de" date="1629201600">- Allow systemd-sysctl to read kernel specific sysctl.conf
  (fix_kernel_sysctl.patch, boo#1184804)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1629720000">- Added policy module for rebootmgr (jsc#SMO-28)</changelog>
  <changelog author="jsegitz@suse.com" date="1629979200">- Properly label cockpit files
- Allow wicked to communicate with network manager on DBUS (bsc#1188331)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1630065600">- fix rebootmgr does not trigger the reboot properly (boo#1189878)
  * fix managing /etc/rebootmgr.conf
  * allow rebootmgr_t to cope with systemd and dbus messaging</changelog>
  <changelog author="jsegitz@suse.com" date="1633003200">- Fix auditd service start with systemd hardening directives (bsc#1190918)
  * add fix_auditd.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1633435200">- Add init_watch_unallocated_ttys.patch to fix services with
  StandardOutput=tty (bsc#1187313)</changelog>
  <changelog author="jsegitz@suse.com" date="1645444800">- Added fix_hypervkvp.patch to fix issues with hyperv labeling
  (bsc#1193987)</changelog>
  <changelog author="jsegitz@suse.com" date="1651579200">- Add systemd_domain_dyntrans_type.patch to allow systemd to dyntransition.
  This happens in certain boot conditions (bsc#1182500)</changelog>
  <changelog author="zkubala@suse.cz" date="1659096000">- Add fix_cloudform.patch to fix cloud-init runcmd issue with snapper
  (bnc#1201015)</changelog>
</package>
<package pkgid="96e7f1a019e52feea3124908117bb29c3c6ab9af3826cf36c3f9d0d10e5a90ee" name="selinux-policy" arch="src">
  <version epoch="0" ver="20210716" rel="150300.13.8.1"/>
  <changelog author="jsegitz@suse.com" date="1618833600">- Update to version 20210419
- Refreshed:
  * fix_dbus.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_unprivuser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619179200">- Transition unconfined users to ldconfig type (bsc#1183121).
  Extended fix_unconfineduser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619438400">- Added Recommends for selinux-autorelabel (bsc#1181837)
- Prevent libreoffice fonts from changing types on every relabel
  (bsc#1185265). Added fix_libraries.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619524800">- Updated fix_networkmanager.patch to allow NetworkManager to watch
  its configuration directories
- Added fix_dovecot.patch to fix dovecot authentication (bsc#1182207)</changelog>
  <changelog author="lnussel@suse.de" date="1619611200">- allow cockpit socket to bind nodes (fix_cockpit.patch)
- use %autosetup to get rid of endless patch lines</changelog>
  <changelog author="lnussel@suse.de" date="1621339200">- allow systemd to watch /usr, /usr/lib, /etc, /etc/pki as we have path units
  that trigger on changes in those.
  Added fix_systemd_watch.patch
- own /usr/share/selinux/packages/$SELINUXTYPE/ and
  /var/lib/selinux/$SELINUXTYPE/active/modules/* to allow packages to install
  files there</changelog>
  <changelog author="jsegitz@suse.com" date="1624881600">- Update to version 20210419
- Dropped fix_gift.patch, module was removed
- Updated wicked.te to removed dropped interface
- Refreshed:
  * fix_cockpit.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_logging.patch
  * fix_logrotate.patch
  * fix_networkmanager.patch
  * fix_nscd.patch
  * fix_rpm.patch
  * fix_selinuxutil.patch
  * fix_systemd.patch
  * fix_systemd_watch.patch
  * fix_thunderbird.patch
  * fix_unconfined.patch
  * fix_unconfineduser.patch
  * fix_unprivuser.patch
  * fix_xserver.patch</changelog>
  <changelog author="aplanas@suse.com" date="1625572800">- Add tabrmd SELinux modules from upstream (bsc#1187925)
  https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux
- Automatic spec-cleaner to fix ordering and misaligned spaces</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
  here</changelog>
  <changelog author="jsegitz@suse.com" date="1626436800">- Update to version 20210716
- Remove interfaces for container module before building the package
  (bsc#1188184)
- Updated
  * fix_init.patch
  * fix_systemd_watch.patch
  to adapt to upstream changes</changelog>
  <changelog author="lnussel@suse.de" date="1628596800">- Fix quoting in postInstall macro</changelog>
  <changelog author="lnussel@suse.de" date="1629201600">- Allow systemd-sysctl to read kernel specific sysctl.conf
  (fix_kernel_sysctl.patch, boo#1184804)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1629720000">- Added policy module for rebootmgr (jsc#SMO-28)</changelog>
  <changelog author="jsegitz@suse.com" date="1629979200">- Properly label cockpit files
- Allow wicked to communicate with network manager on DBUS (bsc#1188331)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1630065600">- fix rebootmgr does not trigger the reboot properly (boo#1189878)
  * fix managing /etc/rebootmgr.conf
  * allow rebootmgr_t to cope with systemd and dbus messaging</changelog>
  <changelog author="jsegitz@suse.com" date="1633003200">- Fix auditd service start with systemd hardening directives (bsc#1190918)
  * add fix_auditd.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1633435200">- Add init_watch_unallocated_ttys.patch to fix services with
  StandardOutput=tty (bsc#1187313)</changelog>
  <changelog author="jsegitz@suse.com" date="1645444800">- Added fix_hypervkvp.patch to fix issues with hyperv labeling
  (bsc#1193987)</changelog>
  <changelog author="jsegitz@suse.com" date="1651579200">- Add systemd_domain_dyntrans_type.patch to allow systemd to dyntransition.
  This happens in certain boot conditions (bsc#1182500)</changelog>
  <changelog author="zkubala@suse.cz" date="1659096000">- Add fix_cloudform.patch to fix cloud-init runcmd issue with snapper
  (bnc#1201015)</changelog>
</package>
<package pkgid="47bbc1a5911101f211bfe33af876f56174b17c05a972bb9bf02b163dbee8be85" name="selinux-policy-devel" arch="noarch">
  <version epoch="0" ver="20210716" rel="150300.13.8.1"/>
  <changelog author="jsegitz@suse.com" date="1618833600">- Update to version 20210419
- Refreshed:
  * fix_dbus.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_unprivuser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619179200">- Transition unconfined users to ldconfig type (bsc#1183121).
  Extended fix_unconfineduser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619438400">- Added Recommends for selinux-autorelabel (bsc#1181837)
- Prevent libreoffice fonts from changing types on every relabel
  (bsc#1185265). Added fix_libraries.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619524800">- Updated fix_networkmanager.patch to allow NetworkManager to watch
  its configuration directories
- Added fix_dovecot.patch to fix dovecot authentication (bsc#1182207)</changelog>
  <changelog author="lnussel@suse.de" date="1619611200">- allow cockpit socket to bind nodes (fix_cockpit.patch)
- use %autosetup to get rid of endless patch lines</changelog>
  <changelog author="lnussel@suse.de" date="1621339200">- allow systemd to watch /usr, /usr/lib, /etc, /etc/pki as we have path units
  that trigger on changes in those.
  Added fix_systemd_watch.patch
- own /usr/share/selinux/packages/$SELINUXTYPE/ and
  /var/lib/selinux/$SELINUXTYPE/active/modules/* to allow packages to install
  files there</changelog>
  <changelog author="jsegitz@suse.com" date="1624881600">- Update to version 20210419
- Dropped fix_gift.patch, module was removed
- Updated wicked.te to removed dropped interface
- Refreshed:
  * fix_cockpit.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_logging.patch
  * fix_logrotate.patch
  * fix_networkmanager.patch
  * fix_nscd.patch
  * fix_rpm.patch
  * fix_selinuxutil.patch
  * fix_systemd.patch
  * fix_systemd_watch.patch
  * fix_thunderbird.patch
  * fix_unconfined.patch
  * fix_unconfineduser.patch
  * fix_unprivuser.patch
  * fix_xserver.patch</changelog>
  <changelog author="aplanas@suse.com" date="1625572800">- Add tabrmd SELinux modules from upstream (bsc#1187925)
  https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux
- Automatic spec-cleaner to fix ordering and misaligned spaces</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
  here</changelog>
  <changelog author="jsegitz@suse.com" date="1626436800">- Update to version 20210716
- Remove interfaces for container module before building the package
  (bsc#1188184)
- Updated
  * fix_init.patch
  * fix_systemd_watch.patch
  to adapt to upstream changes</changelog>
  <changelog author="lnussel@suse.de" date="1628596800">- Fix quoting in postInstall macro</changelog>
  <changelog author="lnussel@suse.de" date="1629201600">- Allow systemd-sysctl to read kernel specific sysctl.conf
  (fix_kernel_sysctl.patch, boo#1184804)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1629720000">- Added policy module for rebootmgr (jsc#SMO-28)</changelog>
  <changelog author="jsegitz@suse.com" date="1629979200">- Properly label cockpit files
- Allow wicked to communicate with network manager on DBUS (bsc#1188331)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1630065600">- fix rebootmgr does not trigger the reboot properly (boo#1189878)
  * fix managing /etc/rebootmgr.conf
  * allow rebootmgr_t to cope with systemd and dbus messaging</changelog>
  <changelog author="jsegitz@suse.com" date="1633003200">- Fix auditd service start with systemd hardening directives (bsc#1190918)
  * add fix_auditd.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1633435200">- Add init_watch_unallocated_ttys.patch to fix services with
  StandardOutput=tty (bsc#1187313)</changelog>
  <changelog author="jsegitz@suse.com" date="1645444800">- Added fix_hypervkvp.patch to fix issues with hyperv labeling
  (bsc#1193987)</changelog>
  <changelog author="jsegitz@suse.com" date="1651579200">- Add systemd_domain_dyntrans_type.patch to allow systemd to dyntransition.
  This happens in certain boot conditions (bsc#1182500)</changelog>
  <changelog author="zkubala@suse.cz" date="1659096000">- Add fix_cloudform.patch to fix cloud-init runcmd issue with snapper
  (bnc#1201015)</changelog>
</package>
<package pkgid="8684feda79359664df79d8f07d121287a42df891c02b2df1c2d6a15f79d88a81" name="selinux-policy-targeted" arch="noarch">
  <version epoch="0" ver="20210716" rel="150300.13.8.1"/>
  <changelog author="jsegitz@suse.com" date="1618833600">- Update to version 20210419
- Refreshed:
  * fix_dbus.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_unprivuser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619179200">- Transition unconfined users to ldconfig type (bsc#1183121).
  Extended fix_unconfineduser.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619438400">- Added Recommends for selinux-autorelabel (bsc#1181837)
- Prevent libreoffice fonts from changing types on every relabel
  (bsc#1185265). Added fix_libraries.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1619524800">- Updated fix_networkmanager.patch to allow NetworkManager to watch
  its configuration directories
- Added fix_dovecot.patch to fix dovecot authentication (bsc#1182207)</changelog>
  <changelog author="lnussel@suse.de" date="1619611200">- allow cockpit socket to bind nodes (fix_cockpit.patch)
- use %autosetup to get rid of endless patch lines</changelog>
  <changelog author="lnussel@suse.de" date="1621339200">- allow systemd to watch /usr, /usr/lib, /etc, /etc/pki as we have path units
  that trigger on changes in those.
  Added fix_systemd_watch.patch
- own /usr/share/selinux/packages/$SELINUXTYPE/ and
  /var/lib/selinux/$SELINUXTYPE/active/modules/* to allow packages to install
  files there</changelog>
  <changelog author="jsegitz@suse.com" date="1624881600">- Update to version 20210419
- Dropped fix_gift.patch, module was removed
- Updated wicked.te to removed dropped interface
- Refreshed:
  * fix_cockpit.patch
  * fix_hadoop.patch
  * fix_init.patch
  * fix_logging.patch
  * fix_logrotate.patch
  * fix_networkmanager.patch
  * fix_nscd.patch
  * fix_rpm.patch
  * fix_selinuxutil.patch
  * fix_systemd.patch
  * fix_systemd_watch.patch
  * fix_thunderbird.patch
  * fix_unconfined.patch
  * fix_unconfineduser.patch
  * fix_unprivuser.patch
  * fix_xserver.patch</changelog>
  <changelog author="aplanas@suse.com" date="1625572800">- Add tabrmd SELinux modules from upstream (bsc#1187925)
  https://github.com/tpm2-software/tpm2-abrmd/tree/master/selinux
- Automatic spec-cleaner to fix ordering and misaligned spaces</changelog>
  <changelog author="gmbr3@opensuse.org" date="1626350400">- Use tabrmd SELinux modules from tpm2.0-abrmd instead of storing
  here</changelog>
  <changelog author="jsegitz@suse.com" date="1626436800">- Update to version 20210716
- Remove interfaces for container module before building the package
  (bsc#1188184)
- Updated
  * fix_init.patch
  * fix_systemd_watch.patch
  to adapt to upstream changes</changelog>
  <changelog author="lnussel@suse.de" date="1628596800">- Fix quoting in postInstall macro</changelog>
  <changelog author="lnussel@suse.de" date="1629201600">- Allow systemd-sysctl to read kernel specific sysctl.conf
  (fix_kernel_sysctl.patch, boo#1184804)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1629720000">- Added policy module for rebootmgr (jsc#SMO-28)</changelog>
  <changelog author="jsegitz@suse.com" date="1629979200">- Properly label cockpit files
- Allow wicked to communicate with network manager on DBUS (bsc#1188331)</changelog>
  <changelog author="ales.kedroutek@suse.com" date="1630065600">- fix rebootmgr does not trigger the reboot properly (boo#1189878)
  * fix managing /etc/rebootmgr.conf
  * allow rebootmgr_t to cope with systemd and dbus messaging</changelog>
  <changelog author="jsegitz@suse.com" date="1633003200">- Fix auditd service start with systemd hardening directives (bsc#1190918)
  * add fix_auditd.patch</changelog>
  <changelog author="jsegitz@suse.com" date="1633435200">- Add init_watch_unallocated_ttys.patch to fix services with
  StandardOutput=tty (bsc#1187313)</changelog>
  <changelog author="jsegitz@suse.com" date="1645444800">- Added fix_hypervkvp.patch to fix issues with hyperv labeling
  (bsc#1193987)</changelog>
  <changelog author="jsegitz@suse.com" date="1651579200">- Add systemd_domain_dyntrans_type.patch to allow systemd to dyntransition.
  This happens in certain boot conditions (bsc#1182500)</changelog>
  <changelog author="zkubala@suse.cz" date="1659096000">- Add fix_cloudform.patch to fix cloud-init runcmd issue with snapper
  (bnc#1201015)</changelog>
</package>
<package pkgid="b520e115979b8c875712fb7fb52fd41d542a438d393cf0c34c2dbbaebe9ec23a" name="sg3_utils" arch="aarch64">
  <version epoch="0" ver="1.44~763+22.a121545" rel="150300.16.5.1"/>
  <changelog author="hare@suse.de" date="1455796800">- Update to new upstream release 1.42:
  * sg_timestamp: new, to report or set timestamp
  * sg_read_attr: new, supported by tape drives
  * sg_stpg: fix truncation of target port field
  * sg_inq: cope with unicode strings, udev fixes
  - update version descriptor list to 20160125
  - '--export': new entries for UUID descriptor
  * sg_ses: add more field acronyms (ses3r11)
  8 sg_logs: add Utilization lpage (sbc4r07)
  - add Background operation lpage
  - add Pending defects lpage
  - add LPS misalignment lpage (sbc4r10)
  - document '--All' ('-A') option
  - rework lto tape vendor lpages
  * sg_vpd: add Block limits extension VPD page
  - add Device constituents VPD page
  - add LB Protection VPD page (ssc 15-296r1)
  - LB provisioning VPD page: expand LBPRZ, add
    Minimum and Threshold percentage fields
  - rework lto tape vendor VPD pages
  * sg_inq+sg_vpd+sg_xcopy: add support for locally
    assigned UUIDs in VPD page 0x83 (15-267r2)
  * sg_sanitize: add --znr option (sbc4r07)
  * sg_rep_zones: add --partial option (zbc-r04)
  * sg_format: add ffmt option (sbc4r10)
  - add support for FORMAT MEDIUM (for tape)
  * sg_raw: document length relationships
  * rescan-scsi-bus.sh: updates from Suse
  * sg_lib_data: sync asc/ascq codes with T10 20151126
  * sg_lib: add 'sense' categories for SCSI statuses:
    condition met, busy, task set full, ACA active and
    task aborted
  - add pr2serr() extern
  - change sg_get_sense_str() and dStrHexStr(), return
    chars written (returned void previously)
  - add sg_get_sense_descriptors_str() function
  - add sg_get_designation_descriptor_str() function
  - sg_get_desig_type_str()+sg_get_desig_assoc_str()
    and sg_get_desig_code_set_str() added
  - sg_get_opcode_sa_name() break out zoning in/out,
    read attribute and read position service actions
  * sg_cmds_extra: add sg_ll_format_unit2() for FFMT
  * sg_pr2serr.h: new, to shorten fprintf(stderr, ...)
  * sg_io_linux, sg_pt_linux: drop SUGGEST_* decoding
  * sg_unaligned.h: add 48 bit support and gets for
    variable length unsigned integers
- Delete sg3_utils-sg_inq-blacklist.diff; solved differently
- Added 40-usb-blacklist.rules (bsc#840054)
- Delete sg3_utils-58-scsi-sg3_symlink-fixup.patch;
  merged with upstream
- Delete sg3_utils-flush-fixup.patch; merged with upstream</changelog>
  <changelog author="hare@suse.de" date="1461844800">- sg_inq,sg_vpd: Safe VPD page access (bsc#945094)
  * Add 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch</changelog>
  <changelog author="hare@suse.de" date="1461931200">- Update to new upstream release 1.43:
  * sg_senddiag: add --timeout=SEC option
  * sg_sanitize: add --timeout=SEC option
  * sg_format: add --timeout=SEC option
  * sg_decode sense: add --cdb option
  * sg_ses: handle 2 bit EIIOE field in aes dpage
  - expand join handling of SAS connectors and others
  - expand join debug code
  * sg_logs: fix volume statistics lpage when subpage
    is zero (ssc5r02a); decode mount history log parameter
  - decode Requested recovery, TapeAlert response, and
    Service buffer information lpages for tape
  - add '--pdt=DT' option
  * sg_inq: fix potential unbounded loop in --export
  - update version descriptor list to 20160420
  * sg_inq+sg_vpd: update Extended inquiry data vpd
    page (spc5r09)
  - add --force option to bypass checking supported
    vpd pages page and fetch requested page directly
  * sg_reassign+sg_write_same: fix ULONG_MAX problem
  * sg_turs+sg_requests: make both accept '--num=NUM'
    and '--number=NUM' for mutual compatibility
  * sg_zone: fix debug cdb naming
  * sg_opcode: add '--enumerate' and '--pdt=' options
  * sg_raw: add '--enumerate' option
  * sg_lib: add SSC maintenance in/out sa names
  - add read buffer(16) command mode names
  - add sg_decode_transportid_str()
  * sg_lib_data: sync asc/ascq codes with T10 20160425
  * rescan-scsi-bus.sh: harden code
  * clang --analyze static checker clean ups
  * shellcheck cleanup on scripts
  * automake: add AM_PROG_AR to configure.ac
  - upgrade to version 1.15
- Include patches from upstream:
  * sg_inq+sg_vpd: add --force option to bypass checking
    of supported vpd pages
  * sg_lib_data: add Bind and Unbind to service action out(16)
- Remove 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch; merged
  with upstream.</changelog>
  <changelog author="sparschauer@suse.de" date="1473249600">- using "--lun" now works correctly (bsc#981452), adding patch:
  * add-lunsearch-filter-to-searchexisting.patch</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Remove superfluous insserv PreReq.</changelog>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- Use separate repository for SLE15</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Spec file: add fc_wwpn_id to generate by-path links for
  fibrechannel (bsc#1005063)
- Update to version 1.44~763+17.35f525b:
  * Changed versioning scheme (svn r763, pre-release of
    upstream 1.44, plus 16 SUSE patches, SUSE git commit b2fedfa)
  * Code-identical to previous release except for the following:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)</changelog>
  <changelog author="mwilck@suse.com" date="1556625600">- Update to version 1.44~763+19.1ed0757:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
  (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.44~763+20.81dc714:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1657800000">- Update to version 1.44~763+21.3d16f61:
  * sg_turs: fix exit status when not ready in single case
    (boo#1095671)</changelog>
  <changelog author="mwilck@suse.com" date="1657800001">- Update to version 1.44~763+22.a121545:
  * Add systemd service files for LUN masking
  (bsc#1099278, bsc#954600)</changelog>
</package>
<package pkgid="7a2debc1d099d72d795d18fcd029317bead9ea5ecbbdc3f8c04dc905df905254" name="sg3_utils" arch="src">
  <version epoch="0" ver="1.44~763+22.a121545" rel="150300.16.5.1"/>
  <changelog author="hare@suse.de" date="1455796800">- Update to new upstream release 1.42:
  * sg_timestamp: new, to report or set timestamp
  * sg_read_attr: new, supported by tape drives
  * sg_stpg: fix truncation of target port field
  * sg_inq: cope with unicode strings, udev fixes
  - update version descriptor list to 20160125
  - '--export': new entries for UUID descriptor
  * sg_ses: add more field acronyms (ses3r11)
  8 sg_logs: add Utilization lpage (sbc4r07)
  - add Background operation lpage
  - add Pending defects lpage
  - add LPS misalignment lpage (sbc4r10)
  - document '--All' ('-A') option
  - rework lto tape vendor lpages
  * sg_vpd: add Block limits extension VPD page
  - add Device constituents VPD page
  - add LB Protection VPD page (ssc 15-296r1)
  - LB provisioning VPD page: expand LBPRZ, add
    Minimum and Threshold percentage fields
  - rework lto tape vendor VPD pages
  * sg_inq+sg_vpd+sg_xcopy: add support for locally
    assigned UUIDs in VPD page 0x83 (15-267r2)
  * sg_sanitize: add --znr option (sbc4r07)
  * sg_rep_zones: add --partial option (zbc-r04)
  * sg_format: add ffmt option (sbc4r10)
  - add support for FORMAT MEDIUM (for tape)
  * sg_raw: document length relationships
  * rescan-scsi-bus.sh: updates from Suse
  * sg_lib_data: sync asc/ascq codes with T10 20151126
  * sg_lib: add 'sense' categories for SCSI statuses:
    condition met, busy, task set full, ACA active and
    task aborted
  - add pr2serr() extern
  - change sg_get_sense_str() and dStrHexStr(), return
    chars written (returned void previously)
  - add sg_get_sense_descriptors_str() function
  - add sg_get_designation_descriptor_str() function
  - sg_get_desig_type_str()+sg_get_desig_assoc_str()
    and sg_get_desig_code_set_str() added
  - sg_get_opcode_sa_name() break out zoning in/out,
    read attribute and read position service actions
  * sg_cmds_extra: add sg_ll_format_unit2() for FFMT
  * sg_pr2serr.h: new, to shorten fprintf(stderr, ...)
  * sg_io_linux, sg_pt_linux: drop SUGGEST_* decoding
  * sg_unaligned.h: add 48 bit support and gets for
    variable length unsigned integers
- Delete sg3_utils-sg_inq-blacklist.diff; solved differently
- Added 40-usb-blacklist.rules (bsc#840054)
- Delete sg3_utils-58-scsi-sg3_symlink-fixup.patch;
  merged with upstream
- Delete sg3_utils-flush-fixup.patch; merged with upstream</changelog>
  <changelog author="hare@suse.de" date="1461844800">- sg_inq,sg_vpd: Safe VPD page access (bsc#945094)
  * Add 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch</changelog>
  <changelog author="hare@suse.de" date="1461931200">- Update to new upstream release 1.43:
  * sg_senddiag: add --timeout=SEC option
  * sg_sanitize: add --timeout=SEC option
  * sg_format: add --timeout=SEC option
  * sg_decode sense: add --cdb option
  * sg_ses: handle 2 bit EIIOE field in aes dpage
  - expand join handling of SAS connectors and others
  - expand join debug code
  * sg_logs: fix volume statistics lpage when subpage
    is zero (ssc5r02a); decode mount history log parameter
  - decode Requested recovery, TapeAlert response, and
    Service buffer information lpages for tape
  - add '--pdt=DT' option
  * sg_inq: fix potential unbounded loop in --export
  - update version descriptor list to 20160420
  * sg_inq+sg_vpd: update Extended inquiry data vpd
    page (spc5r09)
  - add --force option to bypass checking supported
    vpd pages page and fetch requested page directly
  * sg_reassign+sg_write_same: fix ULONG_MAX problem
  * sg_turs+sg_requests: make both accept '--num=NUM'
    and '--number=NUM' for mutual compatibility
  * sg_zone: fix debug cdb naming
  * sg_opcode: add '--enumerate' and '--pdt=' options
  * sg_raw: add '--enumerate' option
  * sg_lib: add SSC maintenance in/out sa names
  - add read buffer(16) command mode names
  - add sg_decode_transportid_str()
  * sg_lib_data: sync asc/ascq codes with T10 20160425
  * rescan-scsi-bus.sh: harden code
  * clang --analyze static checker clean ups
  * shellcheck cleanup on scripts
  * automake: add AM_PROG_AR to configure.ac
  - upgrade to version 1.15
- Include patches from upstream:
  * sg_inq+sg_vpd: add --force option to bypass checking
    of supported vpd pages
  * sg_lib_data: add Bind and Unbind to service action out(16)
- Remove 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch; merged
  with upstream.</changelog>
  <changelog author="sparschauer@suse.de" date="1473249600">- using "--lun" now works correctly (bsc#981452), adding patch:
  * add-lunsearch-filter-to-searchexisting.patch</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Remove superfluous insserv PreReq.</changelog>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- Use separate repository for SLE15</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Spec file: add fc_wwpn_id to generate by-path links for
  fibrechannel (bsc#1005063)
- Update to version 1.44~763+17.35f525b:
  * Changed versioning scheme (svn r763, pre-release of
    upstream 1.44, plus 16 SUSE patches, SUSE git commit b2fedfa)
  * Code-identical to previous release except for the following:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)</changelog>
  <changelog author="mwilck@suse.com" date="1556625600">- Update to version 1.44~763+19.1ed0757:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
  (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.44~763+20.81dc714:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1657800000">- Update to version 1.44~763+21.3d16f61:
  * sg_turs: fix exit status when not ready in single case
    (boo#1095671)</changelog>
  <changelog author="mwilck@suse.com" date="1657800001">- Update to version 1.44~763+22.a121545:
  * Add systemd service files for LUN masking
  (bsc#1099278, bsc#954600)</changelog>
</package>
<package pkgid="10582be16120320f4d824fc9fd931210e1a815c78e002a7a129105daf43e167a" name="sg3_utils" arch="x86_64">
  <version epoch="0" ver="1.44~763+22.a121545" rel="150300.16.5.1"/>
  <changelog author="hare@suse.de" date="1455796800">- Update to new upstream release 1.42:
  * sg_timestamp: new, to report or set timestamp
  * sg_read_attr: new, supported by tape drives
  * sg_stpg: fix truncation of target port field
  * sg_inq: cope with unicode strings, udev fixes
  - update version descriptor list to 20160125
  - '--export': new entries for UUID descriptor
  * sg_ses: add more field acronyms (ses3r11)
  8 sg_logs: add Utilization lpage (sbc4r07)
  - add Background operation lpage
  - add Pending defects lpage
  - add LPS misalignment lpage (sbc4r10)
  - document '--All' ('-A') option
  - rework lto tape vendor lpages
  * sg_vpd: add Block limits extension VPD page
  - add Device constituents VPD page
  - add LB Protection VPD page (ssc 15-296r1)
  - LB provisioning VPD page: expand LBPRZ, add
    Minimum and Threshold percentage fields
  - rework lto tape vendor VPD pages
  * sg_inq+sg_vpd+sg_xcopy: add support for locally
    assigned UUIDs in VPD page 0x83 (15-267r2)
  * sg_sanitize: add --znr option (sbc4r07)
  * sg_rep_zones: add --partial option (zbc-r04)
  * sg_format: add ffmt option (sbc4r10)
  - add support for FORMAT MEDIUM (for tape)
  * sg_raw: document length relationships
  * rescan-scsi-bus.sh: updates from Suse
  * sg_lib_data: sync asc/ascq codes with T10 20151126
  * sg_lib: add 'sense' categories for SCSI statuses:
    condition met, busy, task set full, ACA active and
    task aborted
  - add pr2serr() extern
  - change sg_get_sense_str() and dStrHexStr(), return
    chars written (returned void previously)
  - add sg_get_sense_descriptors_str() function
  - add sg_get_designation_descriptor_str() function
  - sg_get_desig_type_str()+sg_get_desig_assoc_str()
    and sg_get_desig_code_set_str() added
  - sg_get_opcode_sa_name() break out zoning in/out,
    read attribute and read position service actions
  * sg_cmds_extra: add sg_ll_format_unit2() for FFMT
  * sg_pr2serr.h: new, to shorten fprintf(stderr, ...)
  * sg_io_linux, sg_pt_linux: drop SUGGEST_* decoding
  * sg_unaligned.h: add 48 bit support and gets for
    variable length unsigned integers
- Delete sg3_utils-sg_inq-blacklist.diff; solved differently
- Added 40-usb-blacklist.rules (bsc#840054)
- Delete sg3_utils-58-scsi-sg3_symlink-fixup.patch;
  merged with upstream
- Delete sg3_utils-flush-fixup.patch; merged with upstream</changelog>
  <changelog author="hare@suse.de" date="1461844800">- sg_inq,sg_vpd: Safe VPD page access (bsc#945094)
  * Add 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch</changelog>
  <changelog author="hare@suse.de" date="1461931200">- Update to new upstream release 1.43:
  * sg_senddiag: add --timeout=SEC option
  * sg_sanitize: add --timeout=SEC option
  * sg_format: add --timeout=SEC option
  * sg_decode sense: add --cdb option
  * sg_ses: handle 2 bit EIIOE field in aes dpage
  - expand join handling of SAS connectors and others
  - expand join debug code
  * sg_logs: fix volume statistics lpage when subpage
    is zero (ssc5r02a); decode mount history log parameter
  - decode Requested recovery, TapeAlert response, and
    Service buffer information lpages for tape
  - add '--pdt=DT' option
  * sg_inq: fix potential unbounded loop in --export
  - update version descriptor list to 20160420
  * sg_inq+sg_vpd: update Extended inquiry data vpd
    page (spc5r09)
  - add --force option to bypass checking supported
    vpd pages page and fetch requested page directly
  * sg_reassign+sg_write_same: fix ULONG_MAX problem
  * sg_turs+sg_requests: make both accept '--num=NUM'
    and '--number=NUM' for mutual compatibility
  * sg_zone: fix debug cdb naming
  * sg_opcode: add '--enumerate' and '--pdt=' options
  * sg_raw: add '--enumerate' option
  * sg_lib: add SSC maintenance in/out sa names
  - add read buffer(16) command mode names
  - add sg_decode_transportid_str()
  * sg_lib_data: sync asc/ascq codes with T10 20160425
  * rescan-scsi-bus.sh: harden code
  * clang --analyze static checker clean ups
  * shellcheck cleanup on scripts
  * automake: add AM_PROG_AR to configure.ac
  - upgrade to version 1.15
- Include patches from upstream:
  * sg_inq+sg_vpd: add --force option to bypass checking
    of supported vpd pages
  * sg_lib_data: add Bind and Unbind to service action out(16)
- Remove 0001-sg_vpd-sg_inq-Safe-VPD-page-access.patch; merged
  with upstream.</changelog>
  <changelog author="sparschauer@suse.de" date="1473249600">- using "--lun" now works correctly (bsc#981452), adding patch:
  * add-lunsearch-filter-to-searchexisting.patch</changelog>
  <changelog author="kukuk@suse.de" date="1487592000">- Remove superfluous insserv PreReq.</changelog>
  <changelog author="hare@suse.de" date="1502452800">- Drop patch merged with git repository
  * drop add-lunsearch-filter-to-searchexisting.patch
- Drop rules included in git repository
  * drop 40-usb-blacklist.rules
- Update to latest svn snapshot:
  * sg_rdac: add sanity checks for -f=lun value
  * sg_vpd improvements
  * sg_ses: fix uninitialized struct
  * sg_luns: resync with SAM and SPC drafts
  * sg_vpd: fix struct misalignment introduced by --force
  * sg_logs: add --vendor and fixup enumeration
- Port patches from SLES:
  * Add systemd service files for LUN masking (bsc#954600)
  * 55-scsi-sg3_id.rules: handle VPD page 0x80 correctly (bsc#1006469)
  * scripts: added udev rules for legacy CCISS (bsc#1006175)
  * rescan-scsi-bus.sh: Add lunsearch filter to findresized()
  (bsc#1027176)
  * Add fc_wwpn_id to generate by-path links for fibrechannel
  (bsc#1005063)
  * 55-scsi-sg3_id.rules: allow to override sysfs inquiry
  (bsc#1012523)
  * sg_inq: export all NAA values (bsc#1050767)
  * Silence gcc warnings</changelog>
  <changelog author="hare@suse.de" date="1507896000">- Update to svn r721:
  * Merge SUSE-specific patches with upstream svn
  * sg_write_atomic: add new program for WRITE ATOMIC
  * sg_bg_ctl: new background control command
  * sg_ses: Improve output and option handling
  * sg_logs: Add --vendor and decode more pages
  * sg_get_lba_status: add new program
  * Install rescan-scsi-bus.sh and scsi_logging_level per default</changelog>
  <changelog author="hare@suse.de" date="1511956800">- Update to svn r730:
  * Move testing utilities to 'testing' directory
  * sg_opcode: check resid and trim response
  * sg_rep_zones: expand --help option
  * sg_mode: Add Out-of-band management control page
  * sg_ses: filer join output on dpage element presence
  * documentation cleanup
- rescan-scsi-bus.sh: Add '--ignore-rev' option
- Supplement SCSI modaliases (bsc#1065212)</changelog>
  <changelog author="hare@suse.de" date="1513598400">- sg_inq: decode standard INQUIRY for CD-ROMs correctly (bsc#1070431)
- rescan-scsi-bus.sh: new option for ignore rev change
- rescan-scsi-bus.sh: Remove white space
- Add 'coreutils' to Requires (bsc#1072744)
- Add 'posttrans' to rpm spec (bsc#1071972)</changelog>
  <changelog author="hare@suse.de" date="1513944000">- sg_inq: check VPD page 0x0 before reading serial number
  (bsc#1067839)
- sg_inq: add option '-o/--only' to skip reading VPD pages
  (bsc#1067839)
- Revert 'postun' rpm spec changes after review</changelog>
  <changelog author="hare@suse.de" date="1518004800">- Update to svn r744:
  * sg_write_x: new command for normal/atomic/orwrite etc
    SCSI WRITE variants
  * sg_ses: add NVMe support
  * sg_inq: decode NVMe controller / NSIDs
- rescan_scsi_bus.sh: Fix manpage for --forcerescan
- 55-scsi-sg3_id.rules: fixes for scsi_id compability (bsc#1079873)
- 55-scsi-sg3_id.rules: run sg_inq for SPC devices (bsc#1079873)</changelog>
  <changelog author="hare@suse.de" date="1518091200">- Merge local patch with git repository
  * Delete sgut-libversioning.diff</changelog>
  <changelog author="hare@suse.de" date="1518177600">- Update to svn r751:
  * NVMe bugfixes
  * sg_seek: new utility
  * sg_stream_ctl: new utility program
- 54-before-scsi-sg3_id.rules: compability rule for systemd
  (bsc#1079873)
- Add dracut.conf to install new rule with dracut</changelog>
  <changelog author="mwilck@suse.com" date="1518436800">- dracut.conf: add whitespace at end of line (bsc#1080562)</changelog>
  <changelog author="hare@suse.de" date="1523016000">- Update to svn r763:
  * More NVMe bugfixes
  * sg_vpd: add device constituents vpd
  * sg_raw: add --raw option
  * sg_turs: add --low option
  * sg_ses: decoding dpage fixes; add --quiet option
- rescan-scsi-bus.sh: Fixup syntax error (bsc#1087008)
- Use separate repository for SLE15</changelog>
  <changelog author="mwilck@suse.com" date="1556193600">- Spec file: add fc_wwpn_id to generate by-path links for
  fibrechannel (bsc#1005063)
- Update to version 1.44~763+17.35f525b:
  * Changed versioning scheme (svn r763, pre-release of
    upstream 1.44, plus 16 SUSE patches, SUSE git commit b2fedfa)
  * Code-identical to previous release except for the following:
  * 59-fc-wwpn-id.rules: fix rule syntax (bsc#1133418)</changelog>
  <changelog author="mwilck@suse.com" date="1556625600">- Update to version 1.44~763+19.1ed0757:
  * rescan-scsi-bus.sh: use LUN wildcard in idlist (bsc#1069384)
  * 40-usb-blacklist.rules: use ID_SCSI_INQUIRY
  (bsc#840054, bsc#1131482)</changelog>
  <changelog author="mwilck@suse.com" date="1654084800">- Update to version 1.44~763+20.81dc714:
  * rescan-scsi-bus.sh: add timeout parameter (bsc#1199248)</changelog>
  <changelog author="mwilck@suse.com" date="1657800000">- Update to version 1.44~763+21.3d16f61:
  * sg_turs: fix exit status when not ready in single case
    (boo#1095671)</changelog>
  <changelog author="mwilck@suse.com" date="1657800001">- Update to version 1.44~763+22.a121545:
  * Add systemd service files for LUN masking
  (bsc#1099278, bsc#954600)</changelog>
</package>
<package pkgid="2253ff6af2a71fd8bb20bfe9e2984462071ed42a61f520bce759240321899767" name="spice" arch="src">
  <version epoch="0" ver="0.14.3" rel="150300.3.3.1"/>
  <changelog author="astieger@suse.com" date="1482408000">- restrict suppression of obsoletes-not-provided warning to
  spice-client bsc#1013916</changelog>
  <changelog author="cbosdonnat@suse.com" date="1486036800">- Synchronize with SLES (fate#322402):
  + bnc#894069: disable smartcard support for SLES
  + merge changelog</changelog>
  <changelog author="psimons@suse.com" date="1486036801">- Added patches to fix two security vulnerabilities.
  * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch
    [CVE-2016-9577, bsc#1023078]
  * CVE-2016-9578-remote-dos-via-crafted-message.patch
    [CVE-2016-9578, bsc#1023079]</changelog>
  <changelog author="cbosdonnat@suse.com" date="1509019200">- Release 0.14.0
  * fix client mouse with virgl
  * fix frozen display after seamless migration
  * set human-readable name on spice threads
  * add sanity-checks for ORC library as it can abort spice-server
    when selinux is in use
  * Close TCP connection early when client did not send the correct
    SPICE magic bytes: this allows VNC clients to gracefully fail
    when connecting to a SPICE port
  * Add VP9 encoding support when GStreamer is being used and misc
    streaming/encoding improvements
  * Improvements to replay utility
  * Limit (deprecated/unusud) QXLMessage size to 100,000 characters
    for improved safety
  * Improve image quality in low bitrate situation when using the
    GStreamer backend
  * Added GStreamer support to the video streaming code
  * Fix old migration bug causing migration to never end in some cases
  * Added lz4 compression to the spicevmc channel
  * Ongoing code cleanups
  * add spice_qxl_gl_scanout() spice_qxl_gl_draw_async() for local
    virgl support
  * spice_server_set_keepalive_timeout() has been removed in favour of
    unconditionally sending keepalive probes every 10 minutes
  * Added public spice_server_set_keepalive_timeout() to make it possible
    to tweak keepalive on all SPICE connection. This can prevent unwanted
    idle disconnections if proxies are used between the client and the host.
  * Fix important memory usage when the webdav channel is used
  * Do not disconnect when the client requests an unsupported compression type
  * Fix potential race condition when using multiple QXL devices
  * Fix display glitch when using XSpice
  * Improve help string for 'replay -s'
  * Fix small leak in MJPEG code
- Removed patches:
  * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch
  * CVE-2016-9578-remote-dos-via-crafted-message.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1516276800">- Enable smartcards on sle15 as the supportlib is available
  * Condition it using name everywhere instead of suse versions
    and join together with lz4
- Format with spec-cleaner
- Convert dependencies to pkgconfig style
- Install documentation and license file
- Add configure arguments to most of the options to not rely on
  autotools automatic behavior
  * Also enable gstreamer and lz4 options
- Drop the not needed python dependencies, they are needed only
  when building from git snapshot</changelog>
  <changelog author="tchvatal@suse.com" date="1517313600">- Split the sle condition again for exact features to allow their
  override</changelog>
  <changelog author="jengelh@inai.de" date="1517313601">- Correct RPM group for shared library.</changelog>
  <changelog author="cbosdonnat@suse.com" date="1531742400">- Avoid buffer overflow on image lz cheks (CVE-2018-10893, bsc#1101295)
  Added patches:
    0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch
    0002-lz-More-checks-on-image-sizes.patch</changelog>
  <changelog author="cbosdonnat@suse.com" date="1534766400">- Fix potential heap corruption when demarshalling (CVE-2018-10873,
  bsc#1104448)
  Added patch:
    bb15d481-Fix-flexible-array-buffer-overflow.patch</changelog>
  <changelog author="brogers@suse.com" date="1537358400">- Update to v0.14.1 stable release
  The announcement email describes this release as follows:
  The main change in this release is the addition of a new protocol
  extension in order to support streaming the remote display as a
  video stream rather than going through the QXL protocol. Together
  with spice-streaming-agent, and/or with more work on the qemu/
  spice-server side, this should allow streaming of 3D accelerated
  VMs in the future. At this point, this part of spice-server is
  still a work in progress (multi-monitor support and various
  features are missing).
  * avoid performance issues on Windows 10 KVM guests (boo#1109044)
  * add new org.spice-space.stream.0 channel used for passing an
    encoded video stream from the guest to the client
  * add support for TCP_CORK to reduce the amount of packets that
    we send
  * fix CVE-2018-10873 (maintainer note: we already carried fix)
  * fix cursor related migration crash
  * fix regression causing sound recording to be muted after client
    disconnection/reconnection (introduced in 0.13.90)
  * fix regression in corner cases where images could be sent
    uncompressed when they used to be compressed with QUIC
  * disable TLS 1.0 support
  * CELT 0.5.1 support is now disabled by default. If celt051-devel
    is installed at build-time, --enable-celt051/--disable-celt051
    must be explicitly specified
  * drop support for unsupported OpenSSL version. OpenSSL 1.0.0 or
    newer is now required
  * bumped minimum required glib version to 2.32
  * endianness fixes
  * (small) leak fixes
  * usual round of code cleanups
  * not directly related to this release, but the upstream git
    repository is now hosted on gitlab.freedesktop.org
- Removed patches:
    bb15d481-Fix-flexible-array-buffer-overflow.patch</changelog>
  <changelog author="astieger@suse.com" date="1537358401">- Upstream disabled support for the celt051 audio codec by default,
  do likewise in the spec
- Note updated 0.14.1 build dependencies in the spec:
  * OpenSSL 1.0.0 or newer is now required
  * glib 2.32 required
- add upstream signing key and verify source signature</changelog>
  <changelog author="brogers@suse.com" date="1548676800">- Fix OOB memory access in internal tracking of slot_ids and
  group_ids. (CVE-2019-3813 bsc#1122706)
  * 0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch
- Remove celt051 Requires directive</changelog>
  <changelog author="olaf@aepfle.de" date="1551441600">- Use plain python2 for SLE12 builds
- Remove PYTHON=python3, configure will find and use the python3</changelog>
  <changelog author="brogers@suse.com" date="1558008000">- Update to v0.14.2 stable release
  The main changes are support for Meson build and graphic device
  info messages allowing to better support multi-monitor
  configurations.
  * support H265 in stream-channel
  * add support for building with meson/ninja
  * minor tests fixes improving CI
  * set char device state for smartcard, allowing Qemu optimization
  * improve red-parse-qxl.c interface making it more consistent
  * add some instrumentation for streaming device
  * QXL interface: add a function to identify monitors in the guest
    (spice_qxl_set_device_info)
  * add support for GraphicsDeviceInfo messages
  * video-stream: prevent crash on stream reattach
  * make channel client callbacks virtual functions
  * bumped minimum required glib version to 2.38
  * attempt to have a reliable led state for keyboard modifiers
- Removed patches:
  (The first two are altered versions of what is carried upstream.
  I think we're fine with what upstream does here)
  0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch
  0002-lz-More-checks-on-image-sizes.patch
  0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch</changelog>
  <changelog author="9+suse@cirno.systems" date="1578657600">- Enable video codec support (VPX and MJPEG)</changelog>
  <changelog author="brogers@suse.com" date="1582891200">- Update to v0.14.3 release
  The main changes are WebSocket and support for Windows.
  * Add support for WebSocket, this will allow to use spice-html5
    without proxy
  * Support Windows, now Qemu Windows can be build enabling Spice
  * Fix some alignment problem
  * Converted some documentation to Asciidoc format to make easier
    to update, updated some
  * Minor compatibility fix for PPC64EL and ARMHF
  * Minor fixes for big endian machines like MIPS
  * Avoid some crashes with some buggy guest drivers, simply
    ignore the invalid request
  * Fix for old OpenSSL versions
  * Minor fix for Windows clients and brushes, fixed an issue with
    Photoshop under Windows 7
  * Add ability to query video-codecs
  * Small use-after-free fix
  * Fix for debugging recording/replaying using QUIC images
  * Fix a regression where spice reported no monitors to the client
  * Fix DoS in spicevmc if WebDAV used
  * Updated and improved test migration script
  * Some minor fixes to smartcard support
  * Avoid possible disconnection using proxies using a in-flow
    keepalive mechanism
- The NEWS file is now named CHANGELOG.md, and the previously
  provided ChangeLog, which was a summary of the git log is no
  longer provided</changelog>
  <changelog author="brogers@suse.com" date="1583755200">- Clean up some spec file conditionals that are no longer helpful</changelog>
  <changelog author="brogers@suse.com" date="1601899200">- Fix buffer overflow vunerabilities in QUIC image decoding
  (CVE-2020-14355 bsc#1177158)
  0001-quic-Check-we-have-some-data-to-start-decoding-quic-.patch
  0002-quic-Check-image-size-in-quic_decode_begin.patch
  0003-quic-Check-RLE-lengths.patch
  0004-quic-Avoid-possible-buffer-overflow-in-find_bucket.patch</changelog>
  <changelog author="brogers@suse.com" date="1602244800">- Note: The Mar 9, 2020 spec file cleanup and the following change
  satisfy jsc#SLE-15520
- Remove gstreamer-plugins-libav and gstreamer-plugins-good as
  BuildRequires. Even though the configure step of the package
  build does report detection of features from these packages, the
  build is actually not otherwise influenced by the presence of
  these packages. It is at runtime when these plugin packages are
  utilized, so leave the Recommends for these in the package spec,
  so that if the packages are available in a distro they can get
  installed and utilized.</changelog>
  <changelog author="carnold@suse.com" date="1622116800">- bsc#1181686 - VUL-0: CVE-2021-20201: spice,spice-gtk: client
  initiated renegotiation denial of service
  0001-With-OpenSSL-1.1-Disable-client-initiated-renegotiation.patch
  0002-With-OpenSSL-1.0.2-and-earlier-disable-client-side-renegotiation.patch</changelog>
</package>
<package pkgid="8e1dfae0c4745df928b6d8795e79f471f872b1032cd119c1f5bc81c502c3b602" name="sqlite3" arch="src">
  <version epoch="0" ver="3.39.3" rel="150000.3.17.1"/>
  <changelog author="astieger@suse.com" date="1517486400">- update to 3.22.0:
  * Add Zipfile virtual table to read and write a ZIP Archive.
  * Improved handling of WAL mode databases
  * various improvements, optimizations and bug fixes</changelog>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
</package>
<package pkgid="13a87090eb1eb118a8d40264748ceb400395af1741c313c53ec462435f92a6c6" name="sqlite3" arch="src">
  <version epoch="0" ver="3.39.3" rel="150000.3.20.1"/>
  <changelog author="astieger@suse.com" date="1522670400">- update to 3.23.0:
  * Add the sqlite3_serialize() and sqlite3_deserialize()
    interfaces when the SQLITE_ENABLE_DESERIALIZE compile-time
    option is used.
  * Recognize TRUE and FALSE as constants. (For compatibility, if
    there exist columns named "true" or "false", then the
    identifiers refer to the columns rather than Boolean constants.)
  * Support operators IS TRUE, IS FALSE, IS NOT TRUE, and IS NOT FALSE.
  * Added the SQLITE_DBSTATUS_CACHE_SPILL option to
    sqlite3_db_status() for reporting the number of cache spills
    that have occurred.
  * The "alternate-form-2" flag ("!") on the built-in printf
    implementation now causes string substitutions to measure the
    width and precision in characters instead of bytes.
  * If the xColumn method in a virtual table implementation returns
    an error message using sqlite3_result_error() then give that
    error message preference over internally-generated messages.
  * Added the -A command-line option to the CLI to make it easier to
    manage SQLite Archive files.
  * Add support for INSERT OR REPLACE, INSERT OR IGNORE, and UPDATE
    OR REPLACE in the Zipfile virtual table.
  * Enhance the sqlite3changeset_apply() interface so that it is
    hardened against attacks from deliberately corrupted changeset
    objects.
  * Added the sqlite3_normalize() extension function.
  * Query optimizer enhancements
  * Various bug fixes
  * Fix various issues reported by fuzzers, including:
    + CVE-2018-8740: NULL pointer dereference on CREATE TABLE as
    (bsc#1085790)</changelog>
  <changelog author="astieger@suse.com" date="1523448000">- update to 3.23.1:
  * Fix two problems in the new LEFT JOIN strength reduction
    optimization
  * Fix misbehavior of the FTS5 xBestIndex method
  * Fix a harmless reference to an uninitialized virtual machine
    register
  * Fix the eval.c extension so that it works with PRAGMA
    empty_result_callbacks=ON
  * Fix the generate_series virtual table so that it correctly
    returns no rows if any of its constraints are NULL
  * Performance enhancements in the parser</changelog>
  <changelog author="max@suse.com" date="1552996800">- CVE-2018-20346, bsc#1119687: Upgrade to the most recent version
  to fix a remote code execution vulnerability in FTS3 (Magellan).
- Drop sqlite-fts5-link.patch and do it in the spec file instead.
- Version 3.27.2:
  * Add the VACUUM INTO command
  * Issue an SQLITE_WARNING message on the error log if a
    double-quoted string literal is used
  * Add the remove_diacritics=2 option to FTS3 and FTS5.
  * Add  the SQLITE_PREPARE_NO_VTAB option to sqlite3_prepare_v3().
    Use that option to prevent circular references to shadow tables
    from causing resource leaks.
  * Enhancements to the sqlite3_deserialize() interface
  * Enhancements to the CLI, mostly to support testing and debugging
    of the SQLite library itself
  * Increased robustness against malicious SQL that is run against
    a maliciously corrupted database
- Version 3.26.0:
  * Optimization: When doing an UPDATE on a table with indexes on
    expressions, do not update the expression indexes if they do
    not refer to any of the columns of the table being updated.
  * Allow the xBestIndex() method of virtual table implementations
    to return SQLITE_CONSTRAINT to indicate that the proposed query
    plan is unusable and should not be given further consideration.
  * Added the SQLITE_DBCONFIG_DEFENSIVE option which disables the
    ability to create corrupt database files using ordinary SQL.
  * Added support for read-only shadow tables when the
    SQLITE_DBCONFIG_DEFENSIVE option is enabled.
  * Added the PRAGMA legacy_alter_table command, which if enabled
    causes the ALTER TABLE command to behave like older version of
    SQLite (prior to version 3.25.0) for compatibility.
  * Added PRAGMA table_xinfo that works just like PRAGMA table_info
    except that it also shows hidden columns in virtual tables.
  * Added the explain virtual table as a run-time loadable
    extension.
  * Add a limit counter to the query planner to prevent excessive
    sqlite3_prepare() times for certain pathological SQL inputs.
  * Added support for the sqlite3_normalized_sql() interface, when
    compiling with SQLITE_ENABLE_NORMALIZE.
  * Enhanced triggers so that they can use table-valued functions
    that exist in schemas other than the schema where the trigger
    is defined.
  * Improvements to the ".help" command in the CLI.
  * The SQLITE_HISTORY environment variable, if it exists,
    specifies the name of the command-line editing history file.
  * The --deserialize option associated with opening a new database
    in the CLI cause the database file to be read into memory and
    accessed using the sqlite3_deserialize() API. This simplifies
    running tests on a database without modifying the file on disk.
- Version 3.25.2:
  * Add the PRAGMA legacy_alter_table=ON command that causes the
    "ALTER TABLE RENAME" command to behave as in 3.24.0 and earlier
  * Fix issue with some expressions with windows functions in views
- Version 3.25.1:
  * Avoid false-positive error checks on ALTER TABLE
  * Further ORDER BY LIMIT optimization fixes for window functions
- Version 3.25.0:
  * Add support for window functions
  * Add support for renaming columns within a table
  * Query optimizer improvements
  * slightly better concurrency in multi-threaded environments
  * The ORDER BY LIMIT optimization might have caused an infinite
    loop in the byte code of the prepared statement under very
    obscure circumstances, due to a confluence of minor defects in
    the query optimizer
- Version 3.24.0:
  * Add support for PostgreSQL-style UPSERT
  * Add support for auxiliary columns in r-tree tables
  * Add C-language APIs for discovering SQL keywords used by SQLite
  * Add C-language APIs for dynamic strings based on sqlite3_str
  * Enhance ALTER TABLE so that it recognizes "true" and "false" as
    valid arguments to DEFAULT
  * Add the sorter-reference optimization as a compile-time option
  * Improve the format of the EXPLAIN QUERY PLAN raw output, so that
  it gives better information about the query plan and about the
    relationships between the various components of the plan
  * Added the SQLITE_DBCONFIG_RESET_DATABASE option to the
    sqlite3_db_config() API.
  * Automatically intercept the raw EXPLAIN QUERY PLAN output an
    reformat it into an ASCII-art graph.
  * Lines that begin with "#" and that are not in the middle of an
    SQL statement are interpreted as comments
  * Add the --append option to the ".backup" command
  * Add the ".dbconfig" command
  * various performance improvements
  * various bug fixes</changelog>
  <changelog author="max@suse.com" date="1555502400">- Upgrade to 3.28.0:
  * CVE-2019-9936, bsc#1130326: running fts5 prefix queries inside
    a transaction could trigger a heap-based buffer over-read.
  * CVE-2019-9937, bsc#1130325: interleaving reads and writes in a
    single transaction with an fts5 virtual table will lead to a
    NULL Pointer Dereference.
  * Enhanced window functions
  * Enhanced VACUUM INTO so that it works for read-only databases.
  * New query optimizations.
  * Added the sqlite3_value_frombind() API for determining if the
    argument to an SQL function is from a bound parameter.
  * Security and compatibilities enhancements to fts3_tokenizer().
  * Improved robustness against corrupt database files.</changelog>
  <changelog author="max@suse.com" date="1568116800">- bsc#1150137, CVE-2019-16168, sqlite3-CVE-2019-16168.patch:
  Improper validation of qlite_stat1 sz field leads to division by
  zero.</changelog>
  <changelog author="max@suse.com" date="1625054400">- Sync version 3.36.0 from Factory to implement jsc#SLE-16032.
- Obsoletes sqlite3-CVE-2019-16168.patch.
- The following CVEs have been fixed in upstream releases up to
  this point, but were not mentioned in the change log so far:
  * bsc#1173641, CVE-2020-15358: heap-based buffer overflow in
    multiSelectOrderBy due to mishandling of query-flattener
    optimization
  * bsc#1164719, CVE-2020-9327: NULL pointer dereference and
    segmentation fault because of generated column optimizations in
    isAuxiliaryVtabOperator
  * bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds
    with WITH stack unwinding even after a parsing error
  * bsc#1160438, CVE-2019-19959: memory-management error via
    ext/misc/zipfile.c involving embedded '\0' input
  * bsc#1160309, CVE-2019-19923: improper handling  of  certain uses
    of SELECT DISTINCT in flattenSubquery may lead to null pointer
    dereference
  * bsc#1159850, CVE-2019-19924: improper error handling in
    sqlite3WindowRewrite()
  * bsc#1159847, CVE-2019-19925: improper handling of NULL pathname
    during an update of a ZIP archive
  * bsc#1159715, CVE-2019-19926: improper handling  of certain
    errors during parsing  multiSelect in select.c
  * bsc#1159491, CVE-2019-19880: exprListAppendList in window.c
    allows attackers to trigger an invalid pointer dereference
  * bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE
    and CREATE VIEW statements, does not consider confusion with
    a shadow table name
  * bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an
    integrity_check PRAGMA command in certain cases of generated
    columns
  * bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger
    infinite recursion via certain types of self-referential views
    in conjunction with ALTER TABLE statements
  * bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits
    from the colUsed bitmask in the case of a generated column,
    which allows attackers to cause a denial of service
  * bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The
    function sqlite3Select in select.c allows a crash if a
    sub-select uses both DISTINCT and window functions, and also
    has certain ORDER BY usage
  * bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator
    vulnerability
  * bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of
    collation-sequence names
  * CVE-2020-13434 boo#1172115: integer overflow in
    sqlite3_str_vappendf
  * CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
  * CVE-2020-13631 boo#1172236: virtual table allowed to be renamed
    to one of its shadow tables
  * CVE-2020-13632 boo#1172240: NULL pointer dereference via
    crafted matchinfo() query
  * CVE-2020-13435: Malicious SQL statements could have crashed the
    process that is running SQLite (boo#1172091)</changelog>
  <changelog author="max@suse.com" date="1638273600">- SQLite3 3.37.0:
  * STRICT tables provide a prescriptive style of data type
    management, for developers who prefer that kind of thing.
  * When adding columns that contain a CHECK constraint or a
    generated column containing a NOT NULL constraint, the
    ALTER TABLE ADD COLUMN now checks new constraints against
    preexisting rows in the database and will only proceed if no
    constraints are violated.
  * Added the PRAGMA table_list statement.
  * Add the .connection command, allowing the CLI to keep multiple
    database connections open at the same time.
  * Add the --safe command-line option that disables dot-commands
    and SQL statements that might cause side-effects that extend
    beyond the single database file named on the command-line.
  * CLI: Performance improvements when reading SQL statements that
    span many lines.
  * Added the sqlite3_autovacuum_pages() interface.
  * The sqlite3_deserialize() does not and has never worked
    for the TEMP database. That limitation is now noted in the
    documentation.
  * The query planner now omits ORDER BY clauses on subqueries and
    views if removing those clauses does not change the semantics
    of the query.
  * The generate_series table-valued function extension is modified
    so that the first parameter ("START") is now required. This is
    done as a way to demonstrate how to write table-valued
    functions with required parameters. The legacy behavior is
    available using the -DZERO_ARGUMENT_GENERATE_SERIES
    compile-time option.
  * Added new sqlite3_changes64() and sqlite3_total_changes64()
    interfaces.
  * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
  * Use less memory to hold the database schema.
  * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert
    extension when a column has no collating sequence.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641124800">- update to 3.37.1:
  * Fix a bug introduced by the UPSERT enhancements of version
    3.35.0 that can cause incorrect byte-code to be generated for
    some obscure but valid SQL, possibly resulting in a NULL-
    pointer dereference.
  * Fix an OOB read that can occur in FTS5 when reading corrupt
    database files.
  * Improved robustness of the --safe option in the CLI.
  * Other minor fixes to assert() statements and test cases.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1641988800">- update to 3.37.2:
  * Fix a bug introduced in version 3.35.0 (2021-03-12) that can
    cause database corruption if a SAVEPOINT is rolled back while
    in PRAGMA temp_store=MEMORY mode, and other changes are made,
    and then the outer transaction commits
  * Fix a long-standing problem with ON DELETE CASCADE and ON
    UPDATE CASCADE in which a cache of the bytecode used to
    implement the cascading change was not being reset following a
    local DDL change</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1645876800">- update to 3.38.0
  * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON
  * The JSON functions are now built-ins
  * Enhancements to date and time functions
  * Rename the printf() SQL function to format() for better
    compatibility, with alias for backwards compatibility.
  * Add the sqlite3_error_offset() interface for helping localize
    an SQL error to a specific character in the input SQL text
  * Enhance the interface to virtual tables
  * CLI columnar output modes are enhanced to correctly handle tabs
    and newlines embedded in text, and add options like "--wrap N",
    "--wordwrap on", and "--quote" to the columnar output modes.
  * Query planner enhancements using a Bloom filter to speed up
    large analytic queries, and a balanced merge tree to evaluate
    UNION or UNION ALL compound SELECT statements that have an
    ORDER BY clause.
  * The ALTER TABLE statement is changed to silently ignores
    entries in the sqlite_schema table that do not parse when
    PRAGMA writable_schema=ON</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1647172800">- update to 3.38.1:
  * Fix problems with the new Bloom filter optimization that might
    cause some obscure queries to get an incorrect answer.
  * Fix the localtime modifier of the date and time functions so
    that it preserves fractional seconds.
  * Fix the sqlite_offset SQL function so that it works correctly
    even in corner cases such as when the argument is a virtual
    column or the column of a view.
  * Fix row value IN operator constraints on virtual tables so that
    they work correctly even if the virtual table implementation
    relies on bytecode to filter rows that do not satisfy the
    constraint.
  * Other minor fixes to assert() statements, test cases, and
    documentation. See the source code timeline for details.
- add upstream patch to run atof1 tests only on x86_64
  sqlite-src-3380100-atof1.patch</changelog>
  <changelog author="max@suse.com" date="1647432000">- Remove obsolete configure flags
- Package the Tcl bindings here again so that we only ship one copy
  of SQLite (bsc#1195773).</changelog>
  <changelog author="max@suse.com" date="1648555200">- update to 3.38.2:
  * Fix a problem with the Bloom filter optimization that might
    cause an incorrect answer when doing a LEFT JOIN with a WHERE
    clause constraint that says that one of the columns on the
    right table of the LEFT JOIN is NULL.
  * Other minor patches.</changelog>
  <changelog author="info@paolostivanin.com" date="1651147200">- update to 3.38.3:
  * Fix a case of the query planner be overly aggressive with
    optimizing automatic-index and Bloom-filter construction,
    using inappropriate ON clause terms to restrict the size of the
    automatic-index or Bloom filter, and resulting in missing rows
    in the output.
  * Other minor patches. See the timeline for details.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1652011200">- update to 3.38.5:
  * Fix a blunder in the CLI of the 3.38.4 release
- includes changes from 3.38.4:
  * fix a byte-code problem in the Bloom filter pull-down
    optimization added by release 3.38.0 in which an error in the
    byte code causes the byte code engine to enter an infinite loop
    when the pull-down optimization encounters a NULL key</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1656676800">- update to 3.39.0:
  * Add (long overdue) support for RIGHT and FULL OUTER JOIN
  * Add new binary comparison operators IS NOT DISTINCT FROM and
    IS DISTINCT FROM that are equivalent to IS and IS NOT,
    respective, for compatibility with PostgreSQL and SQL standards
  * Add a new return code (value "3") from the sqlite3_vtab_distinct()
    interface that indicates a query that has both DISTINCT and
    ORDER BY clauses
  * Added the sqlite3_db_name() interface
  * The unix os interface resolves all symbolic links in database
    filenames to create a canonical name for the database before
    the file is opened
  * Defer materializing views until the materialization is actually
    needed, thus avoiding unnecessary work if the materialization
    turns out to never be used
  * The HAVING clause of a SELECT statement is now allowed on any
    aggregate query, even queries that do not have a GROUP BY
    clause
  * Many microoptimizations collectively reduce CPU cycles by about
    2.3%.
- drop sqlite-src-3380100-atof1.patch, included upstream
- add sqlite-src-3390000-func7-pg-181.patch to skip float precision
  related test failures on 32 bit</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1657886400">- update to 3.39.1:
  * Fix an incorrect result from a query that uses a view that
    contains a compound SELECT in which only one arm contains a
    RIGHT JOIN and where the view is not the first FROM clause term
    of the query that contains the view
  * Fix a long-standing problem with ALTER TABLE RENAME that can
    only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set
    to a very small value.
  * Fix a long-standing problem in FTS3 that can only arise when
    compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time
    option.
  * Fix the initial-prefix optimization for the REGEXP extension so
    that it works correctly even if the prefix contains characters
    that require a 3-byte UTF8 encoding.
  * Enhance the sqlite_stmt virtual table so that it buffers all of
    its output.</changelog>
  <changelog author="max@suse.com" date="1658404800">- update to 3.39.2:
  * Fix a performance regression in the query planner associated
    with rearranging the order of FROM clause terms in the
    presences of a LEFT JOIN.
  * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and
    1345947, forum post 3607259d3c, and other minor problems
    discovered by internal testing. [boo#1201783]</changelog>
  <changelog author="max@suse.com" date="1662379200">- update to 3.39.3:
  * Use a statement journal on DML statement affecting two or more
    database rows if the statement makes use of a SQL functions
    that might abort.
  * Use a mutex to protect the PRAGMA temp_store_directory and
    PRAGMA data_store_directory statements, even though they are
    decremented and documented as not being threadsafe.</changelog>
  <changelog author="max@suse.com" date="1670932800">- bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch:
  relying on --safe for execution of an untrusted CLI script</changelog>
</package>
<package pkgid="0c330eb378f835b63d81a41cf344198d8f031ee4c73537680f1cb55639bc5fcb" name="sssd" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="bd1f947cecb63e8d3be057e47e7ad0a90f7497d944099c22eb7a43d39296536e" name="sssd" arch="src">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="8a5a39e439d6d9acd1a2010129e4b3c028a55b585dcb1287e754832634eaa6a6" name="sssd" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="c01ce51c7e4701d04a4bfe963adf5710cd852823decd99f7da618a43b3f60399" name="sssd" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="4b10810ba07d5018172761fa8bc47f4192448cc2c544a4a33da3e43a5861a1b3" name="sssd" arch="src">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="aede99d9dba184f76086acabb6005fafd403bf82e6e77050e919a88bb7a410b2" name="sssd" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="2aa8f3324d049a62070060f6643d1c271d598849c13f0eaa461c3d7ea58ba707" name="sssd-common" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="4be76d3718ecbcfec927098581be66743d4d24e0303254fa72283dc4ef1716c7" name="sssd-common" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="0bb53e5da78d6fc3c6258c79c04657b7ded8a1dd3940e9b6fe6e24978a4c3609" name="sssd-common" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="9f9aeebf73540edf7cf5ceb1eae208219dacfd27a4f08a2ffc17299b0a746966" name="sssd-common" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="561d5c9d65a9d066d9658a8a6b62db09aa42a866711fb11e9c157c093dda2314" name="sssd-krb5-common" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="62cf8301a2279d04219a50e51b0de4050c54c94818e959a0af881fb1aab28dc0" name="sssd-krb5-common" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="8adc57816e97319f072f8a8548303927eaf2de21ee54ef0f7e67317c5fd9b935" name="sssd-krb5-common" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="b7c7c581d6df32b75e88e17bd5768a2ace1c974916ba47631e9190300b4573fc" name="sssd-krb5-common" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="ec2a5abab62cea47737e5a23d20bacf60ba19a03e8bcdbc2ec00dc1088dfeb5a" name="sssd-ldap" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="ba2710ec49aec030988fd36c0b8a573c8598b1460c77ee630ff799462b28397e" name="sssd-ldap" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.34.1"/>
  <changelog author="dmulder@suse.com" date="1578916800">- SSSD GPO host entries are ignored if computer cn does not
  match it's samaccountname, add
  0001-Resolve-computer-lookup-failure-when-sam-cn.patch;
  (jsc#SLE-9298); (bsc#1160688)</changelog>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
</package>
<package pkgid="b0903e48062a677aad4d593e9874b137f18906cf4f66a9a2425f4559174a97e8" name="sssd-ldap" arch="aarch64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="6bedeee97198253163210e9036b0f7a9b1cad49cafad614dc075f5052ae48ee5" name="sssd-ldap" arch="x86_64">
  <version epoch="0" ver="1.16.1" rel="150300.23.37.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628596800">- Add LDAPS support for the AD provider; (bsc#1183735);
  Add 0045-ldaps-for-ad-provider.patch
- Improve logs to record the reason why internal watchdog terminates
  a process; (bsc#1187120); Adds:
  * 0041-DEBUG-changed-timestamp-output-format.patch
  * 0042-DEBUG-introduce-new-SSSDBG_TRACE_LDB-level.patch
  * 0043-DEBUG-changed-debug_prg_name-format.patch
  * 0044-WATCHDOG-log-process-termination-to-the-journal.patch
- Fix watchdog not terminating tasks; (bsc#1187120);
  Add 0040-util-watchdog-fixed-watchdog-implementation.patch</changelog>
  <changelog author="scabrero@suse.de" date="1629201600">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0046-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="scabrero@suse.de" date="1631102400">- Fix a crash with newer libcares2 versions when the library fails
  to parse a dns name; (bsc#1190021); Add
  0047-RESOLV-handle-fail-of-ares_parse_-_reply-properly.patch</changelog>
  <changelog author="nopower@suse.com" date="1642248000">- Fix tests test_copy_ccache &amp; test_copy_keytab for later versions
  of krb5; (jsc#SLE-23329);
  - Add 0048-tests-fix-mocking-krb5_creds-in-test_copy_ccache.patch
  - Add 0049-tests-fix-enctypes-in-test_copy_keytab.patch
  - Add 0050-BUILD-Accept-krb5-1.17-for-building-the-PAC-plugin.patch
  - Add 0051-BUILD-Accept-krb5-1.19-for-building-the-PAC-plugin.patch
- Update spec file to requires newer ldb version
- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0052-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix a crash caused by a read-after-free condition; (bsc#1196564);
  Add patch 0053-SBUS-defer-deallocation-of-sbus_watch_ctx.patch</changelog>
  <changelog author="scabrero@suse.de" date="1652270400">- Update sss_cache command's manpage to clarify its effects on the
  memory cache; (bsc#1199393); Add
  0054-man-clarify-effects-of-sss_cache-on-the-memory-cache.patch</changelog>
  <changelog author="scabrero@suse.de" date="1657713600">- Create kdcinfo file for sub-domains; (bsc#1197925);
  Add 0055-Populate-kdcinfo-files-on-trust-clients.patch</changelog>
  <changelog author="scabrero@suse.de" date="1674648000">- libsss_certmap fails to sanitise certificate data used in LDAP
  filters; (CVE-2022-4254); (bsc#1207474); Add patch
  0056-certmap-sanitize-LDAP-search-filter.patch</changelog>
</package>
<package pkgid="a3d91b7c9a9d8e3dabda991deb5ceae41e74fb68a26cbd04e18986cfa0e9f5f0" name="sudo" arch="aarch64">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.13.1"/>
  <changelog author="kstreitova@suse.com" date="1587124800">- build with enable-python to support python plugins</changelog>
  <changelog author="kstreitova@suse.com" date="1588766400">- Update to 1.9.0rc3
  * The sudo-logsrvd package now installs a systemd service on Linux
    distros that use systemd.
  * The I/O plugin is now closed before the policy plugin on command
    exit.
  * When copying the edited files to the original path, sudoedit now
    allocates any additional space needed before writing. Previously,
    it could truncate the destination file if the file system was
    full. Bug #922.
  * Fixed a compilation issue with Python 3.8.
  * Changed how TLS connections are made to the log server. Instead
    of using a starttls type approach where TLS and plaintext
    connections share the same point we now use separate ports for
    plaintext and TLS connections. A (tls) flag can be specified after
    the host:port to indicate that the connection should be secured
    with TLS. This avoids a potention man-in-the-middle attack that
    could cause the connection to be forced into plaintext mode.
    Unfortunately, this change breaks compatibility with the
    previous release candidates.</changelog>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
</package>
<package pkgid="11b121d9a8387f6f997b0bb4b4f40f75a3742d1c911eedb693ae4cb0c7fe67b2" name="sudo" arch="src">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.13.1"/>
  <changelog author="kstreitova@suse.com" date="1587124800">- build with enable-python to support python plugins</changelog>
  <changelog author="kstreitova@suse.com" date="1588766400">- Update to 1.9.0rc3
  * The sudo-logsrvd package now installs a systemd service on Linux
    distros that use systemd.
  * The I/O plugin is now closed before the policy plugin on command
    exit.
  * When copying the edited files to the original path, sudoedit now
    allocates any additional space needed before writing. Previously,
    it could truncate the destination file if the file system was
    full. Bug #922.
  * Fixed a compilation issue with Python 3.8.
  * Changed how TLS connections are made to the log server. Instead
    of using a starttls type approach where TLS and plaintext
    connections share the same point we now use separate ports for
    plaintext and TLS connections. A (tls) flag can be specified after
    the host:port to indicate that the connection should be secured
    with TLS. This avoids a potention man-in-the-middle attack that
    could cause the connection to be forced into plaintext mode.
    Unfortunately, this change breaks compatibility with the
    previous release candidates.</changelog>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
</package>
<package pkgid="0bfdfa331b15a0e63fafa2b9ab42c371961b906792c29a8ae5a7014d131fd103" name="sudo" arch="x86_64">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.13.1"/>
  <changelog author="kstreitova@suse.com" date="1587124800">- build with enable-python to support python plugins</changelog>
  <changelog author="kstreitova@suse.com" date="1588766400">- Update to 1.9.0rc3
  * The sudo-logsrvd package now installs a systemd service on Linux
    distros that use systemd.
  * The I/O plugin is now closed before the policy plugin on command
    exit.
  * When copying the edited files to the original path, sudoedit now
    allocates any additional space needed before writing. Previously,
    it could truncate the destination file if the file system was
    full. Bug #922.
  * Fixed a compilation issue with Python 3.8.
  * Changed how TLS connections are made to the log server. Instead
    of using a starttls type approach where TLS and plaintext
    connections share the same point we now use separate ports for
    plaintext and TLS connections. A (tls) flag can be specified after
    the host:port to indicate that the connection should be secured
    with TLS. This avoids a potention man-in-the-middle attack that
    could cause the connection to be forced into plaintext mode.
    Unfortunately, this change breaks compatibility with the
    previous release candidates.</changelog>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
</package>
<package pkgid="3de9d86ff0230d5dd890a42e12ed90b978c903612992b71901985531737682e2" name="sudo" arch="aarch64">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.16.1"/>
  <changelog author="kstreitova@suse.com" date="1588766400">- Update to 1.9.0rc3
  * The sudo-logsrvd package now installs a systemd service on Linux
    distros that use systemd.
  * The I/O plugin is now closed before the policy plugin on command
    exit.
  * When copying the edited files to the original path, sudoedit now
    allocates any additional space needed before writing. Previously,
    it could truncate the destination file if the file system was
    full. Bug #922.
  * Fixed a compilation issue with Python 3.8.
  * Changed how TLS connections are made to the log server. Instead
    of using a starttls type approach where TLS and plaintext
    connections share the same point we now use separate ports for
    plaintext and TLS connections. A (tls) flag can be specified after
    the host:port to indicate that the connection should be secured
    with TLS. This avoids a potention man-in-the-middle attack that
    could cause the connection to be forced into plaintext mode.
    Unfortunately, this change breaks compatibility with the
    previous release candidates.</changelog>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
</package>
<package pkgid="9ddcb76aeccb77589e396802a9019671e32560b281aeed8ea67f1dd1e1ff5458" name="sudo" arch="src">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.16.1"/>
  <changelog author="kstreitova@suse.com" date="1588766400">- Update to 1.9.0rc3
  * The sudo-logsrvd package now installs a systemd service on Linux
    distros that use systemd.
  * The I/O plugin is now closed before the policy plugin on command
    exit.
  * When copying the edited files to the original path, sudoedit now
    allocates any additional space needed before writing. Previously,
    it could truncate the destination file if the file system was
    full. Bug #922.
  * Fixed a compilation issue with Python 3.8.
  * Changed how TLS connections are made to the log server. Instead
    of using a starttls type approach where TLS and plaintext
    connections share the same point we now use separate ports for
    plaintext and TLS connections. A (tls) flag can be specified after
    the host:port to indicate that the connection should be secured
    with TLS. This avoids a potention man-in-the-middle attack that
    could cause the connection to be forced into plaintext mode.
    Unfortunately, this change breaks compatibility with the
    previous release candidates.</changelog>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
</package>
<package pkgid="7eff06bf98fe094bee6d7290e80511e7f369d76652eb159cf157832242af4e73" name="sudo" arch="x86_64">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.16.1"/>
  <changelog author="kstreitova@suse.com" date="1588766400">- Update to 1.9.0rc3
  * The sudo-logsrvd package now installs a systemd service on Linux
    distros that use systemd.
  * The I/O plugin is now closed before the policy plugin on command
    exit.
  * When copying the edited files to the original path, sudoedit now
    allocates any additional space needed before writing. Previously,
    it could truncate the destination file if the file system was
    full. Bug #922.
  * Fixed a compilation issue with Python 3.8.
  * Changed how TLS connections are made to the log server. Instead
    of using a starttls type approach where TLS and plaintext
    connections share the same point we now use separate ports for
    plaintext and TLS connections. A (tls) flag can be specified after
    the host:port to indicate that the connection should be secured
    with TLS. This avoids a potention man-in-the-middle attack that
    could cause the connection to be forced into plaintext mode.
    Unfortunately, this change breaks compatibility with the
    previous release candidates.</changelog>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
</package>
<package pkgid="3a7fe1e9b8e9afe09923fb7cd76699af7f0f8b559ea62e1cd95ab00424e01b3d" name="sudo" arch="aarch64">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.19.1"/>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
  <changelog author="jsikes@suse.com" date="1673870400">- Added sudo-CVE-2023-22809.patch
  * CVE-2023-22809
  * bsc#1207082
  * Prevent '--' in the EDITOR environment variable which can allow
    users to edit sensitive files as root.</changelog>
</package>
<package pkgid="b463ac849f24e3d2e257ec231e345c3a8948f72392898456561c9d25059d6f3d" name="sudo" arch="src">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.19.1"/>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
  <changelog author="jsikes@suse.com" date="1673870400">- Added sudo-CVE-2023-22809.patch
  * CVE-2023-22809
  * bsc#1207082
  * Prevent '--' in the EDITOR environment variable which can allow
    users to edit sensitive files as root.</changelog>
</package>
<package pkgid="2a0468daa546e37a94ceabf58526172d42674664822ffea15a587639158edd24" name="sudo" arch="x86_64">
  <version epoch="0" ver="1.9.5p2" rel="150300.3.19.1"/>
  <changelog author="kstreitova@suse.com" date="1588852800">- Update to 1.9.0rc4
  * Various spelling fixes. Bug #925.
  * The struct passwd passed to PAM session modules is now looked up
    by user name, not user-ID, when possible. Fixes a problem with
    the pam_limits module and configurations where multiple user names
    share the same ID. Debian bug #734752.
  * Sudo command line options that take a value may only be specified
    once. This is to help guard against problems caused by poorly
    written scripts that invoke sudo with user-controlled input. Bug #924.</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- Update to 1.9.0rc5
  * The default TLS listener is now only enabled when either the
    TLS certificate file is explicitly specified in sudo_logsrvd.conf
    or the default TLS certificate file exists in the file system.
    There is no change in behavior for listen_address entries
    explicitly set in the configuration file.</changelog>
  <changelog author="kstreitova@suse.com" date="1589803200">- Update to 1.9.0 (current stable release)
  * for changes between version 1.9.0 and 1.8.31p1 see rc changes
    below</changelog>
  <changelog author="vcizek@suse.com" date="1592568000">- Update to 1.9.1
  * Fixed an AIX-specific problem when I/O logging was enabled.
    The terminal device was not being properly set to raw mode.
    Bug #927.
  * Corrected handling of sudo_logsrvd connections without associated
    I/O log data.  This fixes support for RejectMessage as well as
    AcceptMessage when the expect_iobufs flag is not set.
  * Added an "iolog_path" entry to the JSON-format event log produced
    by sudo_logsrvd.  Previously, it was only possible to determine
    the I/O log file an event belonged to using sudo-format logs.
  * Fixed the bundle IDs for sudo-logsrvd and sudo-python macOS packages.
  * I/O log files produced by the sudoers plugin now clear the write
    bits on the I/O log timing file when the log is complete.  This
    is consistent with how sudo_logsrvd indicates that a log is
    complete.
  * The sudoreplay utility has a new "-F" (follow) command line
    option to allow replaying a session that is still in progress,
    similar to "tail -f".
  * The @include and @includedir directives can be used in sudoers
    instead of #include and #includedir.  In addition, include paths
    may now have embedded white space by either using a double-quoted
    string or escaping the space characters with a backslash.
  * When running a command in a pty, sudo will no longer try to
    suspend itself if the user's tty has been revoked (for instance
    when the parent ssh daemon is killed).  This fixes a bug where
    sudo would continuously suspend the command (which would succeed),
    then suspend itself (which would fail due to the missing tty)
    and then resume the command.
  * If sudo's event loop fails due to the tty being revoked, remove
    the user's tty events and restart the event loop (once).  This
    fixes a problem when running "sudo reboot" in a pty on some
    systems.  When the event loop exited unexpectedly, sudo would
    kill the command running in the pty, which in the case of "reboot",
    could lead to the system being in a half-rebooted state.
  * Fixed a regression introduced in sudo 1.8.23 in the LDAP and
    SSSD back-ends where a missing sudoHost attribute was treated
    as an "ALL" wildcard value.  A sudoRole with no sudoHost attribute
    is now ignored as it was prior to version 1.8.23.
  * The audit plugin API has been changed slightly.  The sudo front-end
    now audits an accept event itself after all approval plugins are
    run and the I/O logging plugins (if any) are opened.  This makes
    it possible for an audit plugin to only log a single overall
    accept event if desired.
  * The sudoers plugin can now be loaded as an audit plugin.  Logging
    of successful commands is now performed in the audit plugin's
    accept function.  As a result, commands are now only logged if
    allowed by sudoers and all approval plugins.  Commands rejected
    by an approval plugin are now also logged by the sudoers plugin.
  * Romanian translation for sudo and sudoers from translationproject.org.
  * Fixed a regression introduced in sudo 1.9.0 where sudoedit did
    not remove its temporary files after installing them.  Bug #929.
  * Fixed a regression introduced in sudo 1.9.0 where the iolog_file
    setting in sudoers and sudo_logsrvd.conf caused an error if the
    file name ended in six or more X's.</changelog>
  <changelog author="kukuk@suse.com" date="1593432000">- Move python plugin support to own sub-package, we don't want
  python in a really minimal system [bsc#1173200]</changelog>
  <changelog author="info@paolostivanin.com" date="1595592000">- Update to 1.9.2:
  * The configure script now uses pkg-config to find the openssl cflags
    and libs where possible.
  * The contents of the log.json I/O log file is now documented in
    the sudoers manual.
  * The sudoers plugin now properly exports the sudoers_audit symbol
    on systems where the compiler lacks symbol visibility controls.
    This caused a regression in 1.9.1 where a successful sudo command
    was not logged due to the missing audit plugin. Bug #931.
  * Fixed a regression introduced in 1.9.1 that can result in crash
    when there is a syntax error in the sudoers file. Bug #934.
- Rebase sudo-sudoers.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1598356800">- This rpm packages decides about the permissions of /etc/sudoers.d</changelog>
  <changelog author="marco.varlese@suse.com" date="1599480000">- Modified the secure_path to include the other two default paths
  which are commonly available to $user. This will offer a better
  and more consistent UX.</changelog>
  <changelog author="kstreitova@suse.com" date="1605268800">- Update to 1.9.3p1
  * Fixed a regression introduced in sudo 1.9.3 where the configure
    script would not detect the crypt(3) function if it was present
    in the C library, not an additional library.
  * Fixed a regression introduced in sudo 1.8.23 with shadow passwd
    file authentication on OpenBSD.  BSD authentication was not
    affected.
  * Sudo now logs when a user-specified command-line option is
    rejected by a sudoers rule.  Previously, these conditions were
    written to the audit log, but the default sudo log file.  Affected
    command line arguments include -C (--close-from), -D (--chdir),
  - R (--chroot), -g (--group) and -u (--user).
- News in 1.9.3
  * Fixed building the Python plugin on systems with a compiler that
    doesn't support symbol hiding.
  * Sudo now uses a linker script to hide symbols even when the
    compiler has native symbol hiding support.  This should make it
    easier to detect omissions in the symbol exports file, regardless
    of the platform.
  * Fixed the libssl dependency in Debian packages for older releases
    that use libssl1.0.0.
  * Sudo and visudo now provide more detailed messages when a syntax
    error is detected in sudoers.  The offending line and token are
    now displayed.  If the parser was generated by GNU bison,
    additional information about what token was expected is also
    displayed.  Bug #841.
  * Sudoers rules must now end in either a newline or the end-of-file.
    Previously, it was possible to have multiple rules on a single
    line, separated by white space.  The use of an end-of-line
    terminator makes it possible to display accurate error messages.
  * Sudo no longer refuses to run if a syntax error in the sudoers
    file is encountered.  The entry with the syntax error will be
    discarded and sudo will continue to parse the file.  This makes
    recovery from a syntax error less painful on systems where sudo
    is the primary method of superuser access.  The historic behavior
    can be restored by add "error_recovery=false" to the sudoers
    plugin's optional arguments in sudo.conf.  Bug #618.
  * Fixed the sample_approval plugin's symbol exports file for systems
    where the compiler doesn't support symbol hiding.
  * Fixed a regression introduced in sudo 1.9.1 where arguments to
    the "sudoers_policy" plugin in sudo.conf were not being applied.
    The sudoers file is now parsed by the "sudoers_audit" plugin,
    which is loaded implicitly when "sudoers_policy" is listed in
    sudo.conf.  Starting with sudo 1.9.3, if there are plugin arguments
    for "sudoers_policy" but "sudoers_audit" is not listed, those
    arguments will be applied to "sudoers_audit" instead.
  * The user's resource limits are now passed to sudo plugins in
    the user_info[] list.  A plugin cannot determine the limits
    itself because sudo changes the limits while it runs to prevent
    resource starvation.
  * It is now possible to set the working directory or change the
    root directory on a per-command basis using the CWD and CHROOT
    options.  There are also new Defaults settings, runchroot and
    runcwd, that can be used to set the working directory or root
    directory on a more global basis.
  * New -D (--chdir) and -R (--chroot) command line options can be
    used to set the working directory or root directory if the sudoers
    file allows it.  This functionality is not enabled by default
    and must be explicitly enabled in the sudoers file.
- add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before
  executing the command. Fixes a problem with pam_xauth which
  checks effective and real uids to get the real identity of the
  user [bsc#1174593]</changelog>
  <changelog author="kstreitova@suse.com" date="1606737600">- Update to 1.9.4
  * The sudoers parser will now detect when an upper-case reserved
    word is used when declaring an alias.  Now instead of "syntax
    error, unexpected CHROOT, expecting ALIAS" the message will be
    "syntax error, reserved word CHROOT used as an alias name".
    Bug #941.
  * Better handling of sudoers files without a final newline.
    The parser now adds a newline at end-of-file automatically which
    removes the need for special cases in the parser.
  * Fixed a regression introduced in sudo 1.9.1 in the sssd back-end
    where an uninitialized pointer could be freed on an error path.
    GitHub issue #67.
  * The core logging code is now shared between sudo_logsrvd and
    the sudoers plugin.
  * JSON log entries sent to syslog now use "minimal" JSON which
    skips all non-essential whitespace.
  * The sudoers plugin can now produce JSON-formatted logs.  The
    "log_format" sudoers option can be used to select sudo or json
    format logs.  The default is sudo format logs.
  * The sudoers plugin and visudo now display the column number in
    syntax error messages in addition to the line number.  Bug #841.
  * If I/O logging is not enabled but "log_servers" is set, the
    sudoers plugin will now log accept events to sudo_logsrvd.
    Previously, the accept event was only sent when I/O logging was
    enabled.  The sudoers plugin now sends reject and alert events too.
  * The sudo logsrv protocol has been extended to allow an AlertMessage
    to contain an optional array of InfoMessage, as AcceptMessage
    and RejectMessage already do.
  * Fixed a bug in sudo_logsrvd where receipt of SIGHUP would result
    in duplicate entries in the debug log when debugging was enabled.
  * The visudo utility now supports EDITOR environment variables
    that use single or double quotes in the command arguments.
    Bug #942.
  * The PAM session modules now run when sudo is set-user-ID root,
    which allows a module to determine the original user-ID.
    Bug #944.
  * Fixed a regression introduced in sudo 1.8.24 in the LDAP back-end
    where sudoNotBefore and sudoNotAfter were applied even when the
    SUDOERS_TIMED setting was not present in ldap.conf.  Bug #945.
  * Sudo packages for macOS 11 now contain universal binaries that
    support both Intel and Apple Silicon CPUs.
  * For sudo_logsrvd, an empty value for the "pid_file" setting in
    sudo_logsrvd.conf will now disable the process ID file.
- Remove sudo-1.9.3p1-pam_xauth.patch (upstreamed)</changelog>
  <changelog author="kstreitova@suse.com" date="1608552000">- Update to 1.9.4p2
  * Fixed a bug introduced in sudo 1.9.4p1 which could lead to a crash
    if the sudoers file contains a runas user-specific Defaults entry.
    Bug #951.
- News in 1.9.4p1
  * Fixed a regression introduced in version 1.9.4 where sudo would
    not build when configured using the --without-sendmail option.
    Bug #947.
  * Fixed a problem where if I/O logging was disabled and sudo was
    unable to connect to sudo_logsrvd, the command would still be
    allowed to run even when the "ignore_logfile_errors" sudoers
    option was enabled.
  * Fixed a crash introduced in version 1.9.4 when attempting to run
    a command as a non-existent user.  Bug #948.
  * The installed sudo.conf file now has the default sudoers Plugin
    lines commented out.  This fixes a potential conflict when there
    is both a system-installed version of sudo and a user-installed
    version.  GitHub issue #75.
  * Fixed a regression introduced in sudo 1.9.4 where sudo would run
    the command as a child process even when a pseudo-terminal was
    not in use and the "pam_session" and "pam_setcred" options were
    disabled.  GitHub issue #76.
  * Fixed a regression introduced in sudo 1.8.9 where the "closefrom"
    sudoers option could not be set to a value of 3.  Bug #950.</changelog>
  <changelog author="kstreitova@suse.com" date="1610625600">- Update to 1.9.5.p1
  * Fixed a regression introduced in sudo 1.9.5 where the editor run
    by sudoedit was set-user-ID root unless SELinux RBAC was in use.
    The editor is now run with the user's real and effective user-IDs.
- News in 1.9.5
  * Fixed a crash introduced in 1.9.4 when running "sudo -i" as an
    unknown user.  This is related to but distinct from Bug #948.
  * If the "lecture_file" setting is enabled in sudoers, it must now
    refer to a regular file or a symbolic link to a regular file.
  * Fixed a potential use-after-free bug in sudo_logsrvd when the
    server shuts down if there are existing connections from clients
    that are only logging events and not session I/O data.
  * Fixed a buffer size mismatch when serializing the list of IP
    addresses for configured network interfaces.  This bug is not
    actually exploitable since the allocated buffer is large enough
    to hold the list of addresses.
  * If sudo is executed with a name other than "sudo" or "sudoedit",
    it will now fall back to "sudo" as the program name.  This affects
    warning, help and usage messages as well as the matching of Debug
    lines in the /etc/sudo.conf file.  Previously, it was possible
    for the invoking user to manipulate the program name by setting
    argv[0] to an arbitrary value when executing sudo. (bsc#1180687)
  * Sudo now checks for failure when setting the close-on-exec flag
    on open file descriptors.  This should never fail but, if it
    were to, there is the possibility of a file descriptor leak to
    a child process (such as the command sudo runs).
  * Fixed CVE-2021-23239, a potential information leak in sudoedit
    that could be used to test for the existence of directories not
    normally accessible to the user in certain circumstances.  When
    creating a new file, sudoedit checks to make sure the parent
    directory of the new file exists before running the editor.
    However, a race condition exists if the invoking user can replace
    (or create) the parent directory.  If a symbolic link is created
    in place of the parent directory, sudoedit will run the editor
    as long as the target of the link exists.  If the target of the
    link does not exist, an error message will be displayed.  The
    race condition can be used to test for the existence of an
    arbitrary directory.  However, it _cannot_ be used to write to
    an arbitrary location. (bsc#1180684)
  * Fixed CVE-2021-23240, a flaw in the temporary file handling of
    sudoedit's SELinux RBAC support.  On systems where SELinux is
    enabled, a user with sudoedit permissions may be able to set the
    owner of an arbitrary file to the user-ID of the target user.
    On Linux kernels that support "protected symlinks", setting
    /proc/sys/fs/protected_symlinks to 1 will prevent the bug from
    being exploited.  For more information see
    https://www.sudo.ws/alerts/sudoedit_selinux.html. (bsc#1180685)
  * Added writability checks for sudoedit when SELinux RBAC is in use.
    This makes sudoedit behavior consistent regardless of whether
    or not SELinux RBAC is in use.  Previously, the "sudoedit_checkdir"
    setting had no effect for RBAC entries.
  * A new sudoers option "selinux" can be used to disable sudo's
    SELinux RBAC support.
  * Quieted warnings from PVS Studio, clang analyzer, and cppcheck.
    Added suppression annotations for PVS Studio false positives.</changelog>
  <changelog author="sflees@suse.de" date="1611748800">- Update to 1.9.5.p2
  * When invoked as sudoedit, the same set of command line
    options are now accepted as for sudo -e. The -H and -P
    options are now rejected for sudoedit and sudo -e which
    matches the sudo 1.7 behavior. This is part of the fix for
    CVE-2021-3156.
  * Fixed a potential buffer overflow when unescaping backslashes
    in the command's arguments. Normally, sudo escapes special
    characters when running a command via a shell (sudo -s or
    sudo -i). However, it was also possible to run sudoedit with
    the -s or -i flags in which case no escaping had actually
    been done, making a buffer overflow possible.
    This fixes CVE-2021-3156. (bsc#1181090)
  * Fixed sudo's setprogname(3) emulation on systems that don't
    provide it.
  * Fixed a problem with the sudoers log server client where a
    partial write to the server could result the sudo process
    consuming large amounts of CPU time due to a cycle in the
    buffer queue. Bug #954.
  * Added a missing dependency on libsudo_util in libsudo_eventlog.
    Fixes a link error when building sudo statically.
  * The user's KRB5CCNAME environment variable is now preserved
    when performing PAM authentication. This fixes GSSAPI
    authentication when the user has a non-default ccache.</changelog>
  <changelog author="sflees@suse.de" date="1645012800">- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch</changelog>
  <changelog author="jsikes@suse.com" date="1646308800">- Add sudo-1.9.5p2-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak &lt;dzejrou@gmail.com&gt;</changelog>
  <changelog author="jsikes@suse.com" date="1665144000">- Fixed an issue where some redundant entries in a sudo configuration
  file caused freed memory to be accessed in the error message thus
  wrong information was output in the error message.
  * [bsc#1190818]
  * Added [sudo-1.9.5p2-no_free_alias_name.patch]
    Sourced from the following git commit hashes:
    | 9ed14870c Add garbage collection to the sudoers parser to clean
    up on error. This makes it possible to avoid memory leaks when
    there is a parse error.
    | bdb02b1ef Got back to calling alias_free() on alias_add() failure.
    We now need to remove the name and members from the leak list
  * before* calling alias_add() since alias_add() will consume them
    for both success and failure.
    | b4cabdb39 Don't free the alias name in alias_add() if the alias
    already exists. We need to be able to display it using
    alias_error(). Only free what we actually allocated in alias_add()
    on error and let the caller handle cleanup.  Note that we cannot
    completely fill in the alias until it is inserted.  Otherwise,
    we will have modified the file and members parameters even if
    there was an error. As a result, we have to remove those from the
    leak list after alias_add(), not before.</changelog>
  <changelog author="jsikes@suse.com" date="1667476800">- Added sudo-CVE-2022-43995.patch
  * CVE-2022-43995
  * bsc#1204986
  * Fixed a potential heap-based buffer over-read when entering a password
    of seven characters or fewer and using the crypt() password backend.</changelog>
  <changelog author="jsikes@suse.com" date="1668600000">- Added sudo-observe-SIGCHLD.patch
  * Make sure SIGCHLD is not ignored when sudo is executed; fixes
    race condition.
  * bsc#1203201
  * Sourced from https://github.com/sudo-project/sudo/commit/727056e</changelog>
  <changelog author="jsikes@suse.com" date="1669032000">- Added sudo-utf8-ldap-schema.patch
  * Change sudo-ldap schema from ASCII to UTF8.
  * Fixes bsc#1197998
  * Credit to William Brown &lt;william.brown@suse.com&gt;
  * https://github.com/sudo-project/sudo/pull/163</changelog>
  <changelog author="jsikes@suse.com" date="1673870400">- Added sudo-CVE-2023-22809.patch
  * CVE-2023-22809
  * bsc#1207082
  * Prevent '--' in the EDITOR environment variable which can allow
    users to edit sensitive files as root.</changelog>
</package>
<package pkgid="249c65ac47e9cc94148733e1c7d0058ddc4f2b2afdc114c8540365502a301b20" name="supportutils" arch="noarch">
  <version epoch="0" ver="3.1.21" rel="150300.7.35.15.1"/>
  <changelog author="jason.record@gmail.com" date="1616414400">- [powerpc] Collect dynamic_debug log files for ibmvNIC #98 (bsc#1183826)</changelog>
  <changelog author="jason.record@suse.com" date="1618488000">- Additions to version 3.1.15
  + Added drbd-overview to drbd.txt
  + Added list-timers to systemd.txt (bsc#1169348)
  + Including nfs4 in search (bsc#1184829)
- Minor: Fix a typo (executible -&gt; executable) #99
- Changed minor wording to loaded module</changelog>
  <changelog author="jason.record@suse.com" date="1618833600">- Additions to version 3.1.15
  + Checks package signatures in rpm.txt (bsc#1021918)
  + Optimize find (bsc#1184912)
- Using zypper --xmlout (bsc#1181351)
- Error fix for sysfs.txt (bsc#1089870)</changelog>
  <changelog author="jason.record@suse.com" date="1620820800">- getappcore checks for valid compression binary (bsc#1185991)
- getappcore does not trigger errors with help message (bsc#1185993)</changelog>
  <changelog author="jason.record@suse.com" date="1621857600">- analyzevmcore supports local directories (bsc#1186397)</changelog>
  <changelog author="jason.record@suse.com" date="1622116800">- Fixes to supportconfig
  + Exclude rhn.conf from etc.txt (bsc#1186347)</changelog>
  <changelog author="jason.record@suse.com" date="1623067200">- Changes to version 3.1.16
  + lsof options to improve performance (bsc#1186687)</changelog>
  <changelog author="jason.record@suse.com" date="1625572800">- Changes to version 3.1.17
  + Adding ethtool options g l m to network.txt (jsc#SLE-18240)</changelog>
  <changelog author="jason.record@suse.com" date="1629115200">- Changes to version 3.1.18
  + Added email.txt based on OPTION_EMAIL #108 (bsc#1189028)
  + Include 'multipath -t' output in mpio.txt #105
  + Improved lsblk readability with --ascsi #106
  + Removed duplicate commands in network.txt
  + Remove duplicate firewalld status output #109</changelog>
  <changelog author="jason.record@suse.com" date="1631102400">- Fixed cron package for RPM validation (bsc#1190315)
- Updated spec file with correct URL</changelog>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
</package>
<package pkgid="ddeb2c4af38da54c6f3a098341a396fb842cb9a0e927f18e1976698cdbb667fc" name="supportutils" arch="src">
  <version epoch="0" ver="3.1.21" rel="150300.7.35.15.1"/>
  <changelog author="jason.record@gmail.com" date="1616414400">- [powerpc] Collect dynamic_debug log files for ibmvNIC #98 (bsc#1183826)</changelog>
  <changelog author="jason.record@suse.com" date="1618488000">- Additions to version 3.1.15
  + Added drbd-overview to drbd.txt
  + Added list-timers to systemd.txt (bsc#1169348)
  + Including nfs4 in search (bsc#1184829)
- Minor: Fix a typo (executible -&gt; executable) #99
- Changed minor wording to loaded module</changelog>
  <changelog author="jason.record@suse.com" date="1618833600">- Additions to version 3.1.15
  + Checks package signatures in rpm.txt (bsc#1021918)
  + Optimize find (bsc#1184912)
- Using zypper --xmlout (bsc#1181351)
- Error fix for sysfs.txt (bsc#1089870)</changelog>
  <changelog author="jason.record@suse.com" date="1620820800">- getappcore checks for valid compression binary (bsc#1185991)
- getappcore does not trigger errors with help message (bsc#1185993)</changelog>
  <changelog author="jason.record@suse.com" date="1621857600">- analyzevmcore supports local directories (bsc#1186397)</changelog>
  <changelog author="jason.record@suse.com" date="1622116800">- Fixes to supportconfig
  + Exclude rhn.conf from etc.txt (bsc#1186347)</changelog>
  <changelog author="jason.record@suse.com" date="1623067200">- Changes to version 3.1.16
  + lsof options to improve performance (bsc#1186687)</changelog>
  <changelog author="jason.record@suse.com" date="1625572800">- Changes to version 3.1.17
  + Adding ethtool options g l m to network.txt (jsc#SLE-18240)</changelog>
  <changelog author="jason.record@suse.com" date="1629115200">- Changes to version 3.1.18
  + Added email.txt based on OPTION_EMAIL #108 (bsc#1189028)
  + Include 'multipath -t' output in mpio.txt #105
  + Improved lsblk readability with --ascsi #106
  + Removed duplicate commands in network.txt
  + Remove duplicate firewalld status output #109</changelog>
  <changelog author="jason.record@suse.com" date="1631102400">- Fixed cron package for RPM validation (bsc#1190315)
- Updated spec file with correct URL</changelog>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
</package>
<package pkgid="a63925739a6a8084f24b79a2f014f5ccae1cfed8670f430d9ac592b57173c37b" name="suse-build-key" arch="noarch">
  <version epoch="0" ver="12.0" rel="150000.8.28.1"/>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
</package>
<package pkgid="90903478893e0758b52d188808913fb11876128caaef064a8df27957b1fa49dc" name="suse-build-key" arch="src">
  <version epoch="0" ver="12.0" rel="150000.8.28.1"/>
  <changelog author="ro@suse.de" date="1350820800">- export keys to single files in /usr/lib/rpm/gnupg/keys</changelog>
  <changelog author="ro@suse.de" date="1358164800">- added reserve key for SLES (fate#312896)
  50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
  valid until (2017-01-13)</changelog>
  <changelog author="ro@suse.de" date="1359633600">- added future signing key for SLES (fate#314767) (bnc#801055)
  using 2048 bit rsa key</changelog>
  <changelog author="meissner@suse.com" date="1389268800">- Merged over logic from openSUSE-build-key.
- Got rid of default importing into roots keyring.
- Removed some old keys.
- Clarify that security@suse.de is a email only key
- PTF key is supplied also as %doc, to not be default
  imported.
- Keys currently inside:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
  - pub  1024D/B37B98A9 SUSE PTF Signing Key &lt;support@suse.com&gt;
  - pub  2048R/3D25D3D9 SuSE Security Team &lt;security@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1389614400">- reverted to contain the fullkeyring build SLE12 Alpha.
- also list the old sle11 build@suse.de key temporary</changelog>
  <changelog author="meissner@suse.com" date="1392033600">- create suse-build-key.gpg during build.
- Remove old keys from keyring. (fate#314767)
  Keys currently inside the RPM trusted keyring:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
- Various keys are moved to the documentation area
  (/usr/share/doc/packages/suse-build-key)
  - build-at-suse-sle11.asc: the old SUSE Linux Enterprise 11 key.
    if SUSE Linux Enterprise 11 packages need to be verified on
    a SUSE Linux Enterprise 12 system.
  - suse_ptf_key.asc: The suse ptf key. For verification of provided PTFs.
  - security_at_suse_de.asc: Use only for email encryption and
    verification purposes when contacting our security contact address
    security@suse.de</changelog>
  <changelog author="meissner@suse.com" date="1409313600">- Went to new method again.
  - suse-build-key.gpg blob dropped
  - ship seperate files</changelog>
  <changelog author="meissner@suse.com" date="1412251200">- renamed security_at_suse_de.asc to security_at_suse_de_old.asc
- security_at_suse_de.asc: new 4096 bit RSA key.
  pub  4096R/317CD502 2014-10-02 SUSE Security Team &lt;security@suse.de&gt;
  bnc#899509</changelog>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
</package>
<package pkgid="4b2eed06f29ad50f9b8c236675d5b6e9ee8ba37bd63afe88b2fc67545a156638" name="suse-build-key" arch="noarch">
  <version epoch="0" ver="12.0" rel="150000.8.31.1"/>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
  <changelog author="meissner@suse.com" date="1675771200">- Establish multiple new 4096 RSA keys that we will switch
  to mid of 2023. (jsc#PED-2777)
  - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos).
  - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos).
  - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs.
  - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem:
    new RSA 4096 key for the SUSE registry registry.suse.com, installed as
    suse-container-key-2023.pem and suse-container-key-2023.asc
  - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem:
    New PTF container signing key for registry.suse.com/ptf/ space.</changelog>
</package>
<package pkgid="f3571753f1d9bd006508b6f50f5f2fb81ba95bbd93df9e6615e4bd8f1337a605" name="suse-build-key" arch="src">
  <version epoch="0" ver="12.0" rel="150000.8.31.1"/>
  <changelog author="ro@suse.de" date="1358164800">- added reserve key for SLES (fate#312896)
  50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
  valid until (2017-01-13)</changelog>
  <changelog author="ro@suse.de" date="1359633600">- added future signing key for SLES (fate#314767) (bnc#801055)
  using 2048 bit rsa key</changelog>
  <changelog author="meissner@suse.com" date="1389268800">- Merged over logic from openSUSE-build-key.
- Got rid of default importing into roots keyring.
- Removed some old keys.
- Clarify that security@suse.de is a email only key
- PTF key is supplied also as %doc, to not be default
  imported.
- Keys currently inside:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
  - pub  1024D/B37B98A9 SUSE PTF Signing Key &lt;support@suse.com&gt;
  - pub  2048R/3D25D3D9 SuSE Security Team &lt;security@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1389614400">- reverted to contain the fullkeyring build SLE12 Alpha.
- also list the old sle11 build@suse.de key temporary</changelog>
  <changelog author="meissner@suse.com" date="1392033600">- create suse-build-key.gpg during build.
- Remove old keys from keyring. (fate#314767)
  Keys currently inside the RPM trusted keyring:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
- Various keys are moved to the documentation area
  (/usr/share/doc/packages/suse-build-key)
  - build-at-suse-sle11.asc: the old SUSE Linux Enterprise 11 key.
    if SUSE Linux Enterprise 11 packages need to be verified on
    a SUSE Linux Enterprise 12 system.
  - suse_ptf_key.asc: The suse ptf key. For verification of provided PTFs.
  - security_at_suse_de.asc: Use only for email encryption and
    verification purposes when contacting our security contact address
    security@suse.de</changelog>
  <changelog author="meissner@suse.com" date="1409313600">- Went to new method again.
  - suse-build-key.gpg blob dropped
  - ship seperate files</changelog>
  <changelog author="meissner@suse.com" date="1412251200">- renamed security_at_suse_de.asc to security_at_suse_de_old.asc
- security_at_suse_de.asc: new 4096 bit RSA key.
  pub  4096R/317CD502 2014-10-02 SUSE Security Team &lt;security@suse.de&gt;
  bnc#899509</changelog>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
  <changelog author="meissner@suse.com" date="1675771200">- Establish multiple new 4096 RSA keys that we will switch
  to mid of 2023. (jsc#PED-2777)
  - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos).
  - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos).
  - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs.
  - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem:
    new RSA 4096 key for the SUSE registry registry.suse.com, installed as
    suse-container-key-2023.pem and suse-container-key-2023.asc
  - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem:
    New PTF container signing key for registry.suse.com/ptf/ space.</changelog>
</package>
<package pkgid="02a766d936b3f947c74576b583ecba13ada3729de28b166151237b84c17789e4" name="sysconfig" arch="aarch64">
  <version epoch="0" ver="0.85.9" rel="150200.12.1"/>
  <changelog author="dimstar@opensuse.org" date="1496923200">- Make /etc/ppp owned by root:root. The group dialout usage is no
  longer used.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mt@suse.com" date="1511784000">- version 0.84.2
- spec: revert change to use _fillupdir in update hook from &lt; 0.80
- merged fixes of the the fillup templates logic and macro in
  configure.ac by Marcus Meissner</changelog>
  <changelog author="kukuk@suse.de" date="1521460800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mt@suse.de" date="1526558400">- version 0.84.3
- netconfig: change policy to permit non-NM settings (bsc#1079793)
  As requested and approved by NetworkManager maintainer, the 'auto'
  policy permits now also per interface settings provided by other
  services when NetworkManager is enabled. That is, the auto policy
  resolving has been changed from "STATIC_FALLBACK NetworkManager"
  to "STATIC_FALLBACK * NetworkManager".</changelog>
  <changelog author="mt@suse.de" date="1545393600">- version 0.85.0
- netconfig: change to write resolv.conf,yp.conf,forwarders.conf
  to files in /[var/]run/netconfig/ and link in /etc (fate#325872)
- netconfig: add to update ntp servers in chrony (bsc#1099272) and
  cleaned up to use start-ntpd addserver to update ntpd servers.
- Remove code to update from openSUSE older than 12.3, which is EOL
  (gh#openSUSE/sysconfig#19).
- Move /var/adm/netconfig to /var/lib/netconfig to become more FHS
  conform (gh#openSUSE/sysconfig#18).</changelog>
  <changelog author="mt@suse.de" date="1547726400">- version 0.85.1
- removed modprobe.d/50-blacklist.conf, which will be provided by
  the suse-module-tools package instead (boo#1107611). See also:
  gh#openSUSE/suse-module-tools/pull/3
  gh#openSUSE/sysconfig/pull/22</changelog>
  <changelog author="coolo@suse.com" date="1549713600">- HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch</changelog>
  <changelog author="mt@suse.de" date="1550145600">- version 0.85.2
- Fixed changes file to mention relevant github pull requests.
- Removed remaining preun rpm hook from EOL openSUSE versions
- Merged /var/adm/netconfig move revert from openSUSE:Factory
  causing to not find md5 sums from previous netconfig version
  due to incorrectly merged hook in spec file and trouble on
  transactional systems without writeable /var/lib/netconfig.
  Removed obsoletes revert-var-adm-lib-netconfig-move.patch.
  (bsc#1124152,bsc#1124340).
- Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23)</changelog>
  <changelog author="max@suse.com" date="1563969600">- version 0.85.3
- boo#1123699: Use systemd's tmpfile mechanism to create the
  symlink infrastructure for resolv.conf and yp.conf early during
  boot.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Mark /etc/yp.conf as %config(noreplace): this is the same as the
  file shipped by ypbind has as mode. In sysconfig we create a
  symlink, in ypbind, the file is actually only owned for
  reference. Having the same modes allows for the bots to do their
  work properly (boo#1159566).</changelog>
  <changelog author="mt@suse.com" date="1582632000">- version 0.85.4
- Add Upstream First openSUSE Build Service Policy to the spec</changelog>
  <changelog author="mt@suse.com" date="1595332800">- version 0.85.5
- spec: Fix Requires, use file requires
  (https://github.com/openSUSE/sysconfig/pull/25)
- ntp: call chrony helper in background (bsc#1173391)</changelog>
  <changelog author="mt@suse.com" date="1600689600">- version 0.85.6
- netconfig: execute chrony/helper in /usr/libexec with fallback
  to it's previous location in /usr/lib (boo#1176285)
- netconfig: only write files like /etc/resolv.conf on content
  change to avoid that e.g. dnsmasq (if running) re-reads the
  /etc/resolv.conf and re-initializes itself (bsc#1176325)</changelog>
  <changelog author="fvogt@suse.com" date="1606478400">- Also support service(network) provides</changelog>
  <changelog author="fvogt@suse.com" date="1619438400">- spec: Drop hard dependency on /sbin/ifup
- spec: Suggest instead of recommend wicked-service
- spec: Mention that the .spec file is in git as well</changelog>
  <changelog author="mt@suse.com" date="1623153600">- version 0.85.7</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623153601">- Link as Position Independent Executable (bsc#1184124).</changelog>
  <changelog author="mt@suse.com" date="1636372800">- version 0.85.8
- netconfig: revert NM default policy change change (boo#1185882)
  With the change to the default policy, netconfig with NetworkManager
  as network.service accepted settings from all services/programs
  directly instead only from NetworkManager, where plugins/services
  have to deliver their settings to apply them.</changelog>
  <changelog author="mt@suse.com" date="1654257600">- version 0.85.9
- spec: revert to recommend wicked-service on &lt;= 15.4
- netconfig: remove sed dependency
- netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093)
- netconfig: cleanup /var/run leftovers (bsc#1194557)
- netconfig: update ntp man page documentation, fix typos
- spec: drop legacy migration (from sle11) and rpm-utils</changelog>
</package>
<package pkgid="761b88d47c71534d5804a05f3f8dec3e8e21575d7dfae3ea272c85c26a39e9b5" name="sysconfig" arch="src">
  <version epoch="0" ver="0.85.9" rel="150200.12.1"/>
  <changelog author="dimstar@opensuse.org" date="1496923200">- Make /etc/ppp owned by root:root. The group dialout usage is no
  longer used.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mt@suse.com" date="1511784000">- version 0.84.2
- spec: revert change to use _fillupdir in update hook from &lt; 0.80
- merged fixes of the the fillup templates logic and macro in
  configure.ac by Marcus Meissner</changelog>
  <changelog author="kukuk@suse.de" date="1521460800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mt@suse.de" date="1526558400">- version 0.84.3
- netconfig: change policy to permit non-NM settings (bsc#1079793)
  As requested and approved by NetworkManager maintainer, the 'auto'
  policy permits now also per interface settings provided by other
  services when NetworkManager is enabled. That is, the auto policy
  resolving has been changed from "STATIC_FALLBACK NetworkManager"
  to "STATIC_FALLBACK * NetworkManager".</changelog>
  <changelog author="mt@suse.de" date="1545393600">- version 0.85.0
- netconfig: change to write resolv.conf,yp.conf,forwarders.conf
  to files in /[var/]run/netconfig/ and link in /etc (fate#325872)
- netconfig: add to update ntp servers in chrony (bsc#1099272) and
  cleaned up to use start-ntpd addserver to update ntpd servers.
- Remove code to update from openSUSE older than 12.3, which is EOL
  (gh#openSUSE/sysconfig#19).
- Move /var/adm/netconfig to /var/lib/netconfig to become more FHS
  conform (gh#openSUSE/sysconfig#18).</changelog>
  <changelog author="mt@suse.de" date="1547726400">- version 0.85.1
- removed modprobe.d/50-blacklist.conf, which will be provided by
  the suse-module-tools package instead (boo#1107611). See also:
  gh#openSUSE/suse-module-tools/pull/3
  gh#openSUSE/sysconfig/pull/22</changelog>
  <changelog author="coolo@suse.com" date="1549713600">- HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch</changelog>
  <changelog author="mt@suse.de" date="1550145600">- version 0.85.2
- Fixed changes file to mention relevant github pull requests.
- Removed remaining preun rpm hook from EOL openSUSE versions
- Merged /var/adm/netconfig move revert from openSUSE:Factory
  causing to not find md5 sums from previous netconfig version
  due to incorrectly merged hook in spec file and trouble on
  transactional systems without writeable /var/lib/netconfig.
  Removed obsoletes revert-var-adm-lib-netconfig-move.patch.
  (bsc#1124152,bsc#1124340).
- Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23)</changelog>
  <changelog author="max@suse.com" date="1563969600">- version 0.85.3
- boo#1123699: Use systemd's tmpfile mechanism to create the
  symlink infrastructure for resolv.conf and yp.conf early during
  boot.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Mark /etc/yp.conf as %config(noreplace): this is the same as the
  file shipped by ypbind has as mode. In sysconfig we create a
  symlink, in ypbind, the file is actually only owned for
  reference. Having the same modes allows for the bots to do their
  work properly (boo#1159566).</changelog>
  <changelog author="mt@suse.com" date="1582632000">- version 0.85.4
- Add Upstream First openSUSE Build Service Policy to the spec</changelog>
  <changelog author="mt@suse.com" date="1595332800">- version 0.85.5
- spec: Fix Requires, use file requires
  (https://github.com/openSUSE/sysconfig/pull/25)
- ntp: call chrony helper in background (bsc#1173391)</changelog>
  <changelog author="mt@suse.com" date="1600689600">- version 0.85.6
- netconfig: execute chrony/helper in /usr/libexec with fallback
  to it's previous location in /usr/lib (boo#1176285)
- netconfig: only write files like /etc/resolv.conf on content
  change to avoid that e.g. dnsmasq (if running) re-reads the
  /etc/resolv.conf and re-initializes itself (bsc#1176325)</changelog>
  <changelog author="fvogt@suse.com" date="1606478400">- Also support service(network) provides</changelog>
  <changelog author="fvogt@suse.com" date="1619438400">- spec: Drop hard dependency on /sbin/ifup
- spec: Suggest instead of recommend wicked-service
- spec: Mention that the .spec file is in git as well</changelog>
  <changelog author="mt@suse.com" date="1623153600">- version 0.85.7</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623153601">- Link as Position Independent Executable (bsc#1184124).</changelog>
  <changelog author="mt@suse.com" date="1636372800">- version 0.85.8
- netconfig: revert NM default policy change change (boo#1185882)
  With the change to the default policy, netconfig with NetworkManager
  as network.service accepted settings from all services/programs
  directly instead only from NetworkManager, where plugins/services
  have to deliver their settings to apply them.</changelog>
  <changelog author="mt@suse.com" date="1654257600">- version 0.85.9
- spec: revert to recommend wicked-service on &lt;= 15.4
- netconfig: remove sed dependency
- netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093)
- netconfig: cleanup /var/run leftovers (bsc#1194557)
- netconfig: update ntp man page documentation, fix typos
- spec: drop legacy migration (from sle11) and rpm-utils</changelog>
</package>
<package pkgid="8d5ac96a9d6fd5a107156091ac572c31b2df4b620bf767c2b1c6109d19f3ff27" name="sysconfig" arch="x86_64">
  <version epoch="0" ver="0.85.9" rel="150200.12.1"/>
  <changelog author="dimstar@opensuse.org" date="1496923200">- Make /etc/ppp owned by root:root. The group dialout usage is no
  longer used.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mt@suse.com" date="1511784000">- version 0.84.2
- spec: revert change to use _fillupdir in update hook from &lt; 0.80
- merged fixes of the the fillup templates logic and macro in
  configure.ac by Marcus Meissner</changelog>
  <changelog author="kukuk@suse.de" date="1521460800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mt@suse.de" date="1526558400">- version 0.84.3
- netconfig: change policy to permit non-NM settings (bsc#1079793)
  As requested and approved by NetworkManager maintainer, the 'auto'
  policy permits now also per interface settings provided by other
  services when NetworkManager is enabled. That is, the auto policy
  resolving has been changed from "STATIC_FALLBACK NetworkManager"
  to "STATIC_FALLBACK * NetworkManager".</changelog>
  <changelog author="mt@suse.de" date="1545393600">- version 0.85.0
- netconfig: change to write resolv.conf,yp.conf,forwarders.conf
  to files in /[var/]run/netconfig/ and link in /etc (fate#325872)
- netconfig: add to update ntp servers in chrony (bsc#1099272) and
  cleaned up to use start-ntpd addserver to update ntpd servers.
- Remove code to update from openSUSE older than 12.3, which is EOL
  (gh#openSUSE/sysconfig#19).
- Move /var/adm/netconfig to /var/lib/netconfig to become more FHS
  conform (gh#openSUSE/sysconfig#18).</changelog>
  <changelog author="mt@suse.de" date="1547726400">- version 0.85.1
- removed modprobe.d/50-blacklist.conf, which will be provided by
  the suse-module-tools package instead (boo#1107611). See also:
  gh#openSUSE/suse-module-tools/pull/3
  gh#openSUSE/sysconfig/pull/22</changelog>
  <changelog author="coolo@suse.com" date="1549713600">- HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch</changelog>
  <changelog author="mt@suse.de" date="1550145600">- version 0.85.2
- Fixed changes file to mention relevant github pull requests.
- Removed remaining preun rpm hook from EOL openSUSE versions
- Merged /var/adm/netconfig move revert from openSUSE:Factory
  causing to not find md5 sums from previous netconfig version
  due to incorrectly merged hook in spec file and trouble on
  transactional systems without writeable /var/lib/netconfig.
  Removed obsoletes revert-var-adm-lib-netconfig-move.patch.
  (bsc#1124152,bsc#1124340).
- Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23)</changelog>
  <changelog author="max@suse.com" date="1563969600">- version 0.85.3
- boo#1123699: Use systemd's tmpfile mechanism to create the
  symlink infrastructure for resolv.conf and yp.conf early during
  boot.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Mark /etc/yp.conf as %config(noreplace): this is the same as the
  file shipped by ypbind has as mode. In sysconfig we create a
  symlink, in ypbind, the file is actually only owned for
  reference. Having the same modes allows for the bots to do their
  work properly (boo#1159566).</changelog>
  <changelog author="mt@suse.com" date="1582632000">- version 0.85.4
- Add Upstream First openSUSE Build Service Policy to the spec</changelog>
  <changelog author="mt@suse.com" date="1595332800">- version 0.85.5
- spec: Fix Requires, use file requires
  (https://github.com/openSUSE/sysconfig/pull/25)
- ntp: call chrony helper in background (bsc#1173391)</changelog>
  <changelog author="mt@suse.com" date="1600689600">- version 0.85.6
- netconfig: execute chrony/helper in /usr/libexec with fallback
  to it's previous location in /usr/lib (boo#1176285)
- netconfig: only write files like /etc/resolv.conf on content
  change to avoid that e.g. dnsmasq (if running) re-reads the
  /etc/resolv.conf and re-initializes itself (bsc#1176325)</changelog>
  <changelog author="fvogt@suse.com" date="1606478400">- Also support service(network) provides</changelog>
  <changelog author="fvogt@suse.com" date="1619438400">- spec: Drop hard dependency on /sbin/ifup
- spec: Suggest instead of recommend wicked-service
- spec: Mention that the .spec file is in git as well</changelog>
  <changelog author="mt@suse.com" date="1623153600">- version 0.85.7</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623153601">- Link as Position Independent Executable (bsc#1184124).</changelog>
  <changelog author="mt@suse.com" date="1636372800">- version 0.85.8
- netconfig: revert NM default policy change change (boo#1185882)
  With the change to the default policy, netconfig with NetworkManager
  as network.service accepted settings from all services/programs
  directly instead only from NetworkManager, where plugins/services
  have to deliver their settings to apply them.</changelog>
  <changelog author="mt@suse.com" date="1654257600">- version 0.85.9
- spec: revert to recommend wicked-service on &lt;= 15.4
- netconfig: remove sed dependency
- netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093)
- netconfig: cleanup /var/run leftovers (bsc#1194557)
- netconfig: update ntp man page documentation, fix typos
- spec: drop legacy migration (from sle11) and rpm-utils</changelog>
</package>
<package pkgid="feecd2b687d4bc48139c0384298534fc9dfaa3ffa05759664a336f3d5603e651" name="sysconfig-netconfig" arch="aarch64">
  <version epoch="0" ver="0.85.9" rel="150200.12.1"/>
  <changelog author="dimstar@opensuse.org" date="1496923200">- Make /etc/ppp owned by root:root. The group dialout usage is no
  longer used.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mt@suse.com" date="1511784000">- version 0.84.2
- spec: revert change to use _fillupdir in update hook from &lt; 0.80
- merged fixes of the the fillup templates logic and macro in
  configure.ac by Marcus Meissner</changelog>
  <changelog author="kukuk@suse.de" date="1521460800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mt@suse.de" date="1526558400">- version 0.84.3
- netconfig: change policy to permit non-NM settings (bsc#1079793)
  As requested and approved by NetworkManager maintainer, the 'auto'
  policy permits now also per interface settings provided by other
  services when NetworkManager is enabled. That is, the auto policy
  resolving has been changed from "STATIC_FALLBACK NetworkManager"
  to "STATIC_FALLBACK * NetworkManager".</changelog>
  <changelog author="mt@suse.de" date="1545393600">- version 0.85.0
- netconfig: change to write resolv.conf,yp.conf,forwarders.conf
  to files in /[var/]run/netconfig/ and link in /etc (fate#325872)
- netconfig: add to update ntp servers in chrony (bsc#1099272) and
  cleaned up to use start-ntpd addserver to update ntpd servers.
- Remove code to update from openSUSE older than 12.3, which is EOL
  (gh#openSUSE/sysconfig#19).
- Move /var/adm/netconfig to /var/lib/netconfig to become more FHS
  conform (gh#openSUSE/sysconfig#18).</changelog>
  <changelog author="mt@suse.de" date="1547726400">- version 0.85.1
- removed modprobe.d/50-blacklist.conf, which will be provided by
  the suse-module-tools package instead (boo#1107611). See also:
  gh#openSUSE/suse-module-tools/pull/3
  gh#openSUSE/sysconfig/pull/22</changelog>
  <changelog author="coolo@suse.com" date="1549713600">- HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch</changelog>
  <changelog author="mt@suse.de" date="1550145600">- version 0.85.2
- Fixed changes file to mention relevant github pull requests.
- Removed remaining preun rpm hook from EOL openSUSE versions
- Merged /var/adm/netconfig move revert from openSUSE:Factory
  causing to not find md5 sums from previous netconfig version
  due to incorrectly merged hook in spec file and trouble on
  transactional systems without writeable /var/lib/netconfig.
  Removed obsoletes revert-var-adm-lib-netconfig-move.patch.
  (bsc#1124152,bsc#1124340).
- Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23)</changelog>
  <changelog author="max@suse.com" date="1563969600">- version 0.85.3
- boo#1123699: Use systemd's tmpfile mechanism to create the
  symlink infrastructure for resolv.conf and yp.conf early during
  boot.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Mark /etc/yp.conf as %config(noreplace): this is the same as the
  file shipped by ypbind has as mode. In sysconfig we create a
  symlink, in ypbind, the file is actually only owned for
  reference. Having the same modes allows for the bots to do their
  work properly (boo#1159566).</changelog>
  <changelog author="mt@suse.com" date="1582632000">- version 0.85.4
- Add Upstream First openSUSE Build Service Policy to the spec</changelog>
  <changelog author="mt@suse.com" date="1595332800">- version 0.85.5
- spec: Fix Requires, use file requires
  (https://github.com/openSUSE/sysconfig/pull/25)
- ntp: call chrony helper in background (bsc#1173391)</changelog>
  <changelog author="mt@suse.com" date="1600689600">- version 0.85.6
- netconfig: execute chrony/helper in /usr/libexec with fallback
  to it's previous location in /usr/lib (boo#1176285)
- netconfig: only write files like /etc/resolv.conf on content
  change to avoid that e.g. dnsmasq (if running) re-reads the
  /etc/resolv.conf and re-initializes itself (bsc#1176325)</changelog>
  <changelog author="fvogt@suse.com" date="1606478400">- Also support service(network) provides</changelog>
  <changelog author="fvogt@suse.com" date="1619438400">- spec: Drop hard dependency on /sbin/ifup
- spec: Suggest instead of recommend wicked-service
- spec: Mention that the .spec file is in git as well</changelog>
  <changelog author="mt@suse.com" date="1623153600">- version 0.85.7</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623153601">- Link as Position Independent Executable (bsc#1184124).</changelog>
  <changelog author="mt@suse.com" date="1636372800">- version 0.85.8
- netconfig: revert NM default policy change change (boo#1185882)
  With the change to the default policy, netconfig with NetworkManager
  as network.service accepted settings from all services/programs
  directly instead only from NetworkManager, where plugins/services
  have to deliver their settings to apply them.</changelog>
  <changelog author="mt@suse.com" date="1654257600">- version 0.85.9
- spec: revert to recommend wicked-service on &lt;= 15.4
- netconfig: remove sed dependency
- netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093)
- netconfig: cleanup /var/run leftovers (bsc#1194557)
- netconfig: update ntp man page documentation, fix typos
- spec: drop legacy migration (from sle11) and rpm-utils</changelog>
</package>
<package pkgid="47928d89fbef1cf3262c8d12600da08ed8424ea8854c8305e23da8fca481247d" name="sysconfig-netconfig" arch="x86_64">
  <version epoch="0" ver="0.85.9" rel="150200.12.1"/>
  <changelog author="dimstar@opensuse.org" date="1496923200">- Make /etc/ppp owned by root:root. The group dialout usage is no
  longer used.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mt@suse.com" date="1511784000">- version 0.84.2
- spec: revert change to use _fillupdir in update hook from &lt; 0.80
- merged fixes of the the fillup templates logic and macro in
  configure.ac by Marcus Meissner</changelog>
  <changelog author="kukuk@suse.de" date="1521460800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mt@suse.de" date="1526558400">- version 0.84.3
- netconfig: change policy to permit non-NM settings (bsc#1079793)
  As requested and approved by NetworkManager maintainer, the 'auto'
  policy permits now also per interface settings provided by other
  services when NetworkManager is enabled. That is, the auto policy
  resolving has been changed from "STATIC_FALLBACK NetworkManager"
  to "STATIC_FALLBACK * NetworkManager".</changelog>
  <changelog author="mt@suse.de" date="1545393600">- version 0.85.0
- netconfig: change to write resolv.conf,yp.conf,forwarders.conf
  to files in /[var/]run/netconfig/ and link in /etc (fate#325872)
- netconfig: add to update ntp servers in chrony (bsc#1099272) and
  cleaned up to use start-ntpd addserver to update ntpd servers.
- Remove code to update from openSUSE older than 12.3, which is EOL
  (gh#openSUSE/sysconfig#19).
- Move /var/adm/netconfig to /var/lib/netconfig to become more FHS
  conform (gh#openSUSE/sysconfig#18).</changelog>
  <changelog author="mt@suse.de" date="1547726400">- version 0.85.1
- removed modprobe.d/50-blacklist.conf, which will be provided by
  the suse-module-tools package instead (boo#1107611). See also:
  gh#openSUSE/suse-module-tools/pull/3
  gh#openSUSE/sysconfig/pull/22</changelog>
  <changelog author="coolo@suse.com" date="1549713600">- HOTPATCH (to be reverted): revert-var-adm-lib-netconfig-move.patch</changelog>
  <changelog author="mt@suse.de" date="1550145600">- version 0.85.2
- Fixed changes file to mention relevant github pull requests.
- Removed remaining preun rpm hook from EOL openSUSE versions
- Merged /var/adm/netconfig move revert from openSUSE:Factory
  causing to not find md5 sums from previous netconfig version
  due to incorrectly merged hook in spec file and trouble on
  transactional systems without writeable /var/lib/netconfig.
  Removed obsoletes revert-var-adm-lib-netconfig-move.patch.
  (bsc#1124152,bsc#1124340).
- Merged rpm spec bash section marks (gh#openSUSE/sysconfig#23)</changelog>
  <changelog author="max@suse.com" date="1563969600">- version 0.85.3
- boo#1123699: Use systemd's tmpfile mechanism to create the
  symlink infrastructure for resolv.conf and yp.conf early during
  boot.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580299200">- Mark /etc/yp.conf as %config(noreplace): this is the same as the
  file shipped by ypbind has as mode. In sysconfig we create a
  symlink, in ypbind, the file is actually only owned for
  reference. Having the same modes allows for the bots to do their
  work properly (boo#1159566).</changelog>
  <changelog author="mt@suse.com" date="1582632000">- version 0.85.4
- Add Upstream First openSUSE Build Service Policy to the spec</changelog>
  <changelog author="mt@suse.com" date="1595332800">- version 0.85.5
- spec: Fix Requires, use file requires
  (https://github.com/openSUSE/sysconfig/pull/25)
- ntp: call chrony helper in background (bsc#1173391)</changelog>
  <changelog author="mt@suse.com" date="1600689600">- version 0.85.6
- netconfig: execute chrony/helper in /usr/libexec with fallback
  to it's previous location in /usr/lib (boo#1176285)
- netconfig: only write files like /etc/resolv.conf on content
  change to avoid that e.g. dnsmasq (if running) re-reads the
  /etc/resolv.conf and re-initializes itself (bsc#1176325)</changelog>
  <changelog author="fvogt@suse.com" date="1606478400">- Also support service(network) provides</changelog>
  <changelog author="fvogt@suse.com" date="1619438400">- spec: Drop hard dependency on /sbin/ifup
- spec: Suggest instead of recommend wicked-service
- spec: Mention that the .spec file is in git as well</changelog>
  <changelog author="mt@suse.com" date="1623153600">- version 0.85.7</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623153601">- Link as Position Independent Executable (bsc#1184124).</changelog>
  <changelog author="mt@suse.com" date="1636372800">- version 0.85.8
- netconfig: revert NM default policy change change (boo#1185882)
  With the change to the default policy, netconfig with NetworkManager
  as network.service accepted settings from all services/programs
  directly instead only from NetworkManager, where plugins/services
  have to deliver their settings to apply them.</changelog>
  <changelog author="mt@suse.com" date="1654257600">- version 0.85.9
- spec: revert to recommend wicked-service on &lt;= 15.4
- netconfig: remove sed dependency
- netconfig/dns-resolver: remove search limit of 6 domains (bsc#1199093)
- netconfig: cleanup /var/run leftovers (bsc#1194557)
- netconfig: update ntp man page documentation, fix typos
- spec: drop legacy migration (from sle11) and rpm-utils</changelog>
</package>
<package pkgid="5db703d3f7150a70147b12d0bc253e7cce6e5846693bfd07da88832f3b1ecda1" name="systemd" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="07dd5dda318658740b3adb816260a1c28c31fd90935fadd1df164c3214eb7cc4" name="systemd" arch="src">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="fc59821e156350ef834f9f03f8b22b9f9b75fdc4b074988f87c25778b9f53d34" name="systemd" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="4292ea05d3212acded53933c426e17463bc15358c66ae5dba614a8c7250b8792" name="systemd" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="3147ad7b1a6ae8fe1a6b9e03363981b5c00605e8763056a5dd82d55909c8b053" name="systemd" arch="src">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="597f6c40da072011e10de350e423aaa09f7fd973ec256c85e204ec5bdf258136" name="systemd" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="4bc56a98cac14d879190af3d17cc11e890980fe8afba5c03bd3827185512c458" name="systemd" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="7e87b499f61e8d4a3b0198a238a3767ecd237077534ddd6f3d73b6339a919d5e" name="systemd" arch="src">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="2e365dd8d1ce193286209ff339b011ecead2369535cf1facd2a27872f2015b47" name="systemd" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="2952da0030a11e27de40314099c30e8764090654b1f9bf73c0b7fea60aacdb99" name="systemd" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="ff87d3400469ff19ba6d5c2a7756d55febff18f7caa3b803647ee20081dc537a" name="systemd" arch="src">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="2c0b254ef9596b264d56f46c1b58349282fecd647117e70f505de712ad937888" name="systemd" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="71876f619656e0b1e8d81e5618709cc8b5e7af6358984d257ce98208839eaaa4" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="520d170b9bf7fed1a8a4b058f80cf6ff628f8eaa6d24f7c8c8ea20127d1d8974" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="ac84ff95e60001f41d2550157ebd4a86cc38401792c118edc10bf09d68f63ae0" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="e62d2998402978e12799e7bdd21b036c1dbb21235d50a524335d82c9c1e7e23b" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="74d5cedde92bcb30573f844b2bbea02bb7eefae3ebdc779615ac6f57e7206b18" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="a2dc2f3e44338881420991fdb3af53fd76dbfecfc6663de8d236b0687ea4dcbb" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="8812f64a79359ba921888827a14fc277d164d40be70ebf8847c8badb1ed6c6ea" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="9e1f9ff25f26b100a13e690bbb8166681e467c482f36e47cc8e482a54ffee8cb" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="f03ab99fc81db7fd9d522728e7fe93622f5c86a73b721069a6067fc0f135685d" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="2c34d8bf0ea0dd919b80345e1d2a1d67bd0a4fe99069604c1220d23842eef063" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="01d14bcc8410abaedd1e086ee5779466374e89cb3c4b061554d2f6852dd1f9d5" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="41501fca1ef0cd278cdd191861bc865585b96db17ea1e7007470bf21ab5b887c" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="0b18fc9521efdabd1cdf403c2ced5474e5c11b4d0f57b844d5955db267ded193" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="2c2b79f22a95cd0205e9ded73f1ea10d674a088e8f0af7a865913988956f1ec8" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="760f15f7e63ba612d0c760e9de14a96e8763f7e7ffa773d80089174fe3d2b24f" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="09e02ab590b969addba6bf8048963ad42bb42ee5bf61b595827c1bbe85c00d29" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="85959117d75232937c67c7e3ca27109d0262594e74ba175b09ef98dd7ad12922" name="systemd-presets-common-SUSE" arch="noarch">
  <version epoch="0" ver="15" rel="150100.8.17.1"/>
  <changelog author="nfbrown@suse.com" date="1544702400">- Eanble new mdadm timers mdcheck_start.timer and  mdmonitor-oneshot.timer
  (bsc#1115407)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1547035200">- Enable new unbound-anchor timer to keep root.key updated
  (bsc#1115417)</changelog>
  <changelog author="kukuk@suse.de" date="1547208000">- Add issue-generator.path to make sure /etc/issue is really
  regenerated if snippets change [bsc#1116825]</changelog>
  <changelog author="tiwai@suse.de" date="1547553600">- Add default user preset: currently containing only the new
  pulseaudio.socket (bsc#1083473)</changelog>
  <changelog author="sbrabec@suse.com" date="1547812800">- branding-preset-states: Apply preset to all unit types
  (bsc#1121219).
- Rename 90-default-SUSE.preset to 95-default-SUSE.preset, so
  product branding takes precedence over common presets.</changelog>
  <changelog author="psimons@suse.com" date="1548244800">- Recent versions of mlocate don't use updatedb.timer any more.
  Instead, the unit is called mlocate.timer. [boo#1115408]</changelog>
  <changelog author="sschricker@suse.com" date="1552564800">- enable nvmefc-boot-connections.service to discover
  network-provided nvme drives on boot (bsc#1128428)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1554120000">- Enable logwatch.timer (bsc#1112500).</changelog>
  <changelog author="iforster@suse.com" date="1559822400">- Enable ignition-firstboot-complete.service</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="ngompa13@gmail.com" date="1597147200">- Enable dnf-makecache.timer</changelog>
  <changelog author="fvogt@suse.com" date="1598443200">- Enable btrfsmaintenance-refresh.path and disable
  btrfsmaintenance-refresh.service to avoid needless refresh on boot
  (boo#1165780)</changelog>
  <changelog author="alarrosa@suse.com" date="1614859200">- Enable user services pipewire.socket and pipewire-pulse.socket
  (boo#1183012).</changelog>
  <changelog author="fcrozat@suse.com" date="1615377600">- Enable user service pipewire-media-session.service (used with
  pipewire &gt;= 0.3.23).</changelog>
  <changelog author="msuchanek@suse.com" date="1617796800">- Enable hcn-init.service for HNV on POWER (bsc#1184136 ltc#192155).</changelog>
  <changelog author="alarrosa@suse.com" date="1622116800">- When installing the systemd-presets-common-SUSE package for the
  first time in a new system, it might happen that some services
  are installed before systemd so the %systemd_pre/post macros
  would not work. This is handled by enabling all preset services
  in this package's %posttrans section but it wasn't enabling
  user services, just system services. Now it enables also the
  user services installed before this package, thus fixing
  boo#1186561</changelog>
  <changelog author="kallan@suse.com" date="1643716800">- enable vgauthd service for VMWare by default (bsc#1195251)</changelog>
  <changelog author="alarrosa@suse.com" date="1655121600">- Add the wireplumber user service preset to enable it by default
  in SLE15-SP4 where it replaced pipewire-media-session, but keep
  pipewire-media-session preset so we don't have to branch the
  systemd-presets-common-SUSE package for SP4 (boo#1200485)</changelog>
  <changelog author="alarrosa@suse.com" date="1655208000">- Modify branding-preset-states to fix systemd-presets-common-SUSE
  not enabling new user systemd service preset configuration just
  as it handles system service presets. By passing an (optional)
  second parameter "user", the save/apply-changes commands now
  work with user services instead of system ones (boo#1200485)</changelog>
  <changelog author="iforster@suse.com" date="1657108800">- enable ignition-delete-config by default (bsc#1199524)</changelog>
</package>
<package pkgid="d4d44705006527a6b34deeb737753149c0b781529faa4bf449850724e61f1c85" name="systemd-presets-common-SUSE" arch="src">
  <version epoch="0" ver="15" rel="150100.8.17.1"/>
  <changelog author="nfbrown@suse.com" date="1544702400">- Eanble new mdadm timers mdcheck_start.timer and  mdmonitor-oneshot.timer
  (bsc#1115407)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1547035200">- Enable new unbound-anchor timer to keep root.key updated
  (bsc#1115417)</changelog>
  <changelog author="kukuk@suse.de" date="1547208000">- Add issue-generator.path to make sure /etc/issue is really
  regenerated if snippets change [bsc#1116825]</changelog>
  <changelog author="tiwai@suse.de" date="1547553600">- Add default user preset: currently containing only the new
  pulseaudio.socket (bsc#1083473)</changelog>
  <changelog author="sbrabec@suse.com" date="1547812800">- branding-preset-states: Apply preset to all unit types
  (bsc#1121219).
- Rename 90-default-SUSE.preset to 95-default-SUSE.preset, so
  product branding takes precedence over common presets.</changelog>
  <changelog author="psimons@suse.com" date="1548244800">- Recent versions of mlocate don't use updatedb.timer any more.
  Instead, the unit is called mlocate.timer. [boo#1115408]</changelog>
  <changelog author="sschricker@suse.com" date="1552564800">- enable nvmefc-boot-connections.service to discover
  network-provided nvme drives on boot (bsc#1128428)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1554120000">- Enable logwatch.timer (bsc#1112500).</changelog>
  <changelog author="iforster@suse.com" date="1559822400">- Enable ignition-firstboot-complete.service</changelog>
  <changelog author="dimstar@opensuse.org" date="1560340800">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="ngompa13@gmail.com" date="1597147200">- Enable dnf-makecache.timer</changelog>
  <changelog author="fvogt@suse.com" date="1598443200">- Enable btrfsmaintenance-refresh.path and disable
  btrfsmaintenance-refresh.service to avoid needless refresh on boot
  (boo#1165780)</changelog>
  <changelog author="alarrosa@suse.com" date="1614859200">- Enable user services pipewire.socket and pipewire-pulse.socket
  (boo#1183012).</changelog>
  <changelog author="fcrozat@suse.com" date="1615377600">- Enable user service pipewire-media-session.service (used with
  pipewire &gt;= 0.3.23).</changelog>
  <changelog author="msuchanek@suse.com" date="1617796800">- Enable hcn-init.service for HNV on POWER (bsc#1184136 ltc#192155).</changelog>
  <changelog author="alarrosa@suse.com" date="1622116800">- When installing the systemd-presets-common-SUSE package for the
  first time in a new system, it might happen that some services
  are installed before systemd so the %systemd_pre/post macros
  would not work. This is handled by enabling all preset services
  in this package's %posttrans section but it wasn't enabling
  user services, just system services. Now it enables also the
  user services installed before this package, thus fixing
  boo#1186561</changelog>
  <changelog author="kallan@suse.com" date="1643716800">- enable vgauthd service for VMWare by default (bsc#1195251)</changelog>
  <changelog author="alarrosa@suse.com" date="1655121600">- Add the wireplumber user service preset to enable it by default
  in SLE15-SP4 where it replaced pipewire-media-session, but keep
  pipewire-media-session preset so we don't have to branch the
  systemd-presets-common-SUSE package for SP4 (boo#1200485)</changelog>
  <changelog author="alarrosa@suse.com" date="1655208000">- Modify branding-preset-states to fix systemd-presets-common-SUSE
  not enabling new user systemd service preset configuration just
  as it handles system service presets. By passing an (optional)
  second parameter "user", the save/apply-changes commands now
  work with user services instead of system ones (boo#1200485)</changelog>
  <changelog author="iforster@suse.com" date="1657108800">- enable ignition-delete-config by default (bsc#1199524)</changelog>
</package>
<package pkgid="3c84dca143a4bbf98d0082b582643fa5a98e4e6522361571ebbec6723127a56f" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="11a26b28322a0d89766f52be9277b85f4006a0f5736d5e9852abd26ab9b0af01" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="f0a6188ec9dd4ce1d87e7a7bcec29aed6df547fbacc8294d0c041190f4175dee" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="2a7da59a8ab2b98e203f896d25cd4431921a0e7a425d3491dfcaa248291f31c2" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="2312c0302bd50c269c25d3b270a6f6fc69042a3bfbf8ba061b4be8b7a23c8e90" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="202339a509a63497a592f1d91aa29c75645c1a99b8609b51d34219df3c86a9aa" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="ef3ae6f79efc5a774d8b1b084047373e1ef04fc0cb9a871e7cf1f43bb19701d9" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="eb4a82dee3f9251c44ae20584f7112200fed89fc5ea4de40b8f3594a7555e894" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="81560cedb8d56d54aa87ddc750beac7ae616d70663d5fce5fec9c8111514be52" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.15.1"/>
  <changelog author="kstreitova@suse.com" date="1490270400">- move binaries from /bin to /usr/bin [bsc#1029977]
  * refresh tar-backup-spec-fix-paths.patch to change path of the
    tar binary from TAR=/bin/tar to TAR=/usr/bin/tar
- use spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490616000">- Disable tar-1.26-remove_O_NONBLOCK.patch - this issue has been
  fixed in tar-1.27
- backup-scripts subpackage change to noarch
- Change rpm group of tar-tests to Development/Tools/Other
- Enable rmt building, change package description
- Switch rmt to alternatives system
- Separate rmt subpackage - it can be used by different archiving
  tools as a dedicated program
- Change rmt path to /usr/bin folder - it can be used by non privileged
  users for backup purposes. Security is controlled by access rights to
  the targets and remote shell.
- Separate doc subpackage
- Remove conditions for old SUSE builds and lang subpackage
- Rename restore script to restore.sh for avoiding file conflicts
  with dump/restore</changelog>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
</package>
<package pkgid="5118940ba0906e0d75fae3160e545f232939301322cf8331010573d4d3cb6f15" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.15.1"/>
  <changelog author="kstreitova@suse.com" date="1490270400">- move binaries from /bin to /usr/bin [bsc#1029977]
  * refresh tar-backup-spec-fix-paths.patch to change path of the
    tar binary from TAR=/bin/tar to TAR=/usr/bin/tar
- use spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490616000">- Disable tar-1.26-remove_O_NONBLOCK.patch - this issue has been
  fixed in tar-1.27
- backup-scripts subpackage change to noarch
- Change rpm group of tar-tests to Development/Tools/Other
- Enable rmt building, change package description
- Switch rmt to alternatives system
- Separate rmt subpackage - it can be used by different archiving
  tools as a dedicated program
- Change rmt path to /usr/bin folder - it can be used by non privileged
  users for backup purposes. Security is controlled by access rights to
  the targets and remote shell.
- Separate doc subpackage
- Remove conditions for old SUSE builds and lang subpackage
- Rename restore script to restore.sh for avoiding file conflicts
  with dump/restore</changelog>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
</package>
<package pkgid="d24419ff3031e7d06f11f01db9dd503e9112da54af8159d9540d9ef1444124ba" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.15.1"/>
  <changelog author="kstreitova@suse.com" date="1490270400">- move binaries from /bin to /usr/bin [bsc#1029977]
  * refresh tar-backup-spec-fix-paths.patch to change path of the
    tar binary from TAR=/bin/tar to TAR=/usr/bin/tar
- use spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490616000">- Disable tar-1.26-remove_O_NONBLOCK.patch - this issue has been
  fixed in tar-1.27
- backup-scripts subpackage change to noarch
- Change rpm group of tar-tests to Development/Tools/Other
- Enable rmt building, change package description
- Switch rmt to alternatives system
- Separate rmt subpackage - it can be used by different archiving
  tools as a dedicated program
- Change rmt path to /usr/bin folder - it can be used by non privileged
  users for backup purposes. Security is controlled by access rights to
  the targets and remote shell.
- Separate doc subpackage
- Remove conditions for old SUSE builds and lang subpackage
- Rename restore script to restore.sh for avoiding file conflicts
  with dump/restore</changelog>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
</package>
<package pkgid="c4837b75803d27264ad6dfb0d4eb61952c01a27c0fe3505ec76dc28fb8791195" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.18.1"/>
  <changelog author="svalx@svalx.net" date="1490616000">- Disable tar-1.26-remove_O_NONBLOCK.patch - this issue has been
  fixed in tar-1.27
- backup-scripts subpackage change to noarch
- Change rpm group of tar-tests to Development/Tools/Other
- Enable rmt building, change package description
- Switch rmt to alternatives system
- Separate rmt subpackage - it can be used by different archiving
  tools as a dedicated program
- Change rmt path to /usr/bin folder - it can be used by non privileged
  users for backup purposes. Security is controlled by access rights to
  the targets and remote shell.
- Separate doc subpackage
- Remove conditions for old SUSE builds and lang subpackage
- Rename restore script to restore.sh for avoiding file conflicts
  with dump/restore</changelog>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
</package>
<package pkgid="37e4dbd883404a59c73bd1815ae30eaeae753a03e64c44edf32ad68de862449e" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.18.1"/>
  <changelog author="svalx@svalx.net" date="1490616000">- Disable tar-1.26-remove_O_NONBLOCK.patch - this issue has been
  fixed in tar-1.27
- backup-scripts subpackage change to noarch
- Change rpm group of tar-tests to Development/Tools/Other
- Enable rmt building, change package description
- Switch rmt to alternatives system
- Separate rmt subpackage - it can be used by different archiving
  tools as a dedicated program
- Change rmt path to /usr/bin folder - it can be used by non privileged
  users for backup purposes. Security is controlled by access rights to
  the targets and remote shell.
- Separate doc subpackage
- Remove conditions for old SUSE builds and lang subpackage
- Rename restore script to restore.sh for avoiding file conflicts
  with dump/restore</changelog>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
</package>
<package pkgid="f3387148fdeb10ce40a9aa8478d06b7238d16386abd93cd0b35c6f046f9c9478" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.18.1"/>
  <changelog author="svalx@svalx.net" date="1490616000">- Disable tar-1.26-remove_O_NONBLOCK.patch - this issue has been
  fixed in tar-1.27
- backup-scripts subpackage change to noarch
- Change rpm group of tar-tests to Development/Tools/Other
- Enable rmt building, change package description
- Switch rmt to alternatives system
- Separate rmt subpackage - it can be used by different archiving
  tools as a dedicated program
- Change rmt path to /usr/bin folder - it can be used by non privileged
  users for backup purposes. Security is controlled by access rights to
  the targets and remote shell.
- Separate doc subpackage
- Remove conditions for old SUSE builds and lang subpackage
- Rename restore script to restore.sh for avoiding file conflicts
  with dump/restore</changelog>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
</package>
<package pkgid="8a88b99bddf7f8106eadb33e0b9b56067430df0b7e66a96478fff2dc549a0977" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.22.3"/>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
</package>
<package pkgid="015beb7bf6e0877cc6f6f4995cfced9ed94d529141cdf6e515c11c6e4228570a" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.22.3"/>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
</package>
<package pkgid="71ae127229414f6b32b2e18b29b488bd66ad5209a7e36b416192b18eaf561add" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.22.3"/>
  <changelog author="svalx@svalx.net" date="1491220800">- Use update-alternatives according to current documentation</changelog>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
</package>
<package pkgid="7e87605122633ea88abffa0056e3301b783edf985496f2fdaa16808f772582bc" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.26.1"/>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
</package>
<package pkgid="85554aa2006c0c7ad31d97702db4dd0540e7f76d3a8855b4e0fd94bb9c923c63" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.26.1"/>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
</package>
<package pkgid="abbf2a998c64f592bedfe8ae2e6e391d37e39a745b63d09c6c7bc6eb6dcab337" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.26.1"/>
  <changelog author="kstreitova@suse.com" date="1492689600">- remove tar-1.26-remove_O_NONBLOCK.patch as this issue was fixed
  in tar 1.27 (commit 03858cf583ce299b836d8a848967ce290a6bf303)</changelog>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
</package>
<package pkgid="59e656cb93977c9f2fadace811290923be2fd00e3680b5a230e5eab3be8d401b" name="tar" arch="aarch64">
  <version epoch="0" ver="1.34" rel="150000.3.31.1"/>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676376000">- Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that
  results in use of uninitialized memory for a conditional jump
  (CVE-2022-48303, bsc#1207753)
  * fix-CVE-2022-48303.patch
- Fix hang when unpacking test tarball, bsc#1202436
  * remove bsc1202436.patch
  * bsc1202436-1.patch
  * bsc1202436-1.patch</changelog>
</package>
<package pkgid="b3cf9ef1092da901254617db96cd0b82361b43ed94c71dc90799021d446245c0" name="tar" arch="src">
  <version epoch="0" ver="1.34" rel="150000.3.31.1"/>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676376000">- Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that
  results in use of uninitialized memory for a conditional jump
  (CVE-2022-48303, bsc#1207753)
  * fix-CVE-2022-48303.patch
- Fix hang when unpacking test tarball, bsc#1202436
  * remove bsc1202436.patch
  * bsc1202436-1.patch
  * bsc1202436-1.patch</changelog>
</package>
<package pkgid="4fc7c60f33460d2430c9ed4f5f40881e9d0ee98c2a59172247acf0b4a8b2094f" name="tar" arch="x86_64">
  <version epoch="0" ver="1.34" rel="150000.3.31.1"/>
  <changelog author="avindra@opensuse.org" date="1513598400">- GNU tar 1.30:
  * Member names containing '..' components are now skipped when
    extracting.
  * Report erroneous use of position-sensitive options.
  * --numeric-owner now affects private headers too.
  * Fixed the --delay-directory-restore option
  * The --warnings=failed-read option
  * The --warnings=none option now suppresses all warnings
  * Fix reporting of hardlink mismatches during compare
- cleanup with spec-cleaner
- switch all urls to https
- drop upstreamed patches
  * add-return-values-to-backup-scripts.patch
  * tar-1.29-extract_pathname_bypass.patch
- rebase add_readme-tests.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1515067200">- add tar-1.30-tests-difflink.patch to fix difflink.at test
  (https://www.mail-archive.com/bug-tar@gnu.org/msg05440.html)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="kstreitova@suse.com" date="1526040000">- add tar-1.30-tests_dirrem_race.patch to fix race in dirrem01 and
  dirrem02 tests that were passing/failing randomly because of that
- run spec-cleaner
- renumber patches</changelog>
  <changelog author="kstreitova@suse.com" date="1550145600">- update to version 1.31
  * Fix heap-buffer-overrun with --one-top-level, bug introduced
    with the addition of that option in 1.28
  * Support for zstd compression
  * New option '--zstd' instructs tar to use zstd as compression
    program. When listing, extractng and comparing, zstd compressed
    archives are recognized automatically. When '-a' option is in
    effect, zstd compression is selected if the destination archive
    name ends in '.zst' or '.tzst'.
  * The -K option interacts properly with member names given in the
    command line. Names of members to extract can be specified along
    with the "-K NAME" option. In this case, tar will extract NAME
    and those of named members that appear in the archive after it,
    which is consistent with the semantics of the option. Previous
    versions of tar extracted NAME, those of named members that
    appeared before it, and everything after it.
  * Fix CVE-2018-20482 - When creating archives with the --sparse
    option, previous versions of tar would loop endlessly if a
    sparse file had been truncated while being archived.
- remove the following patches (upstreamed)
  * tar-1.30-tests-difflink.patch
  * tar-1.30-tests_dirrem_race.patch
- refresh add_readme-tests.patch
- add tar-1.31-tests_dirrem.patch to fix expected output in dirrem
  tests
- add tar-1.31-racy_compress_tests.patch to fix compression tests</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1552651200">- Remove libattr-devel from buildrequires, tar no longer uses
  it but finds xattr functions in libc.</changelog>
  <changelog author="kstreitova@suse.com" date="1553515200">- update to version 1.32
  * Fix the use of --checkpoint without explicit --checkpoint-action
  * Fix extraction with the -U option
  * Fix iconv usage on BSD-based systems
  * Fix possible NULL dereference (savannah bug #55369)
    [bsc#1130496] [CVE-2019-9923]
  * Improve the testsuite
- remove tar-1.31-tests_dirrem.patch and
  tar-1.31-racy_compress_tests.patch that are no longer needed
  (applied usptream)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- No longer recommend -lang: supplements are in use.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585915200">- Drop Requires(pre) info in the preamble: the main package does
  not contain any info files, and has not even a pre script. The
  - doc subpackage already has the correct deps.</changelog>
  <changelog author="lnussel@suse.de" date="1603108800">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1610193600">- GNU tar 1.33:
  * POSIX extended format headers do not include PID by default
  * --delay-directory-restore works for archives with reversed
    member ordering
  * Fix extraction of a symbolic link hardlinked to another
    symbolic link
  * Wildcards in exclude-vcs-ignore mode don't match slash
  * Fix the --no-overwrite-dir option
  * Fix handling of chained renames in incremental backups
  * Link counting works for file names supplied with -T
  * Accept only position-sensitive (file-selection) options in file
    list files
- remove deprecated texinfo packaging macros</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1613304000">- GNU tar 1.34:
  * Fix extraction over pipe
  * Fix memory leak in read_header
  * Fix extraction when . and .. are unreadable
  * Gracefully handle duplicate symlinks when extracting
  * Re-initialize supplementary groups when switching to user
    privileges</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1623240000">- Link /var/lib/tests/tar/bin/genfile as Position-Independent Executable
  (bsc#1184124).
  + tar-PIE.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1633694400">- The following issues have already been fixed in this package but
  weren't previously mentioned in the changes file:
  * bsc#1181131, CVE-2021-20193
  * bsc#1120610</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1634212800">- tests-skip-time01-on-32bit-time_t.patch: Add patch to skip test
  'tests/time01.at' on platforms with 32-bit time_t for now.
- tar.spec: Reference it.
  (%check): Output the testsuite.log in case the testsuite failed.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1655726400">- Fix race condition while creating intermediate subdirectories,
  bsc#1200657
  * bsc1200657.patch</changelog>
  <changelog author="sflees@suse.de" date="1660737600">- bsc1200657.patch was previously incomplete leading to deadlocks
  * bsc#1202436
  * bsc1200657.patch updated</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- Fix unexpected inconsistency when making directory, bsc#1203600
  * tar-avoid-overflow-in-symlinks-tests.patch
  * tar-fix-extract-unlink.patch
- Update race condition fix, bsc#1200657
  * tar-fix-race-condition.patch
- Refresh bsc1200657.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Fix hang when unpacking test tarball, bsc#1202436
  * bsc1202436.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676376000">- Fix CVE-2022-48303, tar has a one-byte out-of-bounds read that
  results in use of uninitialized memory for a conditional jump
  (CVE-2022-48303, bsc#1207753)
  * fix-CVE-2022-48303.patch
- Fix hang when unpacking test tarball, bsc#1202436
  * remove bsc1202436.patch
  * bsc1202436-1.patch
  * bsc1202436-1.patch</changelog>
</package>
<package pkgid="1c6bd87f8a8656f8db5ca25c8b61045bbb28fcbe3a90ea01a23115ed087284fa" name="terminfo" arch="aarch64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="a9693750f938c8c0753073ff0ca56c4f7d9fc6c60f48e5282c038b4be326269e" name="terminfo" arch="x86_64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="5a332cc48f27092408f4ba1316ec8c51fca31b0d71cd09a58b106a5233f0f9ae" name="terminfo-base" arch="aarch64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="8a1d30e1ccbf059028959da9d134f3a48c304a251bad2c0a7bdea86c3a35d8ca" name="terminfo-base" arch="x86_64">
  <version epoch="0" ver="6.1" rel="150000.5.12.1"/>
  <changelog author="werner@suse.de" date="1515499200">- Add ncurses patch 20180106
  + fixes for writing extended color pairs in putwin.
  + modify test/savescreen.c to add test patterns that exercise 88-,
    256-, etc., colors.
  + modify configure option --with-build-cc, adding clang, c89 and c99
    as possible default values.
  + modify ncurses-examples configure script to use pkg-config for the
    extra form/menu/panel libraries, to be more consistent with the
    handling of the curses/ncurses library.
  + modify test-packages for mingw to supply "pc" files.
  + modify gen-pkgconfig.in to list -lpthread as a private library when
    configured to access it via weak symbols.
  + simplify gen-pkgconfig.in, adding -ltinfo without the special linker
    checks because some versions of the linker simply hard-code the
    behavior.
  + update URLs for ncurses website to use https.
  + modify CF_CURSES_LIBS to fill in $cf_nculib_root in case the
    ncurses-examples are built with a system ncurses that lacks the
    standard "curses" symbolic link, as done by SuSE.  The symbol is
    needed to make a followup check for the pthread library work, and
    would be set properly using the options "--with-screen", etc.
  + generate misc/*.pc with "all" rule, as done for "sources" rule
    (report by Jeffrey Walton).</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add ncurses patch 20180121 pre-release 6.1
  &gt; terminfo changes:
  + add xterm+noalt, xterm+titlestack, xterm+alt1049, xterm+alt+title
    blocks from xterm #331 -TD
  + add xterm+direct, xterm+indirect, xterm-direct entries from xterm
    [#331] -TD
  + modify xterm+256color and xterm+256setaf to use correct number of
    color pairs, for ncurses 6.1 -TD
  + add rs1 capability to xterm-256color -TD
  + modify xterm-r5, xterm-r6 and xterm-xf86-v32 to use xterm+kbs to
    match xterm #272, reflecting packager's changes -TD
  + remove "boolean" Se, Ss from st-0.7 -TD
  + add konsole-direct and st-direct -TD
  + remove unsupported "Tc" capability from st-0.7; use st-direct if
    direct-colors are wanted -TD
  + add vte-direct -TD
  + add XT, hpa, indn, and vpa to screen, and invis, E3 to tmux (patch by
    Pierre Carru)
  + use xterm+sm+1006 in xterm-new, vte-2014 -TD
  + use xterm+x11mouse in iterm, iterm2, mlterm3 because xterm's 1006
    mode does not work with those programs.  konsole is debatable -TD
  + add "termite" entry (report by Markus Pfeiffer) -TD
  &gt; merge branch begun April 2, 2017 which provides these features:
  + support read/write new binary-format for terminfo which stores
    numeric capabilities as a signed 32-bit integer.  The test programs
    such as picsmap, ncurses were created or updated during 2017 to use
    this feature.
  + the new format is written by the wide-character configuration of
    tic when it finds a numeric capability larger than 32767.
  + other applications such as infocmp built with the wide-character
    ncurses library work as expected.
  + applications built with the "narrow" (8-bit) configuration will
    read the new format, but will limit those extended values to 32767.
  + in either wide/narrow configuration, the structure defined in
    term.h still uses signed 16-bit values.
  + because it is incompatible with the legacy (mid-1980s) binary format,
    a new magic value is provided for the "file" program.
  + the term.5 manual page is updated to describe this new format.
  + the limit on file-size for compiled terminfo is increased in the
    wide-character configuration to 32768.
- Add ncurses patch 20180120
  + build-fix in picsmap.c for stdint.h existence.
  + add --disable-stripping option to configure scripts.
  + modify ncurses-examples to install test-scripts in the data directory.
  + work around tool-breakage in Debian 9 and later by invoking
    gprconfig to specify the C compiler to be used by gnatmake,
    and conditionally suppressing Library_Options line for static
    libraries.
  + bump the compat level for test-packages to 7, i.e., Debian 5.
- Add tack patch 1.08-20170818</changelog>
  <changelog author="werner@suse.de" date="1517227200">- Update to ncurses 6.1 (patch 20180127)
  + updated release notes
  + amend a warning message from tic which should have flagged misuse
    of "XT" capability in "screen" terminal description.
  &gt; terminfo changes:
  + trim "XT" from screen entry, add comments to explain why it was
    not suitable -TD
  + modify iterm to use xterm+sl-twm building block -TD
  + mark konsole-420pc, konsole-vt100, konsole-xf3x obsolete reflecting
    konsole's removal in 2008 -TD
  + expanded the history section of konsole to explain its flawed
    imitation of xterm's keyboard -TD
  + use xterm+x11mouse in screen.* entries because screen does not yet
    support xterm's 1006 mode -TD
  + add nsterm-build400 for macOS 10.13 -TD
  + add ansi+idc1, use that in ansi+idc adding dch for consistency -TD
  + update vte to vte-2017 -TD
  + add ecma+strikeout to vte-2017 -TD
  + add iterm2-direct -TD
  + updated teraterm, added teraterm-256color -TD
  + add mlterm-direct -TD
  + add descriptions for ANSI building-blocks -TD
- Modify patch ncurses-5.9-ibm327x.dif
- Rename patch ncurses-6.0.dif to new name ncurses-6.1.dif
- Modify patch ncurses-6.1.dif</changelog>
  <changelog author="werner@suse.de" date="1517313600">- Correct include path for wide chraracter header files for ABI 6.1</changelog>
  <changelog author="werner@suse.de" date="1517313601">- Add ncurses patch 6.1-20180129
  + update "VERSION" file, used in shared-library naming.</changelog>
  <changelog author="werner@suse.de" date="1517832000">- Add ncurses patch 6.1-20180203
  + minor fixes to test/*.h to make them idempotent.
  + add/use test/parse_rgb.h to show how the "RGB" capability works.
  + add a clarification in user_caps.5 regarding "RGB" capability.
  + add extended_slk_color{,_sp} symbols to the appropriate
    package/*.{map,sym} files (report by Sven Joachim, cf: 20170401).</changelog>
  <changelog author="werner@suse.de" date="1518696000">- Add ncurses patch 6.1-20180210
  + modify misc/Makefile.in to install/uninstall explicit list in case
    the build-directory happens to have no ".pc" files when an uninstall
    is performed (report by Jeffrey Walton).
  + deprecate safe-sprintf, since the vsnprintf function, which does what
    was needed, was standardized long ago.
  + add several development/experimental options to development packages.
  + minor reordering of options in configure script to make the threaded
    and reentrant options distinct from the other extensions which are
    normally enabled.
- Make reentrant libs opaque</changelog>
  <changelog author="werner@suse.de" date="1519041600">- Add ncurses patch 6.1-20180217
  + remove incorrect free() from 20170617 changes (report by David Macek).
  + correct type for "U8" in user_caps.5; it is a number not boolean.
  + add a null-pointer check in safe_sprintf.c (report by Steven Noonan).
  + improve fix for Debian #882620 by reusing limit2 variable (report
    Julien Cristau, Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519646400">- Add ncurses patch 6.1-20180224
  + modify _nc_resolve_uses2() to detect incompatible types when merging
    a "use=" clause of extended capabilities.  The problem was seen in a
    defective terminfo integrated from simpleterm sources in 20171111,
    compounded by repair in 20180121.
  + correct Ss/Ms interchange in st-0.7 entry (tmux #1264) -TD
  + fix remaining flash capabilities with trailing mandatory delays -TD
  + correct cut/paste in NEWS (report by Sven Joachim).</changelog>
  <changelog author="werner@suse.de" date="1519905600">- Add patch ncurses-6.1-weakpthreads.dif
  + Be aware that libtinfo/libtinfw is also used without libpthread
    (boo#1058509)
- Use expect to run at least two test for normal and wide character
  version of newdemo from test suite</changelog>
  <changelog author="werner@suse.de" date="1519992000">- Switch back to shared libtinfo only but provide an auxiliary shared
  library libtinfow to avoid a rebuild of third party programs (bsc#1082772)
  + Add sanity check if new 32bit API is included in libtinfo</changelog>
  <changelog author="werner@suse.de" date="1520251200">- Add ncurses patch 6.1-20180303
  + modify TurnOn/TurnOff macros in lib_vidattr.c and lib_vid_attr.c to
    avoid expansion of "CUR" in trace.
  + improve a few lintian warnings in test-packages.
  + modify lib_setup to avoid calling pthread_self() without first
    verifying that the address is valid, i.e., for weak symbols
    (report/patch by Werner Fink).
  + modify generated terminfo.5 to not use "expand" and related width
    on the last column of tables, making layout on wide terminals look
    better (adapted from patch by Kir Kolyshkin).
  + add a category to report_offsets, e.g., "w" for wide-character, "t"
    for threads to make the report more readable.  Reorganized the
    structures reported to make the categories more apparent.
  + simplify some ifdef's for extended-colors.
  + add NCURSES_GLOBALS and NCURSES_PRESCREEN to report_offsets, to show
    how similar the different tinfo configurations are.
- Remove patch ncurses-6.1-weakpthreads.dif now upstream (bsc#1082772)
- Make expect build check less fragile on timing</changelog>
  <changelog author="werner@suse.de" date="1520510400">- Avoid opaque libraries for Leap 15 and SLES 15
- No tests on Leap 15 and SLES 15</changelog>
  <changelog author="werner@suse.de" date="1521460800">- Add ncurses patch 6.1-20180317
  + fix a check in infotocap which may not have detected a problem when
    it should have.
  + add a check in tic for the case where setf/setb are given using
    different strings, but provide identical results to setaf/setab.
  + further improve fix for terminfo.5 (patch by Kir Kolyshkin).
  + reorder loop-limit checks in winsnstr() in case the string has no
    terminating null and only the number of characters is used (patch
    by Gyorgy Jeney).</changelog>
  <changelog author="werner@suse.de" date="1521633600">- Change baselibs.conf to avoid mixed version requirements (bsc#1082744)</changelog>
  <changelog author="werner@suse.de" date="1542715200">- Add patch ncurses-5.9-bsc1115929.patch
  * For bug bsc#1115929 port back null pointer checks to catch e.g.
    the crash in _nc_parse_entry(), belongs to CVE-2018-19211</changelog>
  <changelog author="werner@suse.de" date="1542801600">- Remove screen.xterm from terminfo data base (boo#1103320) as with
  this screen uses fallback TERM=screen</changelog>
  <changelog author="werner@suse.de" date="1571140800">- Add patches
  CVE-2019-17594.patch for bsc#1154036 -- CVE-2019-17594: heap-based
    buffer over-read in _nc_find_entry function in tinfo/comp_hash.c
  CVE-2019-17595.patch for bsc#1154037 -- CVE-2019-17595: heap-based
    buffer over-read in fmt_entry function in tinfo/comp_hash.c</changelog>
  <changelog author="werner@suse.de" date="1634126400">- Add patch bsc1190793-63ca9e06.patch to fix bsc#1190793 for
  CVE-2021-39537: ncurses: heap-based buffer overflow in
  _nc_captoinfo in captoinfo.c</changelog>
  <changelog author="werner@suse.de" date="1657886400">- Add patch ncurses-bnc1198627.patch
  * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read</changelog>
</package>
<package pkgid="cf894ad1d9f059f1d5e6fdf7a8c5641170c06aed4bb4bb2fde520ea5e4708e7c" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.11.1"/>
  <changelog author="mvetter@suse.com" date="1519128000">- bsc#1081690: Add tiff-4.0.9-bsc1081690-CVE-2018-5784.patch
  Fix uncontrolled resource consumption in TIFFSetDirectory</changelog>
  <changelog author="pgajdos@suse.com" date="1526385600">- security update
  * CVE-2018-10963 [bsc#1092949]
    + tiff-CVE-2018-10963.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1526644800">- security update
  * CVE-2017-18013 [bsc#1074317]
    + tiff-CVE-2017-18013.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
</package>
<package pkgid="c689256415035fcb51f3086b48b75474903da2bb590612216eb2d45bef8ffcc3" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.16.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2018-7456 [bsc#1082825]
    + tiff-CVE-2018-7456.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528113601">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
</package>
<package pkgid="8107e629c6be218b981e0562cb3fc1c7791957d89e7fdf2de577a418f060c971" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.19.1"/>
  <changelog author="pgajdos@suse.com" date="1528113600">- security update
  * CVE-2017-11613 [bsc#1082332]
    + tiff-CVE-2017-11613.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
</package>
<package pkgid="01115c5d322baca44af9f73054a8c31b7e6bc72aeea077c9d5ce63312ede6223" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.22.1"/>
  <changelog author="pgajdos@suse.com" date="1528200000">- security update
  * CVE-2018-8905 [bsc#1086408]
    + tiff-CVE-2018-8905.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
</package>
<package pkgid="9145701df961a5b496f4004bf8798a44188d11e6f2b3966b37b5b5f4921b09bd" name="tiff" arch="src">
  <version epoch="0" ver="4.0.9" rel="150000.45.25.1"/>
  <changelog author="pgajdos@suse.com" date="1534334400">- security update
  * CVE-2018-10779 [bsc#1092480]
    + tiff-CVE-2018-10779.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1539777600">- security update
  * CVE-2018-17100 [bsc#1108637]
    + tiff-CVE-2018-17100.patch
  * CVE-2018-17101 [bsc#1108627]
    + tiff-CVE-2018-17101.patch
  * CVE-2018-17795 [bsc#1110358]
    % tiff-4.0.9-bsc1046077-CVE-2017-9935.patch renamed to
    tiff-CVE-2017-9935,CVE-2018-17795.patch
  * CVE-2018-16335 [bsc#1106853]
    % tiff-CVE-2017-11613.patch renamed to
    tiff-CVE-2017-11613,CVE-2018-16335,15209.patch
- add a possibility to build with ASAN</changelog>
  <changelog author="pgajdos@suse.com" date="1542024000">- asan_build: build ASAN included
- debug_build: build more suitable for debugging</changelog>
  <changelog author="pgajdos@suse.com" date="1542024001">- security update
  * CVE-2018-18661 [bsc#1113672]
    + tiff-CVE-2018-18661.patch
  * CVE-2018-18557 [bsc#1113094]
    + tiff-CVE-2018-18557.patch
  * CVE-2018-12900 [bsc#1099257]
    + tiff-CVE-2018-12900.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1542628800">- security update
  * CVE-2018-19210 [bsc#1115717]
    + tiff-CVE-2018-19210.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548849600">- extend tiff-CVE-2018-19210.patch and rename it to
  tiff-CVE-2018-17000,19210.patch [bsc#1108606c#11]
  * solves CVE-2018-19210 [bsc#1115717] and CVE-2018-17000 [bsc#1108606]</changelog>
  <changelog author="mvetter@suse.com" date="1549281600">- security update
  * CVE-2019-6128 [bsc#1121626]
    + tiff-CVE-2019-6128.patch</changelog>
  <changelog author="mvetter@suse.com" date="1549972800">- security update
  * CVE-2019-7663 [bsc#1125113]
    + tiff-CVE-2019-7663.patch</changelog>
  <changelog author="mvetter@suse.com" date="1573041600">- security update: Fix integer overflow in _TIFFCheckMalloc()
  * CVE-2019-14973 [bsc#1146608]
    + tiff-CVE-2019-14973.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573041601">- security update: amend patch to fix test
- modified patches
  % tiff-CVE-2019-14973.patch (refreshed)</changelog>
  <changelog author="mvetter@suse.com" date="1642420800">- security update: Fix buffer overwrite
  * CVE-2019-17546[bsc#1154365]
    + tiff-CVE-2019-17546.patch
- security update: Fix heap based buffer overflow in pal2rgb
  * CVE-2017-17095[bsc#1071031]
    + tiff-CVE-2017-17095.patch
- security update: Fix OOB in _TIFFmemcpy
  * CVE-2022-22844[bsc#1194539]
    + tiff-CVE-2022-22844.patch
- security update: Fix memory allocation failure in tif_read.c
  * CVE-2020-35521[bsc#1182808] CVE-2020-35522[bsc#1182809]
    + tiff-CVE-2020-35521,CVE-2020-35522.patch
- security update: Fix DOS via invertImage()
  * CVE-2020-19131[bsc#1190312]
    + tiff-CVE-2020-19131.patch
- security update: Fix heap-based buffer overflow in TIFF2PDF tool
  * CVE-2020-35524[bsc#1182812]
    + tiff-CVE-2020-35524.patch
- security update: Fix integer overflow in tif_getimage
  * CVE-2020-35523 [bsc#1182811]
    + tiff-CVE-2020-35523.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838400">- security update
  * CVE-2022-1056 [bsc#1197631]
  * CVE-2022-0891 [bsc#1197068]
    + tiff-CVE-2022-1056,CVE-2022-0891.patch</changelog>
  <changelog author="mvetter@suse.com" date="1651838401">- security update
  * CVE-2022-0561 [bsc#1195964]
    + tiff-CVE-2022-0561.patch
  * CVE-2022-0562 [bsc#1195965]
    + tiff-CVE-2022-0562.patch
  * CVE-2022-0865 [bsc#1197066]
    + tiff-CVE-2022-0865.patch
  * CVE-2022-0909 [bsc#1197072]
    + tiff-CVE-2022-0909.patch
  * CVE-2022-0924 [bsc#1197073]
    + tiff-CVE-2022-0924.patch
  * CVE-2022-0908 [bsc#1197074]
    + tiff-CVE-2022-0908.patch</changelog>
  <changelog author="mvetter@suse.com" date="1657108800">- security update
  * CVE-2022-2056 [bsc#1201176]
  * CVE-2022-2057 [bsc#1201175]
  * CVE-2022-2058 [bsc#1201174]
    + tiff-CVE-2022-2056,CVE-2022-2057,CVE-2022-2058.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659355200">- security update:
  * CVE-2022-34526 [bsc#1202026]
    + tiff-CVE-2022-34526.patch</changelog>
  <changelog author="mvetter@suse.com" date="1659528000">- CVE-2022-34266 [bsc#1201971] and [bsc#1201723]:
  Rename tiff-CVE-2022-0561.patch to
  tiff-CVE-2022-0561,CVE-2022-34266.patch
  This CVE is actually a duplicate.</changelog>
  <changelog author="mvetter@suse.com" date="1666008000">- security update:
  * CVE-2022-2519 [bsc#1202968]
  * CVE-2022-2520 [bsc#1202973]
  * CVE-2022-2521 [bsc#1202971]
    + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch
  * CVE-2022-2867 [bsc#1202466]
  * CVE-2022-2868 [bsc#1202467]
  * CVE-2022-2869 [bsc#1202468]
    + tiff-CVE-2022-2867,CVE-2022-2868,CVE-2022-2869.patch</changelog>
  <changelog author="mvetter@suse.com" date="1668340800">- security update:
  * CVE-2022-3597 [bsc#1204641]
  * CVE-2022-3626 [bsc#1204644]
  * CVE-2022-3627 [bsc#1204645]
    + tiff-CVE-2022-3597,CVE-2022-3626,CVE-2022-3627.patch
  * CVE-2022-3599 [bsc#1204643]
    + tiff-CVE-2022-3599.patch
  * CVE-2022-3970 [bsc#1205392]
    + tiff-CVE-2022-3970.patch</changelog>
  <changelog author="fstrba@suse.com" date="1668772800">- security update:
  * CVE-2022-3570 [bsc#1205422]
  * CVE-2022-3598 [bsc#1204642]
    + tiff-CVE-2022-3598,3570.patch</changelog>
  <changelog author="mvetter@suse.com" date="1674734400">- security update:
  * CVE-2022-48281 [bsc#1207413]
    + tiff-CVE-2022-48281.patch</changelog>
</package>
<package pkgid="d03bdc5fe33debaec8bed67c700bf14f07378cc246d10c9da058ec027ab27028" name="timezone" arch="aarch64">
  <version epoch="0" ver="2022a" rel="150000.75.10.1"/>
  <changelog author="astieger@suse.com" date="1539864000">- timezone update 2018f:
  * Volgograd moves from +03 to +04 on 2018-10-28.
  * Fiji ends DST 2019-01-13, not 2019-01-20.
  * Most of Chile changes DST dates, effective 2019-04-06
    (bsc#1104700)
  * Corrections to past timestamps of DST transitions
  * Use "PST" and "PDT" for Philippine time
  * minor code changes to zic handling of the TZif format
  * documentation updates</changelog>
  <changelog author="astieger@suse.com" date="1539864001">- Avoid build failures of timezone-java with javazic SLE/Leap 15
  by using an alternative notation for a 1948-1951 DST transition
  in Japan. add timezone-2018f-bsc1112310.patch, fixes boo#1112310</changelog>
  <changelog author="astieger@suse.com" date="1540641600">- timezone update 2018g:
  * Morocco switches to permanent +01 on 2018-10-27 (bsc#1113554)
  * code fixes for zic on 32 bit</changelog>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
</package>
<package pkgid="85a37bc131e21a893a17462c33772bb023496d216b20644a6803ac2ba08be420" name="timezone" arch="src">
  <version epoch="0" ver="2022a" rel="150000.75.10.1"/>
  <changelog author="astieger@suse.com" date="1539864000">- timezone update 2018f:
  * Volgograd moves from +03 to +04 on 2018-10-28.
  * Fiji ends DST 2019-01-13, not 2019-01-20.
  * Most of Chile changes DST dates, effective 2019-04-06
    (bsc#1104700)
  * Corrections to past timestamps of DST transitions
  * Use "PST" and "PDT" for Philippine time
  * minor code changes to zic handling of the TZif format
  * documentation updates</changelog>
  <changelog author="astieger@suse.com" date="1539864001">- Avoid build failures of timezone-java with javazic SLE/Leap 15
  by using an alternative notation for a 1948-1951 DST transition
  in Japan. add timezone-2018f-bsc1112310.patch, fixes boo#1112310</changelog>
  <changelog author="astieger@suse.com" date="1540641600">- timezone update 2018g:
  * Morocco switches to permanent +01 on 2018-10-27 (bsc#1113554)
  * code fixes for zic on 32 bit</changelog>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
</package>
<package pkgid="027f50696ffc3d5b929ecfb147edde8c4d9291470357c29fe7cdc1c4271b90bd" name="timezone" arch="x86_64">
  <version epoch="0" ver="2022a" rel="150000.75.10.1"/>
  <changelog author="astieger@suse.com" date="1539864000">- timezone update 2018f:
  * Volgograd moves from +03 to +04 on 2018-10-28.
  * Fiji ends DST 2019-01-13, not 2019-01-20.
  * Most of Chile changes DST dates, effective 2019-04-06
    (bsc#1104700)
  * Corrections to past timestamps of DST transitions
  * Use "PST" and "PDT" for Philippine time
  * minor code changes to zic handling of the TZif format
  * documentation updates</changelog>
  <changelog author="astieger@suse.com" date="1539864001">- Avoid build failures of timezone-java with javazic SLE/Leap 15
  by using an alternative notation for a 1948-1951 DST transition
  in Japan. add timezone-2018f-bsc1112310.patch, fixes boo#1112310</changelog>
  <changelog author="astieger@suse.com" date="1540641600">- timezone update 2018g:
  * Morocco switches to permanent +01 on 2018-10-27 (bsc#1113554)
  * code fixes for zic on 32 bit</changelog>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
</package>
<package pkgid="15a272ea1711c862ac146bca2d55050754401df80b2ee926932e627eb09aa7e7" name="timezone" arch="aarch64">
  <version epoch="0" ver="2022f" rel="150000.75.15.1"/>
  <changelog author="astieger@suse.com" date="1540641600">- timezone update 2018g:
  * Morocco switches to permanent +01 on 2018-10-27 (bsc#1113554)
  * code fixes for zic on 32 bit</changelog>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
</package>
<package pkgid="5497294f597bdd42269d725c1739640b09cd2184928308eb94184da90dcc1e01" name="timezone" arch="src">
  <version epoch="0" ver="2022f" rel="150000.75.15.1"/>
  <changelog author="astieger@suse.com" date="1540641600">- timezone update 2018g:
  * Morocco switches to permanent +01 on 2018-10-27 (bsc#1113554)
  * code fixes for zic on 32 bit</changelog>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
</package>
<package pkgid="725b00069aa00886c111c9d8545db30ee557e89d518c53e35f4884d0c5627d3a" name="timezone" arch="x86_64">
  <version epoch="0" ver="2022f" rel="150000.75.15.1"/>
  <changelog author="astieger@suse.com" date="1540641600">- timezone update 2018g:
  * Morocco switches to permanent +01 on 2018-10-27 (bsc#1113554)
  * code fixes for zic on 32 bit</changelog>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
</package>
<package pkgid="54af7afb3715b03b155d88b3bddf3430cd02d53b2f29873b3a7e628d646258ee" name="timezone" arch="aarch64">
  <version epoch="0" ver="2022g" rel="150000.75.18.1"/>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
  <changelog author="danilo.spinella@suse.com" date="1670241600">- timezone update 2022g (bsc#1177460):
  * In the Mexican state of Chihuahua, the border strip near the US
    will change to agree with nearby US locations on 2022-11-30.
    The strip's western part, represented by Ciudad Juárez, switches
    from -06 all year to -07/-06 with US DST rules, like El Paso, TX.
    The eastern part, represented by Ojinaga, will observe US DST next
    year, like Presidio, TX.
    A new Zone America/Ciudad_Juarez splits from America/Ojinaga.
  * Much of Greenland, represented by America/Nuuk, stops observing
    winter time after March 2023, so its daylight saving time becomes
    standard time.
  * Changes for pre-1996 northern Canada
  * Update to past DST transition in Colombia (1993), Singapore
    (1981)
  * timegm is now supported by default</changelog>
</package>
<package pkgid="31bcba921ff21a44f5493015d9c1113e2b574909d895821c187f942d097a7a67" name="timezone" arch="src">
  <version epoch="0" ver="2022g" rel="150000.75.18.1"/>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
  <changelog author="danilo.spinella@suse.com" date="1670241600">- timezone update 2022g (bsc#1177460):
  * In the Mexican state of Chihuahua, the border strip near the US
    will change to agree with nearby US locations on 2022-11-30.
    The strip's western part, represented by Ciudad Juárez, switches
    from -06 all year to -07/-06 with US DST rules, like El Paso, TX.
    The eastern part, represented by Ojinaga, will observe US DST next
    year, like Presidio, TX.
    A new Zone America/Ciudad_Juarez splits from America/Ojinaga.
  * Much of Greenland, represented by America/Nuuk, stops observing
    winter time after March 2023, so its daylight saving time becomes
    standard time.
  * Changes for pre-1996 northern Canada
  * Update to past DST transition in Colombia (1993), Singapore
    (1981)
  * timegm is now supported by default</changelog>
</package>
<package pkgid="cf20e436bd1b5987b0e8717a5167e8ba69d6d274365bb7a4a34c08319d870f5c" name="timezone" arch="x86_64">
  <version epoch="0" ver="2022g" rel="150000.75.18.1"/>
  <changelog author="mcalabkova@suse.com" date="1546603200">- timezone update 2018i (bsc#1120402)
  * São Tomé and Príncipe switches from +01 to +00 on 2019-01-01.
- timezone update 2018h
  * Qyzylorda, Kazakhstan moved from +06 to +05 on 2018-12-21
  * New zone Asia/Qostanay because Qostanay, Kazakhstan didn't move
  * Metlakatla, Alaska observes PST this winter only
  * Guess Morocco will continue to adjust clocks around Ramadan
  * Add predictions for Iran from 2038 through 2090</changelog>
  <changelog author="mcalabkova@suse.com" date="1553601600">- timezone update 2019a:
  * Palestine "springs forward" on 2019-03-30 instead of 2019-03-23
  * Metlakatla "fell back" to rejoin Alaska Time on 2019-01-20 at
    02:00
  * Israel observed DST in 1980 (08-02/09-13) and 1984 (05-05/08-25)
  * zic now has an -r option to limit the time range of output data</changelog>
  <changelog author="mcalabkova@suse.com" date="1562068800">- timezone update 2019b (bsc#1140016):
  * Brazil no longer observes DST.
  * 'zic -b slim' outputs smaller TZif files.
  * Palestine's 2019 spring-forward transition was on 03-29,
    not 03-30.
  * Add info about the Crimea situation.</changelog>
  <changelog author="mcalabkova@suse.com" date="1568289600">- timezone update 2019c (bsc#1150451)
  * Fiji observes DST from 2019-11-10 to 2020-01-12.
  * Norfolk Island starts observing Australian-style DST.</changelog>
  <changelog author="mcalabkova@suse.com" date="1587729600">- timezone update 2020a (bsc#1169582)
  * Morocco springs forward on 2020-05-31, not 2020-05-24.
  * Canada's Yukon advanced to -07 year-round on 2020-03-08.
  * America/Nuuk renamed from America/Godthab.
  * zic now supports expiration dates for leap second lists.</changelog>
  <changelog author="mcalabkova@suse.com" date="1590408000">- zdump --version reported "unknown" (boo#1172055)</changelog>
  <changelog author="mcalabkova@suse.com" date="1602158400">- timezone update 2020b (bsc#1177460)
  * Revised predictions for Morocco's changes starting in 2023.
  * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08.
  * Macquarie Island has stayed in sync with Tasmania since 2011.
  * Casey, Antarctica is at +08 in winter and +11 in summer.
  * zic no longer supports -y, nor the TYPE field of Rules.
- Rebased timezone-2018f-bsc1112310.patch</changelog>
  <changelog author="mcalabkova@suse.com" date="1603108800">- timezone update 2020c (bsc#1177460)
  * Fiji starts DST later than usual, on 2020-12-20.</changelog>
  <changelog author="mcalabkova@suse.com" date="1603368000">- timezone update 2020d (bsc#1177460)
  * Palestine ends DST earlier than predicted, on 2020-10-24.</changelog>
  <changelog author="mcalabkova@suse.com" date="1604318400">- Add fat.patch to generate "fat" timezone files (was default before 2020b)
  bsc#1178346</changelog>
  <changelog author="mmachova@suse.com" date="1608724800">- timezone update 2020e (bsc#1177460)
  * Volgograd switches to Moscow time on 2020-12-27 at 02:00.</changelog>
  <changelog author="mmachova@suse.com" date="1609243200">- timezone update 2020f (bsc#1177460)
  * 'make rearguard_tarballs' no longer generates a bad rearguard.zi,
    fixing a 2020e bug.</changelog>
  <changelog author="mmachova@suse.com" date="1611576000">- timezone update 2021a (bsc#1177460)
  * South Sudan changes from +03 to +02 on 2021-02-01 at 00:00.</changelog>
  <changelog author="mmachova@suse.com" date="1625745600">- Install tzdata.zi (bsc#1188127)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637150400">- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "-00"
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1647518400">- timezone update 2022a (bsc#1177460):
  * Palestine will spring forward on 2022-03-27, not -03-26*
  * zdump -v now outputs better failure indications
  * Bug fixes for code that reads corrupted TZif data</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661515200">- Update to reflect new Chile DST change, bsc#1202310
  * bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665576000">- timezone update 2022e (bsc#1177460):
  * Jordan and Syria switch from +02/+03 with DST to year-round +03
- timezone update 2022d:
  * Palestine transitions are now Saturdays at 02:00
  * Simplify three Ukraine zones into one
- timezone update 2022c:
  * Work around awk bug
  * Improve tzselect on intercontinental Zones
- timezone update 2022b:
  * Chile's DST is delayed by a week in September 2022 boo#1202324
  * Iran no longer observes DST after 2022
  * Rename Europe/Kiev to Europe/Kyiv
  * New zic -R option
  * Vanguard form now uses %z
  * Finish moving duplicate-since-1970 zones to 'backzone'
- Refresh tzdata-china.diff
- Remove upstreamed bsc1202310.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1667217600">- timezone update 2022f (bsc#1177460):
  * Mexico will no longer observe DST except near the US border
  * Chihuahua moves to year-round -06 on 2022-10-30
  * Fiji no longer observes DST
  * Move links to 'backward'
  * In vanguard form, GMT is now a Zone and Etc/GMT a link
  * zic now supports links to links, and vanguard form uses this
  * Simplify four Ontario zones
  * Fix a Y2438 bug when reading TZif data
  * Enable 64-bit time_t on 32-bit glibc platforms
  * Omit large-file support when no longer needed
  * In C code, use some C23 features if available
  * Remove no-longer-needed workaround for Qt bug 53071
- Refreshed patches:
  * fat.patch
  * tzdata-china.diff</changelog>
  <changelog author="danilo.spinella@suse.com" date="1670241600">- timezone update 2022g (bsc#1177460):
  * In the Mexican state of Chihuahua, the border strip near the US
    will change to agree with nearby US locations on 2022-11-30.
    The strip's western part, represented by Ciudad Juárez, switches
    from -06 all year to -07/-06 with US DST rules, like El Paso, TX.
    The eastern part, represented by Ojinaga, will observe US DST next
    year, like Presidio, TX.
    A new Zone America/Ciudad_Juarez splits from America/Ojinaga.
  * Much of Greenland, represented by America/Nuuk, stops observing
    winter time after March 2023, so its daylight saving time becomes
    standard time.
  * Changes for pre-1996 northern Canada
  * Update to past DST transition in Colombia (1993), Singapore
    (1981)
  * timegm is now supported by default</changelog>
</package>
<package pkgid="65cdee6bda5904876f16b6e4b0d70773c3dc501eb01f970614654f6431d91f37" name="transactional-update" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="f53af137094ad46335c5339cc86b876810dd546a0187edaad68f6928a0becae2" name="transactional-update" arch="src">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="503008f85fed6a4579aedba04ae014712c62313b19ee8488350ce486f6b6894d" name="transactional-update" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="8b2f531e4868129f6cdbc21bc04f00e27f45908d8b5c037b04af54e6556c84e6" name="transactional-update" arch="aarch64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="314a6e998160700c387eb3edd2d87c6419a96f4da2538af5ded345bf8edfd9a4" name="transactional-update" arch="src">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="0c9a9e7fa38b4228bb4603623ad7173de8846b2d6311e3c4521774415f7b5494" name="transactional-update" arch="x86_64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="bc9ed64ea8be10792752a871f388fa73f21fdb8cffc141e6df2bbe9769e750d2" name="transactional-update-zypp-config" arch="noarch">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="4bbfb8c187aa9a7d9f23f397734a26c0190fc452819b0cfb2b6e32d1d22891d4" name="transactional-update-zypp-config" arch="noarch">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="58dfe11f42cae9a32d000e90644691b1b4ab5b164cf3b6e3dae9a63456c768b4" name="tukit" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="be488c28cf5aae1e40267d73610b4b6cce0d38c3f3c620696c6360d568f89ece" name="tukit" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="36b8916788cadc58ec6a8747db696469cfc907a01168f6736592838cc03d107b" name="tukit" arch="aarch64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="31917812d14075fda869fda117ae36a7275ae911298bdb9a6161f4c7b44843cb" name="tukit" arch="x86_64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="e6846c1e603a09c69811d3e6842715cf2d7950452ba248fff984ca5cb91acd0d" name="tukitd" arch="aarch64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="439592d22214c9fec026423f4bfd560ecef734c9e63e558e818c3d8a0b1ae939" name="tukitd" arch="x86_64">
  <version epoch="0" ver="4.0.0~rc3" rel="150300.3.3.1"/>
  <changelog author="iforster@suse.com" date="1615377600">- Version 3.2.1
  - t-u: Forward --quiet option to tukit
  - Regression: Add /opt as bind mount into update environment
  - Remove output indicators of the called command to not tamper
    the result line
  - Fix /etc syncing with --drop-if-no-change</changelog>
  <changelog author="iforster@suse.com" date="1615550400">- Version 3.2.2
  - Don't skip patches with rebootSuggested flag [bsc#1183442]</changelog>
  <changelog author="iforster@suse.com" date="1615550401">- Revert inotify-tools dependency: The package is not available in
  SLE. This will probably have to be implemented as a native C
  version.</changelog>
  <changelog author="iforster@suse.com" date="1616673600">- Version 3.3.0
  - Add support for more package managers by bind mounting their directories
  - Support snapshots without dedicated overlay [boo#1183539], [bsc#1183539]
  - Link RPM database correctly with older zypper versions [boo#1183521]
  - Don't discard manual changes in fstab [boo#1183856], [bsc#1192302]</changelog>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
</package>
<package pkgid="7ffc82bcd7fc57de7102e392ef86d4f6f6b4727f034d7dea28ad7a2e7343fd2c" name="tukitd" arch="aarch64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="a3ce90226ceeb2f74a0facedcfdaab31c3616ff55c6b1c877115fadcf0759017" name="tukitd" arch="x86_64">
  <version epoch="0" ver="4.0.1" rel="150300.3.8.1"/>
  <changelog author="iforster@suse.com" date="1623585600">- Version 3.4.0
  - Apply SElinux context on /etc in transaction [boo#1185625], [boo#1185766]
    [bsc#1186842], [boo#1186775]
  - Implement inotify handling in C instead of Bash; this makes the
  - -drop-if-no-change option work on SLE Micro [bsc#1184529]
  - Use `tukit call` for up, dup and patch to allow resuming an update after
    zypper updated itself in the snapshot [bsc#1185226]
  - Fix obsolete output type messages in initrd [boo#1177149]
  - Make different base snapshot warning more visible [bsc#1185224]</changelog>
  <changelog author="iforster@suse.com" date="1627905600">- Version 3.5.0
  - Add alias setDiscardIfUnchanged for setDiscard. The old method name
    wasn't really clear and will be removed if we should have an API break
    in the future
  - Replace mkinitrd with direct dracut call [boo#1186213]
  - tukit: Add configuration file support (/etc/tukit.conf)
  - Allow users to configure additional bind mounts (see /usr/etc/tukit.conf
    for an example and limitations) [bsc#1188322]
  - Add 'transactional-update status' call. This is a POC for obtaining a
    hash of a system to verify its integrity. The functionality is still
    experimental!
  - Internal bugfixes / optimizations</changelog>
  <changelog author="iforster@suse.com" date="1627992000">- Add tukit.conf to spec file</changelog>
  <changelog author="iforster@suse.com" date="1627992001">- Version 3.5.1
  - t-u: Disable status file generation by default
    The new experimental `status` command requires the availability of
    /etc/YaST2/control.xml, which is not present on all systems. Hide the
    creation of the corresponding status file behind a new EXPERIMENTAL_STATUS
    option to try out this functionality.
  - Increase library version</changelog>
  <changelog author="iforster@suse.com" date="1630324800">- Version 3.5.2
  - tukit: Fix overlay syncing errors with SELinux [bsc#1188648]
  - Don't print message for `shell` with --quiet
    [gh#openSUSE/transactional-update#69]</changelog>
  <changelog author="iforster@suse.com" date="1630929600">- Version 3.5.3
  - t-u: Purge kernels as part of package operations
    Required for live patching support [bsc#1189728]</changelog>
  <changelog author="iforster@suse.com" date="1631361600">- Version 3.5.4
  - tukit: Fix resolved support [boo#1190383]</changelog>
  <changelog author="iforster@suse.com" date="1631880000">- Version 3.5.5
  - t-u: Use tukit for SUSEConnect call [bsc#1190574]
    Correctly registers repositories</changelog>
  <changelog author="iforster@suse.com" date="1632398400">- Version 3.5.6
  - tukit: Add S/390 bootloader support [bsc#1189807]
  - t-u: support purge-kernels with t-u patch [bsc#1190788]</changelog>
  <changelog author="iforster@suse.com" date="1634040000">- Version 3.5.7
  Various fixes affecting Salt support:
  - t-u: Don't squash stderr messages into stdout
  - t-u: Correctly handle case when the snapshot has been deleted due to
    using --drop-if-no-change: Don't show reboot messages and avoid an awk
    error message [bsc#1191475]
  - tukit: Make inotify handler less sensitive / ignore more directories
    [bsc#1191475]</changelog>
  <changelog author="iforster@suse.com" date="1634904000">- Version 3.6.0
  - Simplify mount hierarchy by just using a single slave bind
    mount as the root of the update environment; this may avoid the
    error messages of failed unmounts
    May fix [boo#1191945]</changelog>
  <changelog author="iforster@suse.com" date="1636545600">- Version 3.6.1
  - Fix rsyncing /etc into the running system with
  - -drop-if-no-change [bsc#1192242]</changelog>
  <changelog author="iforster@suse.com" date="1637323200">- Version 3.6.2
  - Bind mount root file system snapshot on itself, this makes the
    temporary directory in /tmp unnecessary; also fixes [boo#1188110]
    to return the correct snapshot's working directory via API call.
  - Use separate mount namespace for transactional-update; this should
    fix several applications that fail to run if a mount point has the
    'unbindable' mount flag set</changelog>
  <changelog author="iforster@suse.com" date="1637582400">- Version 4.0.0~rc1
  This release is API, but not ABI compatible with previous releases;
  existing applications will have to be recompiled against this new version.
  Major features:
  - Introduces a D-Bus service to access the libtukit API via the
    org.opensuse.tukit.Transaction interface
  - Introduces a C binding via libtukit.h.
  Other changes:
  - t-u: Rework --quiet handling to make sure no output is shown even in
    error cases; this is necessary for automation, e.g. with Salt.
    [gh#openSUSE/transactional-update#73]
  - tukit: Allow storing command output into variable by introducing a new
    optional parameter for "execute" and "callExt".
  - Replace multiple and non-standalone occurenses of {} in "callExt"
    argument.
  - Split transactional-update.timer into transactional-update.timer
    and transactional-update-cleanup.timer; the later will clean up
    old snapshots even when the system does not do automatic updates.
  - tukit: Remove legacy alias "setDiscard" for "setDiscardIfUnchanged".
  - Throw exception if snapshot is not found.
  - Fix various compiler warnings
- Update spec file:
  - Include tukitd D-Bus daemon
  - Only install one version of the library (as there are no breaking API
    changes yet)
  - Add %pre scriplets for systemd services
  - Replace %systemd_postun scriptlets with %systemd_postun_with_restart
    to satisfy rpmlint checks
  - Add transactional-update log file as %ghost file</changelog>
  <changelog author="iforster@suse.com" date="1646568000">- Version 4.0.0~rc2
  - Fix missing prompt in "shell" command [bsc#1196580]
  - Add output of tukit commands to log file
  - Fix compilation error with GCC12 [boo#1194876]
  - Fixed (non-critical) security review comments [boo#1196149]
  - Fixed selfupdate
  - Code cleanup</changelog>
  <changelog author="iforster@suse.com" date="1651579200">- Version 4.0.0~rc3
  - Add Snapshot interface
  - Reworked signal handling: All public signals are sent from the
    main thread now, keeping the same sender for everything
  - Implement D-Bus call "Execute" for Transactions
  - Implement interface for listing Snapshots
  - Implement Reboot interface
  - Fix bug when using --continue on old snapshots
  - Fix hypothetical integer overflow in snapshot list [bsc#1196826]
  - Fix wrong sort order in status command
    [gh#openSUSE/transactional-update#80]</changelog>
  <changelog author="iforster@suse.com" date="1652788800">- Version 4.0.0~rc4
  - Fix building with GCC 12
  - Fix stack overflow with very long commands / ids [bsc#1196149]
  - Use separate mount namespace for chroot, allowing overwriting
    the bind mounts from the update environment - this could have
    lead to data loss of the bind mount previously
  - Fix C error and exception handling for snapshots</changelog>
  <changelog author="schubi@suse.com" date="1655812800">- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.</changelog>
  <changelog author="iforster@suse.com" date="1659441600">- Version 4.0.0
  - Last minute interface change: Changed "List" method of Snapshot D-Bus
    interface to return a map of properties instead of a comma separated
    list of strings; this will allow retrieving the snapshot properties
    even if they contain a comma in their value [boo#1202147]
  - Remove "Snapshot.hpp" as a public API for now - all public
    functionality is part of SnapshotManager.hpp
  - Add header file documentation for SnapshotManager.hpp
  - Add method to delete snapshot
    [gh#openSUSE/transactional-update#52]
  - Allow setting description of snapshot
    [gh#openSUSE/transactional-update#55]
  - create_dirs_from_rpmdb: set SELinux file context of missing directories
    [gh#openSUSE/transactional-update#84], [bsc#1197242]
  - Fix broken logrotate due to typo in config file
    [gh#openSUSE/transactional-update#87]
  - create_dirs_from_rpmdb: Fix handling return code of create_dirs()
    [gh#openSUSE/transactional-update#86]
  - Fix broken "shell" prompt after selfupdate
  - Add documented D-Bus interface definition files
  - Add tukit_sm_get_current and tukit_sm_get_default to C interface
  - Fixed typos</changelog>
  <changelog author="fvogt@suse.com" date="1661169600">- Version 4.0.1
  - create_dirs_from_rpmdb: Just warn if no default SELinux context found
    [gh#openSUSE/transactional-update#88], [bsc#1188215]
  - create_dirs_from_rpmdb: Don't update the rpmdb cookie on failure
    [gh#openSUSE/transactional-update#88]
  - Handle directories owned by multiple packages
    [gh#openSUSE/transactional-update#90], [bsc#1188215]</changelog>
</package>
<package pkgid="4ea251b9860a6c5f431c6e524c9e910bc0a12f6ed8dedeba32dbcc52ac2d1787" name="typelib-1_0-GdkPixbuf-2_0" arch="aarch64">
  <version epoch="0" ver="2.40.0" rel="150200.3.6.1"/>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Update to version 2.36.10:
  + build: meson build improvements.
  + build: win32 build fixes.
  + tests: show error before failing (bgo#786259).
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
</package>
<package pkgid="9b08c11330b5db4f14c141135b2a6708fd5739e4a16347986b51e828ecb0eea4" name="typelib-1_0-GdkPixbuf-2_0" arch="x86_64">
  <version epoch="0" ver="2.40.0" rel="150200.3.6.1"/>
  <changelog author="zaitor@opensuse.org" date="1505131200">- Update to version 2.36.10:
  + build: meson build improvements.
  + build: win32 build fixes.
  + tests: show error before failing (bgo#786259).
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
</package>
<package pkgid="a9587b3f8393563c784c6a1088d7e87ca48f600dc1bf1d12438c0489450c7ac4" name="typelib-1_0-GdkPixbuf-2_0" arch="aarch64">
  <version epoch="0" ver="2.40.0" rel="150200.3.9.1"/>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
  <changelog author="mgorse@suse.com" date="1661860800">- Add gdk-pixbuf-CVE_2021-44648.patch: check for maximum LZW code
  size (boo#1194633 CVE-2021-44648). Also add
  gdk_pixbuf_new_tests.tar.xz for some new gif tests.</changelog>
</package>
<package pkgid="bc8dca258cc020a2d6e0dbf2c8c55d2393d916295a8b066a5e4cb637c06dc065" name="typelib-1_0-GdkPixbuf-2_0" arch="x86_64">
  <version epoch="0" ver="2.40.0" rel="150200.3.9.1"/>
  <changelog author="luc14n0@linuxmail.org" date="1507032000">- Update to version 2.36.11:
  + Build:
  - Fix tiff loader build (bgo#786342).
  - Prefer newer libpng (bgo#786035).
  + Use a free reference images for tests (bgo#787050).
  + gif: fail quickly if image dimensions are too big (bgo#785973).
  + xlib: Avoid an out-of-bounds error on bigendian (bgo#775896).
  + Updated translations.
- Drop u_contrib-gdk-pixbuf-xlib-Fix-rgb888amsb.patch: fixed
  upstream.
- Add gdk-pixbuf-rpmlintrc: filter gdk-pixbuf-devel.*: W:
  non-conffile-in-etc /etc/rpm/macros.gdk-pixbuf.</changelog>
  <changelog author="mgorse@suse.com" date="1515153600">- Add gdk-pixbuf-bgo779012-ico-overflow.patch: fix a potential
  integer overflow (boo#1027026 CVE-2017-6312).
- Add gdk-pixbuf-gif-negative-array-indexes.patch and
  gdk-pixbuf-gif-uninitialized-variable.patch: protect against
  access to negative array indexes (BGO#778584).
- Add gdk-pixbuf-tiff-overflow.patch: avoid overflow during size
  computation (bgo#779020).
- Add gdk-pixbuf-icns-handle-short-blocklen.patch: protect against
  short block length when reading icns (boo#1027024
  CVE-2017-6313).</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1521547200">- Unconditionally enable translation-update-upstream: on
  Tumbleweed, this results in a NOP and for Leap in SLE paid
  translations being used (boo#1086036).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523361600">- Update to version 2.36.12:
  + gif, ico, jpeg, tiff, icns: various fixes (bgo#778584,
    bgo#779012, bgo#753605, bgo#779020, bgo#779016).
  + Implement async loading without threads.
  + Updated translations.
- Rename with_docs meson option to docs, following usptream change.
- Drop fixed upstream patches:
  gdk-pixbuf-bgo779012-ico-overflow.patch,
  gdk-pixbuf-gif-negative-array-indexes.patch,
  gdk-pixbuf-gif-uninitialized-variable.patch,
  gdk-pixbuf-tiff-overflow.patch and
  gdk-pixbuf-icns-handle-short-blocklen.patch.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1529496000">- Update to version 2.37.0:
  + Plug a memory leak when using GBytes (bgo#787626).
  + Fix introspection annotations (bgo#789935).
  + Fix OOB error when dithering (bgo#748211).
  + Drop the MMX assembly optimizations for pixops.
  + Improve compatibility for the post-install script (bgo#795705).
  + Expose the dimensions of the original image from
    GdkPixbufLoader (bgo#778517).
  + Improve thumbnailer implementation (bgo#778517).
  + Generate separate introspection data for GdkPixdata API
    (glgo#GNOME/gdk-pixbuf#72).
  + Deprecate GDK_INTERP_HYPER (glgo#GNOME/gdk-pixbuf#3).
- Pass installed_tests as false to meson to make sure we don't ship
  unnecessary tests.
- Add typelib-1_0-GdkPixdata GI subpackage and require it on the
  devel package, following upstream changes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1531051200">- Pass all options to meson, ensure we build gdk-pixbuf with the
  features we want.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1534939200">- Update to version 2.37.92:
  + Ensure that GdkPixbuf's storage is safely handled.
  + Add test case for buffer overflow in pixdata loader.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 2.38.0:
  + Stable release.
  + Documentation fixes.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551355200">- Update to version 2.38.1:
  + Fix OOM in JPEG2000 loader.
  + Fix thumbnailing of animated GIFs.
  + Multiple improvements to the GIF loader.
  + Fix introspection generation.
  + Fix error handling in PNG loader.
  + Improve reproducibility of the build.
  + Speed up saving PNG files.
  + Add variables in the pkg-config files for binary utilities.
  + Build fixes.</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 2.38.2:
  + build: Remove unnecessary argument.
  + gif: Suppress last deprecation warning.
  + tests:
  - Disable deprecation warnings for GTimeVal.
  - Add test for issue 95.
  - Add test image for invalid XPM data.
  + Disable deprecation warnings for GTimeVal.
  + Use the monotonic clock instead of wall one.
  + xpm:
  - Fail when XPM file doesn't contain enough data.
  - Simplify error path.
  - Sanity check XPM file dimensions.</changelog>
  <changelog author="mgorse@suse.com" date="1568030401">- Update to version 2.39.2:
  + Add gdk_pixbuf_init_modules() for applications with GdkPixbuf
    loader modules in a separate directory.
  + Add subproject fallback for dependencies.
  + Handle large XPM without crashing.
  + Use the appropriate gdk-pixbuf-query-loaders on install.
  + Disable deprecation warnings introduced by GLib 2.62.
  + Escape GIF version in error messages.
  + Render GIF frames on demand.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570536000">- Update to version 2.40.0:
  + Allow creating a GdkPixbuf instance without any property.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="yfjiang@suse.com" date="1582545600">- A file tests/test-images/gif-test-suite/max-width.gif from the
  test suite is correctly identified by clamav to be a malicious
  BC.Gif.Exploit.Agent-1425366.Agent. This is an intentional part
  of the test suite to ensure it has no negative side effects.
  On SLE, the package is built with clamav scanning, which then
  prevents a successful build. This change repacks the source
  package to a password-protected zip to bypass the clamav scanning
  for SLE (bsc#1159337), with following update:
  + Download upstream tarball through source service
  + Add pre_checkin.sh to convert tarball to zip file
  + Update spec-file to use the zip file as main source</changelog>
  <changelog author="zcjia@suse.com" date="1595851200">- Add gdk-pixbuf-boo1174307-io-gif-overflow.patch: Avoid overflows
  by checking the memset length argument (boo#1174307).
- Raise dependency glib-2.0 version.</changelog>
  <changelog author="zcjia@suse.com" date="1610020800">- Add gdk-pixbuf-bsc1180393-CVE-2020-29385.patch:
  gif: Fix LZW decoder accepting invalid LZW code. (bsc#1180393)</changelog>
  <changelog author="mgorse@suse.com" date="1658923200">- Add gdk-pixbuf-CVE-2021-46829.patch: check for overflow when
  compositing or clearing frames (boo#1201826 CVE-2021-46829).</changelog>
  <changelog author="mgorse@suse.com" date="1661860800">- Add gdk-pixbuf-CVE_2021-44648.patch: check for maximum LZW code
  size (boo#1194633 CVE-2021-44648). Also add
  gdk_pixbuf_new_tests.tar.xz for some new gif tests.</changelog>
</package>
<package pkgid="500f899dc35b69b342858069cb93954b39c1d878e0ba55c6fededb1eaf3e3ce7" name="ucode-intel" arch="src">
  <version epoch="0" ver="20220809" rel="150200.18.1"/>
  <changelog author="meissner@suse.com" date="1563364800">- Updated to 20190618 release (bsc#1111331 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061d-&gt;0000061f Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000714-&gt;00000718 Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- Updated to Intel CPU Microcode 20220419 release. (bsc#1198717)
  - Update for functional issues. Refer to errata
    APLI-11 in [Intel Atom Processor E3900
    Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - Changed Microcodes:
  - | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx</changelog>
  <changelog author="meissner@suse.com" date="1652270400">- Updated to Intel CPU Microcode 20220510 release. (bsc#1199423)
  - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html)
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-97-05/03 |          | 0000001f | Core Gen12
  | ADL            | L0       | 06-9a-03/80 |          | 0000041c | Core Gen12
  | ADL            | L0       | 06-9a-04/80 |          | 0000041c | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | VLV            | D0       | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3
  | APL            | D0       | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile
  | EHL            | B1       | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10
  | CML-U62 V1     | A0       | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile
  | CML-U62 V2     | K1       | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11</changelog>
  <changelog author="meissner@suse.com" date="1660132800">- Updated to Intel CPU Microcode 20220809 release. (bsc#1201727)
  - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html).
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification
  +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | B1       | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11
  | ADL            | C0       | 06-97-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-97-05/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | C0       | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12</changelog>
</package>
<package pkgid="80a2bb5754169e5403df09c10a0d670343ab2366b37745133b3b04282f4f2809" name="ucode-intel" arch="x86_64">
  <version epoch="0" ver="20220809" rel="150200.18.1"/>
  <changelog author="meissner@suse.com" date="1563364800">- Updated to 20190618 release (bsc#1111331 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091)
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061d-&gt;0000061f Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000714-&gt;00000718 Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- Updated to Intel CPU Microcode 20220419 release. (bsc#1198717)
  - Update for functional issues. Refer to errata
    APLI-11 in [Intel Atom Processor E3900
    Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - Changed Microcodes:
  - | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx</changelog>
  <changelog author="meissner@suse.com" date="1652270400">- Updated to Intel CPU Microcode 20220510 release. (bsc#1199423)
  - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html)
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-97-05/03 |          | 0000001f | Core Gen12
  | ADL            | L0       | 06-9a-03/80 |          | 0000041c | Core Gen12
  | ADL            | L0       | 06-9a-04/80 |          | 0000041c | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | VLV            | D0       | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3
  | APL            | D0       | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile
  | EHL            | B1       | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10
  | CML-U62 V1     | A0       | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile
  | CML-U62 V2     | K1       | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11</changelog>
  <changelog author="meissner@suse.com" date="1660132800">- Updated to Intel CPU Microcode 20220809 release. (bsc#1201727)
  - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html).
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification
  +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | B1       | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11
  | ADL            | C0       | 06-97-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-97-05/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | C0       | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12</changelog>
</package>
<package pkgid="be0e8a96f2e0613857aecafd79e5c68a572761dd311fcb876ca79d2a899aaa94" name="ucode-intel" arch="src">
  <version epoch="0" ver="20230214" rel="150200.21.1"/>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- Updated to Intel CPU Microcode 20220419 release. (bsc#1198717)
  - Update for functional issues. Refer to errata
    APLI-11 in [Intel Atom Processor E3900
    Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - Changed Microcodes:
  - | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx</changelog>
  <changelog author="meissner@suse.com" date="1652270400">- Updated to Intel CPU Microcode 20220510 release. (bsc#1199423)
  - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html)
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-97-05/03 |          | 0000001f | Core Gen12
  | ADL            | L0       | 06-9a-03/80 |          | 0000041c | Core Gen12
  | ADL            | L0       | 06-9a-04/80 |          | 0000041c | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | VLV            | D0       | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3
  | APL            | D0       | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile
  | EHL            | B1       | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10
  | CML-U62 V1     | A0       | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile
  | CML-U62 V2     | K1       | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11</changelog>
  <changelog author="meissner@suse.com" date="1660132800">- Updated to Intel CPU Microcode 20220809 release. (bsc#1201727)
  - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html).
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification
  +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | B1       | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11
  | ADL            | C0       | 06-97-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-97-05/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | C0       | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12</changelog>
  <changelog author="meissner@suse.com" date="1676462400">- Updated to Intel CPU Microcode 20230214 release.
  Security issues fixed:
  - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275)
  - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276)
  - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277)
  New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SPR-SP         | E2       | 06-8f-05/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E3       | 06-8f-06/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E4       | 06-8f-07/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E5       | 06-8f-08/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-HBM        | B3       | 06-8f-08/10 |          | 2c000170 | Xeon Max
  | RPL-P 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-H 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-U 2+8      | Q0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-97-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12
  | CLX-SP         | B0       | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-D          | B0       | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3
  | JSL            | A0/A1    | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | LKF            | B2/B3    | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology
  | RKL-S          | B0       | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11
  | RPL-S          | S0       | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13
  | SKX-SP         | B1       | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable</changelog>
</package>
<package pkgid="93eaa957349ad9eec5946e89da0429be829165add2d3cdfbd0f8de42d989f067" name="ucode-intel" arch="x86_64">
  <version epoch="0" ver="20230214" rel="150200.21.1"/>
  <changelog author="meissner@suse.com" date="1568894400">- Updated to 20190918 bugfix release (bsc#1151232 bsc#1138185)
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- updated platforms ------------------------------------
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002d-&gt;0000002e Core Gen5
  HSX-EX       E0       6-3f-4/80 00000014-&gt;00000016 Xeon E7 v3
  BDW-H/E3     E0/G0    6-47-1/22 00000020-&gt;00000021 Core Gen5
  BDX-ML       B0/M0/R0 6-4f-1/ef 0b000036-&gt;0b000038 Xeon E5/E7 v4; Core i7-69xx/68xx
  BDX-DE       V1       6-56-2/10 0000001a-&gt;0000001c Xeon D-1520/40
  BDX-DE       V2/3     6-56-3/10 07000017-&gt;07000019 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  BDX-DE       Y0       6-56-4/10 0f000015-&gt;0f000017 Xeon D-1557/59/67/71/77/81/87
  BDX-NS       A0       6-56-5/10 0e00000d-&gt;0e00000f Xeon D-1513N/23/33/43/53
  SKX-SP       H0/M0/U0 6-55-4/b7 0200005e-&gt;00000064 Xeon Scalable
  SKX-D        M1       6-55-4/b7 0200005e-&gt;00000064 Xeon D-21xx
  CLX-SP       B1       6-55-7/bf 05000021-&gt;0500002b Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1573041600">- Updated to 20191112 security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000150 Xeon Scalable
  - ICL U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKL H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1573646400">- Updated to 20191112 official security release (bsc#1155988)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- new platforms ----------------------------------------
  - AVN          B0/C0    6-4d-8/01           0000012d Atom C2xxx
  - CNL-U        D0       6-66-3/80           0000002a Core Gen8 Mobile
  - SKX-SP       B1       6-55-3/97           01000151 Xeon Scalable
  - CLX-SP       B0       6-55-6/bf           0400002c Xeon Scalable Gen2
  - GLK-R        R0       6-7a-8/01           00000016 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  - ICL-U/Y      D1       6-7e-5/80           00000046 Core Gen10 Mobile
  - CML-U62      A0       6-a6-0/80           000000c6 Core Gen10 Mobile
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000cc-&gt;000000d4 Core Gen6 Mobile
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable
  - SKX-D        M1       6-55-4/b7 02000064-&gt;02000065 Xeon D-21xx
  - CLX-SP       B1       6-55-7/bf 0500002b-&gt;0500002c Xeon Scalable Gen2
  - SKL-H/S/E3   R0/N0    6-5e-3/36 000000cc-&gt;000000d4 Core Gen6
  - GLK          B0       6-7a-1/01 0000002e-&gt;00000032 Pentium J5005/N5000, Celeron J4005/J4105/N4000/N4100
  - AML-Y22      H0       6-8e-9/10 000000b4-&gt;000000c6 Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000b4-&gt;000000c6 Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000b4-&gt;000000c6 Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000b8-&gt;000000c6 Core Gen8 Mobile
  - AML-Y        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - CML-U42      V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000b8-&gt;000000c6 Core Gen8 Mobile
  - KBL-G/X      H0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7/Gen8
  - KBL-H/S/E3   B0       6-9e-9/2a 000000b4-&gt;000000c6 Core Gen7; Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000b4-&gt;000000c6 Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000b4-&gt;000000c6 Core Gen8
  - CFL-H        R0       6-9e-d/22 000000b8-&gt;000000c6 Core Gen9 Mobile
  - ---- removed platforms ------------------------------------
  - CFL-H/S      P0       6-9e-c/22 000000a2           Core Gen9
- Includes security fixes for:
  - CVE-2019-11135: Added feature allowing to disable TSX RTM (bsc#1139073)
  - CVE-2019-11139: A CPU microcode only fix for Voltage modulation issues (bsc#1141035)</changelog>
  <changelog author="meissner@suse.com" date="1574164800">- Updated to 20191115 release (bsc#1157004)
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - SKL-U/Y      D0       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-U23e     K1       6-4e-3/c0 000000d4-&gt;000000d6 Core Gen6 Mobile
  - SKL-H/S/E3   N0/R0/S0 6-5e-3/36 000000d4-&gt;000000d6 Core Gen6
  - AML-Y22      H0       6-8e-9/10 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-U/Y      H0       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - KBL-U23e     J1       6-8e-9/c0 000000c6-&gt;000000ca Core Gen7 Mobile
  - CFL-U43e     D0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - KBL-R U      Y0       6-8e-a/c0 000000c6-&gt;000000ca Core Gen8 Mobile
  - WHL-U        W0       6-8e-b/d0 000000c6-&gt;000000ca Core Gen8 Mobile
  - AML-Y42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - WHL-U        V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen8 Mobile
  - CML-U42      V0       6-8e-c/94 000000c6-&gt;000000ca Core Gen10 Mobile
  - KBL-G/H/S/X/E3 B0     6-9e-9/2a 000000c6-&gt;000000ca Core Gen7 Desktop, Mobile, Xeon E3 v6
  - CFL-H/S/E3   U0       6-9e-a/22 000000c6-&gt;000000ca Core Gen8 Desktop, Mobile, Xeon E
  - CFL-S        B0       6-9e-b/02 000000c6-&gt;000000ca Core Gen8
  - CFL-S        P0       6-9e-c/22 000000c6-&gt;000000ca Core Gen9 Desktop
  - CFL-H/S/E3   R0       6-9e-d/22 000000c6-&gt;000000ca Core Gen9 Desktop, Mobile, Xeon E
  - CML-U62      A0       6-a6-0/80 000000c6-&gt;000000ca Core Gen10 Mobile
- Updated to 20191113 release
  - Processor             Identifier     Version       Products
  - Model        Stepping F-MO-S/PI      Old-&gt;New
  - ---- updated platforms ------------------------------------
  - CFL-S        P0       6-9e-c/22 000000a2-&gt;000000c6 Core Gen9 Desktop</changelog>
  <changelog author="meissner@suse.com" date="1579089600">- reverted the entry below to 02000064 due to occasional faults (bsc#1160478)
  - SKX-SP       H0/M0/U0 6-55-4/b7 02000064-&gt;02000065 Xeon Scalable</changelog>
  <changelog author="meissner@suse.com" date="1587470400">- updated skylake microcode to the current version. (bsc#1169570)
  - 02000064-&gt;02006901</changelog>
  <changelog author="meissner@suse.com" date="1591185600">- Updated Intel CPU Microcode to 20200602 (prerelease) (bsc#1172466)
  Fixes for:
  - CVE-2020-0543: Fixed a side channel attack against special registers
    which could have resulted in leaking of read values to cores other
    than the one which called it.  This attack is known as Special Register
    Buffer Data Sampling (SRBDS) or "CrossTalk" (bsc#1154824).
  - CVE-2020-0548,CVE-2020-0549: Additional ucode updates were supplied to
    mitigate the Vector Register and L1D Eviction Sampling aka "CacheOutAttack"
    attacks. (bsc#1156353)
  == 20200602_DEMO Release ==
  - - Updates upon 20200520 release --
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  HSW          C0       6-3c-3/32 00000027-&gt;00000028 Core Gen4
  BDW-U/Y      E0/F0    6-3d-4/c0 0000002e-&gt;0000002f Core Gen5
  HSW-U        C0/D0    6-45-1/72 00000025-&gt;00000026 Core Gen4
  HSW-H        C0       6-46-1/32 0000001b-&gt;0000001c Core Gen4
  BDW-H/E3     E0/G0    6-47-1/22 00000021-&gt;00000022 Core Gen5
  SKL-U/Y      D0       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKL-U23e     K1       6-4e-3/c0 000000d6-&gt;000000dc Core Gen6 Mobile
  SKX-SP       B1       6-55-3/97 01000151-&gt;01000157 Xeon Scalable
  SKX-SP       H0/M0/U0 6-55-4/b7 02000065-&gt;02006906 Xeon Scalable
  SKX-D        M1       6-55-4/b7 02000065-&gt;02006906 Xeon D-21xx
  CLX-SP       B0       6-55-6/bf 0400002c-&gt;04002f01 Xeon Scalable Gen2
  CLX-SP       B1       6-55-7/bf 0500002c-&gt;04002f01 Xeon Scalable Gen2
  SKL-H/S      R0/N0    6-5e-3/36 000000d6-&gt;000000dc Core Gen6; Xeon E3 v5
  AML-Y22      H0       6-8e-9/10 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-U/Y      H0       6-8e-9/c0 000000ca-&gt;000000d6 Core Gen7 Mobile
  CFL-U43e     D0       6-8e-a/c0 000000ca-&gt;000000d6 Core Gen8 Mobile
  WHL-U        W0       6-8e-b/d0 000000ca-&gt;000000d6 Core Gen8 Mobile
  AML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  CML-Y42      V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen10 Mobile
  WHL-U        V0       6-8e-c/94 000000ca-&gt;000000d6 Core Gen8 Mobile
  KBL-G/H/S/E3 B0       6-9e-9/2a 000000ca-&gt;000000d6 Core Gen7; Xeon E3 v6
  CFL-H/S/E3   U0       6-9e-a/22 000000ca-&gt;000000d6 Core Gen8 Desktop, Mobile, Xeon E
  CFL-S        B0       6-9e-b/02 000000ca-&gt;000000d6 Core Gen8
  CFL-H/S      P0       6-9e-c/22 000000ca-&gt;000000d6 Core Gen9
  CFL-H        R0       6-9e-d/22 000000ca-&gt;000000d6 Core Gen9 Mobile
- Updated Intel CPU Microcode to 20200520
  Processor             Identifier     Version       Products
  Model        Stepping F-MO-S/PI      Old-&gt;New
  - --- new platforms ----------------------------------------
  - --- updated platforms ------------------------------------
  SNB-E/EN/EP  C1/M0    6-2d-6/6d 0000061f-&gt;00000621 Xeon E3/E5, Core X
  SNB-E/EN/EP  C2/M1    6-2d-7/6d 00000718-&gt;0000071a Xeon E3/E5, Core X</changelog>
  <changelog author="meissner@suse.com" date="1592222400">- Updated Intel CPU Microcode to 20200609 official release (bsc#1172466)
  - no changes to 20200602 prerelease</changelog>
  <changelog author="meissner@suse.com" date="1592395200">- Updated Intel CPU Microcode to 20200616 official release (bsc#1172856)
  - revert 06-4e-03 Skylake U/Y, U23e ucode back to 000000d6 release
  - revert 06-5e-03 Skylake H/S ucode back to 000000d6 release,
    as both cause stability issues.  (bsc#1172856)</changelog>
  <changelog author="meissner@suse.com" date="1604491200">- Updated Intel CPU Microcode to 20201027 prerelease (bsc#1170446)
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX)
  [#] New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#] Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605096000">- Updated Intel CPU Microcode to 20201110 official release.
  - CVE-2020-8695: Fixed Intel RAPL sidechannel attack (SGX) (bsc#1170446)
  - CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 (bsc#1173594)
  - CVE-2020-8696: Vector Register Sampling Active INTEL-SA-00381 (bsc#1173592)
- Releasenotes:
  - Security updates for [INTEL-SA-00381](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00381.html).
  - Security updates for [INTEL-SA-00389](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html).
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core? Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
  - Update for functional issues. Refer to [8th and 9th Gen Intel Core? Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
  - Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
  - Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
  [#]## New Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CPX-SP         | A1       | 06-55-0b/bf |          | 0700001e | Xeon Scalable Gen3
  | LKF            | B2/B3    | 06-8a-01/10 |          | 00000028 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 |          | 00000068 | Core Gen11 Mobile
  | CML-H          | R1       | 06-a5-02/20 |          | 000000e0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 |          | 000000e0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 |          | 000000e0 | Core Gen10
  | CML-U62 V2     | K0       | 06-a6-01/80 |          | 000000e0 | Core Gen10 Mobile
  [#]## Updated Platforms
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000043 | 00000044 | Core Gen4 X series; Xeon E5 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000d6 | 000000e2 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 01000157 | 01000159 | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | 02006a08 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006906 | 02006a08 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04002f01 | 04003003 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05002f01 | 05003003 | Xeon Scalable Gen2
  | APL            | D0       | 06-5c-09/03 | 00000038 | 00000040 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000016 | 0000001e | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000d6 | 000000e2 | Core Gen6; Xeon E3 v5
  | GKL-R          | R0       | 06-7a-08/01 | 00000016 | 00000018 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 00000078 | 000000a0 | Core Gen10 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000d6 | 000000de | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000d6 | 000000e0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000d6 | 000000de | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000d6 | 000000de | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000d6 | 000000de | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000d6 | 000000de | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000d6 | 000000de | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000d6 | 000000de | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000d6 | 000000de | Core Gen9 Mobile
  | CML-U62        | A0       | 06-a6-00/80 | 000000ca | 000000e0 | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1605787200">- Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971)
  - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms.</changelog>
  <changelog author="meissner@suse.com" date="1607342400">- Reverted 3 microcodes back to 20200616 release level after regression reports. (bsc#1179224)
  - SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006906 | Xeon Scalable
  - SKX-D          | M1       | 06-55-04/b7 | 02006906 | Xeon D-21xx
  - CLX-SP         | B0       | 06-55-06/bf | 04002f01 | Xeon Scalable Gen2
  - CLX-SP         | B1       | 06-55-07/bf | 05002f01 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1613563200">- Updated Intel CPU Microcode to 20210216 official release. (bsc#1178971 bsc#1179224)
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a08 | 02006a0a | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003003 | 04003006 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003003 | 05003006 | Xeon Scalable Gen2</changelog>
  <changelog author="meissner@suse.com" date="1623153600">- Updated to Intel CPU Microcode 20210525 release.
  - CVE-2020-24513: A domain bypass transient execution vulnerability was discovered on some Intel Atom processors that use a micro-architectural incident channel. (INTEL-SA-00465 bsc#1179833)
    See also: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00465.html
  - CVE-2020-24511: The IBRS feature to mitigate Spectre variant 2 transient execution side channel vulnerabilities may not fully prevent non-root (guest) branches from controlling the branch predictions of the root (host) (INTEL-SA-00464 bsc#1179836)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24512: Fixed trivial data value cache-lines such as all-zero value cache-lines may lead to changes in cache-allocation or write-back behavior for such cache-lines (bsc#1179837 INTEL-SA-00464)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00464.html)
  - CVE-2020-24489: Fixed Intel VT-d device pass through potential local privilege escalation (INTEL-SA-00442 bsc#1179839)
    See also https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00442.html
- Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780)for details.
- Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
- Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/613537) for details.
- Update for functional issues. Refer to [Intel Xeon Processor D-1500, D-1500 NS and D-1600 NS Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-d-1500-specification-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E7-8800 and E7-4800 v3 Processor Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e7-v3-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon Processor E5 v3 Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html?wapkw=processor+spec+update+e5) for details.
- Update for functional issues. Refer to [10th Gen Intel Core Processor Families Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/10th-gen-core-families-specification-update.html) for details.
- Update for functional issues. Refer to [8th and 9th Gen Intel Core Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-spec-update.html) for details.
- Update for functional issues. Refer to [7th Gen and 8th Gen (U Quad-Core) Intel Processor Families Specification Update](https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-spec-update.html) for details.
- Update for functional issues. Refer to [6th Gen Intel Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/332689) for details.
- Update for functional issues. Refer to [Intel Xeon E3-1200 v6 Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/xeon-e3-1200v6-spec-update.html) for details.
- Update for functional issues. Refer to [Intel Xeon E-2100 and E-2200 Processor Family Specification Update](https://www.intel.com/content/www/us/en/products/docs/processors/xeon/xeon-e-2100-specification-update.html) for details.
- New platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | CLX-SP         | A0       | 06-55-05/b7 |          | 03000010 | Xeon Scalable Gen2
  | ICX-SP         | C0       | 06-6a-05/87 |          | 0c0002f0 | Xeon Scalable Gen3
  | ICX-SP         | D0       | 06-6a-06/87 |          | 0d0002a0 | Xeon Scalable Gen3
  | SNR            | B0       | 06-86-04/01 |          | 0b00000f | Atom P59xxB
  | SNR            | B1       | 06-86-05/01 |          | 0b00000f | Atom P59xxB
  | TGL            | B1       | 06-8c-01/80 |          | 00000088 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 |          | 00000016 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 |          | 0000002c | Core Gen11 Mobile
  | EHL            | B1       | 06-96-01/01 |          | 00000011 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 |          | 0000001d | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | RKL-S          | B0       | 06-a7-01/02 |          | 00000040 | Core Gen11
- Updated platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | HSX-E/EP       | Cx/M1    | 06-3f-02/6f | 00000044 | 00000046 | Core Gen4 X series; Xeon E5 v3
  | HSX-EX         | E0       | 06-3f-04/80 | 00000016 | 00000019 | Xeon E7 v3
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | SKL-U23e       | K1       | 06-4e-03/c0 | 000000e2 | 000000ea | Core Gen6 Mobile
  | BDX-ML         | B0/M0/R0 | 06-4f-01/ef | 0b000038 | 0b00003e | Xeon E5/E7 v4; Core i7-69xx/68xx
  | SKX-SP         | B1       | 06-55-03/97 | 01000159 | 0100015b | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006a0a | 02006b06 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 04003006 | 04003102 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003006 | 05003102 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 0700001e | 07002302 | Xeon Scalable Gen3
  | BDX-DE         | V2/V3    | 06-56-03/10 | 07000019 | 0700001b | Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19
  | BDX-DE         | Y0       | 06-56-04/10 | 0f000017 | 0f000019 | Xeon D-1557/59/67/71/77/81/87
  | BDX-NS         | A0       | 06-56-05/10 | 0e00000f | 0e000012 | Xeon D-1513N/23/33/43/53
  | APL            | D0       | 06-5c-09/03 | 00000040 | 00000044 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 0000001e | 00000020 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000e2 | 000000ea | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 0000002e | 00000034 | Atom C Series
  | GLK            | B0       | 06-7a-01/01 | 00000034 | 00000036 | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 00000018 | 0000001a | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a0 | 000000a6 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 00000028 | 0000002a | Core w/Hybrid Technology
  | AML-Y22        | H0       | 06-8e-09/10 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000de | 000000ea | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000e0 | 000000ea | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000de | 000000ea | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000de | 000000ea | Core Gen8 Mobile
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000de | 000000ea | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000de | 000000ea | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000de | 000000ea | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000de | 000000ea | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000de | 000000ea | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000e0 | 000000ea | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000e0 | 000000ea | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000e0 | 000000ec | Core Gen10
  | CML-U62        | A0       | 06-a6-00/80 | 000000e0 | 000000e8 | Core Gen10 Mobile
  | CML-U62 V2     | K0       | 06-a6-01/80 | 000000e0 | 000000ea | Core Gen10 Mobile</changelog>
  <changelog author="meissner@suse.com" date="1644494400">- Updated to Intel CPU Microcode 20220207 release.
  - CVE-2021-0146: Fixed a potential security vulnerability in some Intel Processors may allow escalation of privilege (bsc#1192615)
  - CVE-2021-0127: Intel Processor Breakpoint Control Flow (bsc#1195779)
  - CVE-2021-0145: Fast store forward predictor - Cross Domain Training (bsc#1195780)
  - CVE-2021-33120: Out of bounds read for some Intel Atom processors (bsc#1195781)
  - Security updates for [INTEL-SA-00528](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00528.html)
  - Security updates for [INTEL-SA-00532](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00532.html)
  - Update for functional issues. Refer to [Third Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/637780) for details.
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/631123) for details.
  - Update for functional issues. Refer to [11th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/634808) for details.
  - Update for functional issues. Refer to [10th Gen Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/341079) for details.
  - Update for functional issues. Refer to [10th Generation Intel Core" Processor Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/615213) for details.
  - Update for functional issues. Refer to [8th Generation Intel Core" Processor Families Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338025) for details.
  - Update for functional issues. Refer to [8th Gen Intel Core" Processor Family Spec Update](https://www.intel.com/content/www/us/en/products/docs/processors/core/8th-gen-core-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [7th and 8th Generation Intel Core" Processor Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/334663) for details.
  - Update for functional issues. Refer to [6th Generation Intel Processor Family Specification Update](https://www.intel.com/content/www/us/en/processors/core/desktop-6th-gen-core-family-spec-update.html) for details.
  - Update for functional issues. Refer to [Intel Pentium Silver and Intel Celeron Processors](https://www.intel.com/content/www/us/en/products/docs/processors/pentium/silver-celeron-spec-update.html?wapkw=processor+specification+update) for details.</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- Updated to Intel CPU Microcode 20220419 release. (bsc#1198717)
  - Update for functional issues. Refer to errata
    APLI-11 in [Intel Atom Processor E3900
    Series](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - Changed Microcodes:
  - | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx</changelog>
  <changelog author="meissner@suse.com" date="1652270400">- Updated to Intel CPU Microcode 20220510 release. (bsc#1199423)
  - CVE-2022-21151: Security updates for [INTEL-SA-000617](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00617.html)
  - Update for functional issues. Refer to [Second Generation Intel Xeon Processor Scalable Family Specification Update](https://cdrdv2.intel.com/v1/dl/getContent/338848) for details.
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom C3000 Processor Product Family Specification Update](https://www.intel.com/content/www/us/en/processors/atom/atom-c3000-family-spec-update.html?wapkw=processor+specification+update) for details.
  - Update for functional issues. Refer to [Intel Atom Processor E3900 Specification Update Addendum](https://cdrdv2.intel.com/v1/dl/getContent/612204) for details.
  - New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-97-05/03 |          | 0000001f | Core Gen12
  | ADL            | L0       | 06-9a-03/80 |          | 0000041c | Core Gen12
  | ADL            | L0       | 06-9a-04/80 |          | 0000041c | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  | ADL            | C0       | 06-bf-02/03 |          | 0000001f | Core Gen12
  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | VLV            | D0       | 06-37-09/0F | 0000090c | 0000090d | Atom E38xx
  | SKL-U/Y        | D0       | 06-4e-03/c0 | 000000ec | 000000f0 | Core Gen6 Mobile
  | SKX-SP         | B1       | 06-55-03/97 | 0100015c | 0100015d | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006c0a | 02006d05 | Xeon D-21xx
  | CLX-SP         | B0       | 06-55-06/bf | 0400320a | 04003302 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 0500320a | 05003302 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002402 | 07002501 | Xeon Scalable Gen3
  | APL            | D0       | 06-5c-09/03 | 00000046 | 00000048 | Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx
  | APL            | E0       | 06-5c-0a/03 | 00000024 | 00000028 | Atom x5-E39xx
  | SKL-H/S        | R0/N0    | 06-5e-03/36 | 000000ec | 000000f0 | Core Gen6; Xeon E3 v5
  | DNV            | B0       | 06-5f-01/01 | 00000036 | 00000038 | Atom C Series
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000331 | 0d000363 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 00000038 | 0000003a | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GKL-R          | R0       | 06-7a-08/01 | 0000001c | 0000001e | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000a8 | 000000b0 | Core Gen10 Mobile
  | LKF            | B2/B3    | 06-8a-01/10 | 0000002d | 00000031 | Core w/Hybrid Technology
  | TGL            | B1       | 06-8c-01/80 | 0000009a | 000000a4 | Core Gen11 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000022 | 00000026 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003c | 0000003e | Core Gen11 Mobile
  | AML-Y22        | H0       | 06-8e-09/10 | 000000ec | 000000f0 | Core Gen8 Mobile
  | KBL-U/Y        | H0       | 06-8e-09/c0 | 000000ec | 000000f0 | Core Gen7 Mobile
  | CFL-U43e       | D0       | 06-8e-0a/c0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | WHL-U          | W0       | 06-8e-0b/d0 | 000000ec | 000000f0 | Core Gen8 Mobile
  | AML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-Y42        | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen10 Mobile
  | WHL-U          | V0       | 06-8e-0c/94 | 000000ec | 000000f0 | Core Gen8 Mobile
  | EHL            | B1       | 06-96-01/01 | 00000015 | 00000016 | Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E
  | JSL            | A0/A1    | 06-9c-00/01 | 2400001f | 24000023 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | KBL-G/H/S/E3   | B0       | 06-9e-09/2a | 000000ec | 000000f0 | Core Gen7; Xeon E3 v6
  | CFL-H/S/E3     | U0       | 06-9e-0a/22 | 000000ec | 000000f0 | Core Gen8 Desktop, Mobile, Xeon E
  | CFL-S          | B0       | 06-9e-0b/02 | 000000ec | 000000f0 | Core Gen8
  | CFL-H/S        | P0       | 06-9e-0c/22 | 000000ec | 000000f0 | Core Gen9
  | CFL-H          | R0       | 06-9e-0d/22 | 000000ec | 000000f0 | Core Gen9 Mobile
  | CML-H          | R1       | 06-a5-02/20 | 000000ec | 000000f0 | Core Gen10 Mobile
  | CML-S62        | G1       | 06-a5-03/22 | 000000ec | 000000f0 | Core Gen10
  | CML-S102       | Q0       | 06-a5-05/22 | 000000ee | 000000f0 | Core Gen10
  | CML-U62 V1     | A0       | 06-a6-00/80 | 000000ea | 000000f0 | Core Gen10 Mobile
  | CML-U62 V2     | K1       | 06-a6-01/80 | 000000ec | 000000f0 | Core Gen10 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000050 | 00000053 | Core Gen11</changelog>
  <changelog author="meissner@suse.com" date="1660132800">- Updated to Intel CPU Microcode 20220809 release. (bsc#1201727)
  - CVE-2022-21233: Security updates for [INTEL-SA-00657](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html).
  - Update for functional issues. Refer to [Intel Xeon Processor Scalable Family Specification
  +Update](https://www.intel.com/content/www/us/en/processors/xeon/scalable/xeon-scalable-spec-update.html?wapkw=processor+specification+update) for details.  - Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SKX-SP         | B1       | 06-55-03/97 | 0100015d | 0100015e | Xeon Scalable
  | SKX-SP         | H0/M0/U0 | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon Scalable
  | SKX-D          | M1       | 06-55-04/b7 | 02006d05 | 02006e05 | Xeon D-21xx
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000363 | 0d000375 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003a | 0000003c | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 0000001e | 00000020 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b0 | 000000b2 | Core Gen10 Mobile
  | TGL-R          | C0       | 06-8c-02/c2 | 00000026 | 00000028 | Core Gen11 Mobile
  | TGL-H          | R0       | 06-8d-01/c2 | 0000003e | 00000040 | Core Gen11 Mobile
  | RKL-S          | B0       | 06-a7-01/02 | 00000053 | 00000054 | Core Gen11
  | ADL            | C0       | 06-97-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-97-05/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 0000041c | 00000421 | Core Gen12
  | ADL            | C0       | 06-bf-02/03 | 0000001f | 00000022 | Core Gen12
  | ADL            | C0       | 06-bf-05/03 | 0000001f | 00000022 | Core Gen12</changelog>
  <changelog author="meissner@suse.com" date="1676462400">- Updated to Intel CPU Microcode 20230214 release.
  Security issues fixed:
  - CVE-2022-38090: Security updates for [INTEL-SA-00767](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html) (bsc#1208275)
  - CVE-2022-33196: Security updates for [INTEL-SA-00738](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html) (bsc#1208276)
  - CVE-2022-21216: Security updates for [INTEL-SA-00700](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00700.html) (bsc#1208277)
  New Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | SPR-SP         | E2       | 06-8f-05/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E3       | 06-8f-06/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E4       | 06-8f-07/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-SP         | E5       | 06-8f-08/87 |          | 2b000181 | Xeon Scalable Gen4
  | SPR-HBM        | B3       | 06-8f-08/10 |          | 2c000170 | Xeon Max
  | RPL-P 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-H 6+8      | J0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  | RPL-U 2+8      | Q0       | 06-ba-02/07 |          | 0000410e | Core Gen13
  Updated Platforms:
  | Processor      | Stepping | F-M-S/PI    | Old Ver  | New Ver  | Products
  |:---------------|:---------|:------------|:---------|:---------|:---------
  | ADL            | C0       | 06-97-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-97-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-02/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | C0       | 06-bf-05/07 | 00000026 | 0000002c | Core Gen12
  | ADL            | L0       | 06-9a-03/80 | 00000424 | 00000429 | Core Gen12
  | ADL            | L0       | 06-9a-04/80 | 00000424 | 00000429 | Core Gen12
  | CLX-SP         | B0       | 06-55-06/bf | 04003302 | 04003303 | Xeon Scalable Gen2
  | CLX-SP         | B1       | 06-55-07/bf | 05003302 | 05003303 | Xeon Scalable Gen2
  | CPX-SP         | A1       | 06-55-0b/bf | 07002501 | 07002503 | Xeon Scalable Gen3
  | GLK            | B0       | 06-7a-01/01 | 0000003c | 0000003e | Pentium Silver N/J5xxx, Celeron N/J4xxx
  | GLK-R          | R0       | 06-7a-08/01 | 00000020 | 00000022 | Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120
  | ICL-D          | B0       | 06-6c-01/10 | 01000201 | 01000211 | Xeon D-17xx, D-27xx
  | ICL-U/Y        | D1       | 06-7e-05/80 | 000000b6 | 000000b8 | Core Gen10 Mobile
  | ICX-SP         | D0       | 06-6a-06/87 | 0d000375 | 0d000389 | Xeon Scalable Gen3
  | JSL            | A0/A1    | 06-9c-00/01 | 24000023 | 24000024 | Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105
  | LKF            | B2/B3    | 06-8a-01/10 | 00000031 | 00000032 | Core w/Hybrid Technology
  | RKL-S          | B0       | 06-a7-01/02 | 00000056 | 00000057 | Core Gen11
  | RPL-S          | S0       | 06-b7-01/32 | 0000010e | 00000112 | Core Gen13
  | SKX-SP         | B1       | 06-55-03/97 | 0100015e | 01000161 | Xeon Scalable</changelog>
</package>
<package pkgid="b5bc538a70bf932a2ea832bc0aa120809f5454d504bc3f409c093efd6308ecd0" name="udev" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="833abc0653240c11f44249890efe542b8395f2f78c4f3cf2970cb104b84a71b5" name="udev" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.48.1"/>
  <changelog author="fbui@suse.com" date="1635422400">- Import commit f2f061f1da064bfd47e2201967a854bb9281ca5b
  98e87fc3fd busctl: use usec granularity for the timestamp printed by the busctl monitor command (jsc#SLE-17798)</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Fix IO scheduler udev rules
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
</package>
<package pkgid="3fb123f53bd9b1ebf2849b9733079eb9d08c534f3d64805674105269a9bf2bc8" name="udev" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="80ca62a17e242875da1869a72270b993b23ce579ed038a94e6fdc67257d49604" name="udev" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.51.1"/>
  <changelog author="fbui@suse.com" date="1639396800">- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)</changelog>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
</package>
<package pkgid="524373f671aa0deac222ea80689ce0c13528869ddb457c2c0de264cf00f8aae9" name="udev" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="73d4c4b9a1208e5f56fb7b44dd9d54ecb76309327127af9cb29ab33c3588e129" name="udev" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.54.1"/>
  <changelog author="fbui@suse.com" date="1641297600">- Suppress PAM warning when the credentials for user@.service service are
  established (bsc#1190515)
  systemd-user PAM service needs to define a default implementation of
  pam_setcred() otherwise the fallback (defined by /etc/pam.d/other) is used,
  which consists of pam_warn.so + pam_deny.so, and will throw a warning each
  time a user logs in.
  The new default simply consists in calling pam_deny.so alone.</changelog>
  <changelog author="fbui@suse.com" date="1641470400">- Import commit 3850086c6580291188fe574ad37c8026012894fb
  c0505cbb8d tmpfiles: 'st' may have been used uninitialized
  d3f7c9e806 macro: add new helper RET_NERRNO()
  4a95baa5de rm-rf: optionally fsync() after removing directory tree
  dd8137a589 rm-rf: refactor rm_rf_children(), split out body of directory iteration loop
  3f8765ed2c rm-rf: fstatat() might fail if containing dir has limited access mode, patch that too
  87d39407b7 btrfs-util: add helper that abstracts "might be btrfs subvol?" check
  71ed335c7a rm-rf: add new flag REMOVE_CHMOD
  611376f830 rules: don't ignore Xen virtual interfaces anymore (bsc#1178561)
  All these commits except the last one (611376f830) are preparation for
  CVE-2021-3997.
- Drop 0001-rules-don-t-ignore-Xen-interfaces-anymore.patch
  It's been merged in the git repo (commit 611376f830).</changelog>
  <changelog author="fbui@suse.com" date="1641470401">- Added patches to fix CVE-2021-3997 (bsc#1194178)
  5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  These patches will be moved to the git repo once the bug will become
  public.</changelog>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
</package>
<package pkgid="20c8f22fc2a5401f64289aa4c1eba5061e807fd4111c543bb983c0eca89674c4" name="udev" arch="aarch64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="ad0546fdaaa22915fa1a3861841122c36bd1b5ac64f1b7ed98d8c4918d6dd250" name="udev" arch="x86_64">
  <version epoch="0" ver="246.16" rel="150300.7.57.1"/>
  <changelog author="fbui@suse.com" date="1641816000">- Add 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (bsc#1193086)</changelog>
  <changelog author="fbui@suse.com" date="1643198400">- resolved: disable DNSSEC until the following issue is solved:
  https://github.com/systemd/systemd/issues/10579
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.</changelog>
  <changelog author="fbui@suse.com" date="1643371200">- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.</changelog>
  <changelog author="fbui@suse.com" date="1643889600">- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add in quarantine 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
  Add in quarantine 6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1647518400">- update s390 udev rules conversion script to include the case when
  the legacy rule was also 41-* (bsc#1195247)
  * change scripts-udev-convert-rules.sh</changelog>
  <changelog author="fbui@suse.com" date="1647518401">- Import commit 117e7b96f8e8c63a9eec3459147f5352015a6d08
  3a395b156d Don't open /var journals in volatile mode when runtime_journal==NULL
  1cd65c15e4 udev: 60-persistent-storage-tape.rules: handle duplicate device ID (bsc#1195529)
  3ee9953dd4 man: tweak description of auto/noauto (bsc#1191502)
  6cfeacbf86 shared/install: ignore failures for auxiliary files
  37083278ed install: make UnitFileChangeType enum anonymous
  0a02185526 shared/install: reduce scope of iterator variables
  86c55bde7f systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23867)</changelog>
  <changelog author="fbui@suse.com" date="1647518402">- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated. If such symlinks are found the script
  now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.</changelog>
  <changelog author="fbui@suse.com" date="1648036800">- spec: cope with %{_modprobedir} being /lib/modprobe.d on SLE</changelog>
  <changelog author="fbui@suse.com" date="1650369600">- Import commit 12b0904b9117aeaef138784e5b118b82cd87d7cb
  b579fe1e09 tmpfiles: constify item_compatible() parameters
  01f4af3573 test: add test checking tmpfiles conf file precedence
  e8f4d24e97 test tmpfiles: add a test for 'w+'
  9c559f3854 tmpfiles.d: only 'w+' can have multiple lines for the same path (bsc#1198090)
  7fab6b6a6e journald: make use of CLAMP() in cache_space_refresh()
  1c8b02567c journald: make sure journal_file_open() doesn't leave a corrupted file around after failing (bsc#1198114)
  0007446abc journal-file: port journal_file_open() to openat_report_new()
  a07ad29813 fs-util: make sure openat_report_new() initializes return param also on shortcut
  6bb087a1fc fs-util: fix typos in comments
  42532a8bfb fs-util: add openat_report_new() wrapper around openat()</changelog>
  <changelog author="fbui@suse.com" date="1651233600">- Call pam_loginuid when creating user@.service (bsc#1198507)
  It's a backport of upstream commit 1000522a60ceade446773c67031b47a566d4a70d.</changelog>
  <changelog author="thomas.blume@suse.com" date="1653652800">- fix parsing error in s390 udev rules conversion script (bsc#1198732)</changelog>
  <changelog author="fbui@suse.com" date="1654689600">- Import commit 40960e1ccb15071355fd3ee922877ef51f34bdbc
  e6354ebb34 core/device: device_coldplug(): don't set DEVICE_DEAD
  b593249c00 core/device: do not downgrade device state if it is already enumerated
  7b47b3c306 core/device: ignore DEVICE_FOUND_UDEV bit on switching root (bsc#1137373 bsc#1181658 bsc#1194708 bsc#1195157 bsc#1197570)
  912c07c281 core/device: drop unnecessary condition</changelog>
  <changelog author="fbui@suse.com" date="1654776000">- Import commit 0fb88066f5fa4695467e930559776cc3444773ec
  90740ae2aa string-util: explicitly cast character to unsigned
  ca1455c5b9 string-util: fix build error on aarch64
  c0829f98fc basic/escape: escape control characters, but not utf-8, in shell quoting
  387a2e1fbf basic/string-util: simplify how str_realloc() is used
  cdc4d55d22 basic/string-util: inline iterator variable declarations
  d435514c85 basic/string-util: split out helper function
  bdbc4faff5 basic/escape: always escape newlines in shell_escape()
  3eb13063d1 basic/escape: add mode where empty arguments are still shown as ""
  08fd20d8fb Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
  ec07c1c46c basic/escape: use consistent location for "*" in function declarations
  074e1b622e Allow control characters in environment variable values (bsc#1200170)
  44e419dcb0 Revert "basic/env-util: (mostly) follow POSIX for what variable names are allowed"
  d5756f6f71 test-env-util: Verify that \r is disallowed in env var values
  d02bac33d3 basic/env-util: make function shorter
  c68d5f0ba6 basic/env-util: (mostly) follow POSIX for what variable names are allowed
  887c150a04 test-env-util: print function headers</changelog>
  <changelog author="fbui@suse.com" date="1658318400">- Import commit e7211d27e1bd26b976aa74ff620cc22a0267b5b8
  1300e134a0 tmpfiles: check the directory we were supposed to create, not its parent
  e4bb32dc65 stat-util: replace is_dir() + is_dir_fd() by single is_dir_full() call
  d8d0c083bd logind: don't delay login for root even if systemd-user-sessions.service is not activated yet (bsc#1195059)</changelog>
  <changelog author="fbui@suse.com" date="1660651200">- Update 1009-Drop-or-soften-some-of-the-deprecation-warnings.patch (jsc#PED-944)
  To decrease log level of messages about use of KillMode=none from warning to
  debug. SAP still uses this deprecated option and the warnings emitted by PID1
  confuse both SAP customers and support.</changelog>
  <changelog author="fbui@suse.com" date="1665403200">- Add 1010-man-describe-the-net-naming-schemes-specific-to-SLE.patch (bsc#1204179)</changelog>
  <changelog author="fbui@suse.com" date="1667476800">- Import commit 56bee38fd0da18dad5fc5c5d12c02238a22b50e2
  42a26330fc time-util: fix buffer-over-run (bsc#1204968 CVE-2022-3821)
  8a70235d8a core: Add trigger limit for path units
  93e544f3a0 core/mount: also add default before dependency for automount mount units
  5916a7748c logind: fix crash in logind on user-specified message string</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)
  Also update the rule files to make use of the "CONST{arch}" syntax (available
  since v244).</changelog>
  <changelog author="fbui@suse.com" date="1670241600">- Import commit b83846dc8a5db633cc6cf05a33ddc054f725214e
  4d53a5440f udev/net_id: show the correct identifier in the debug output of dev_pci_onboard()
  f70647a7b7 udev/net_id: add debug logging for construction of device names
  48f40fbc8e pid1: set SYSTEMD_NSS_DYNAMIC_BYPASS=1 env var for dbus-daemon (bsc#1203857)
  7e4434d883 docs: $SYSTEMD_NSS_BYPASS_BUS is not honoured anymore, don't document it
  2bdfc2d8cf pid1: lookup owning PID of BusName= name of services asynchronously
  dba888a4d3 pid1: watch bus name always when we have it
  f524807b89 udev: add one more assertion
  8558101c73 udev: drop assertion which is always false
  566a66dc5c udev: support by-path devlink for multipath nvme block devices (bsc#1200723)
  b4c4edaada tests: minor simplification in test-execute
  76d510c625 tests: make test-execute pass on openSUSE
- Drop the following patches which are part of 'SUSE/v246' now:
    6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
    6001-udev-net_id-show-the-correct-identifier-in-the-debug.patch</changelog>
  <changelog author="fbui@suse.com" date="1670414400">- Fix systemd-coredump to not allow user to access coredumps with changed
  uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
  Add 5000-coredump-Fix-format-string-type-mismatch.patch
  Add 5001-coredump-drop-an-unused-variable.patch
  Add 5002-coredump-adjust-whitespace.patch
  Add 5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch</changelog>
</package>
<package pkgid="ce20e4dc38f4e3f63d1f4d374137779bd03da62398dbe30f065f41b6b399bd21" name="update-alternatives" arch="aarch64">
  <version epoch="0" ver="1.19.0.4" rel="150000.4.4.1"/>
  <changelog author="p.drouand@gmail.com" date="1424174400">- Update to version 1.17.23
  + Use a matching group instead of ${^MATCH} in s/// in dselect build script.
  + Skip tar extractor tests if tar is not GNU tar &gt;= 1.27.
  + Reset the trigger cycle tracking on unsatisfied dependencies during
    trigger processing. Closes: bdo#771730
  + Fix out-of-bounds buffer read accesses when parsing field and trigger
    names or checking package ownership of conffiles and directories.
  + Add versioned Breaks on packages creating trigger cycles. Namely auctex,
    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
    gxine, hoogle, icecc, libjs-protoaculous, mcollective, pypy, wordpress
    and xfonts-traditional.
  + Update translations
- Remove unapplied patches; SLE11 support is disabled in project home
  + dpkg-pod2man-no-utf8.patch
  + dpkg-old-File-Path.patch
  + dpkg-old-Test-More.patch
- Remove obsolete patches
  * dpkg-ppc64le.diff
  * dpkg-archive_tar_format_gnu.patch
  * dpkg-archtable-suse.patch
- Rename updated patch
  pdate-alternatives-1.16.8-suse.patch &gt; pdate-alternatives-suse.patch
- Clean up a bit specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1427889600">- Update to 1.11.24:
  * Translation updates
  * Various small fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1427889601">- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1433419200">- Verion bump to 1.18.1:
  * Bump to latest upstream release
  * Plenty of fixes with too long changelog, see changelog file in
    documentation
  * Also fixes bnc#926749 CVE-2015-0840
  * Refresh patch:
    + update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1433505600">- Adjust to the new manpage location</changelog>
  <changelog author="tchvatal@suse.com" date="1458907200">- Update to the 1.18.4:
  * Rebase patch update-alternatives-suse.patch
  * Touch the gost file in post</changelog>
  <changelog author="tchvatal@suse.com" date="1459944000">- The logfile for update-alternatives is /var/log/alternatives.log
  so stop using update-alternatives.log file which is empty</changelog>
  <changelog author="tchvatal@suse.com" date="1459944001">- Fix bnc#969171 by updating even with equal priority
  * 0001-In-case-of-equal-priority-rather-update.patch
- Try to autorefresh all the alternatives in post in case some of
  them were broken</changelog>
  <changelog author="tchvatal@suse.com" date="1463140800">- Provide alternatives binary and alternatives = %{version} symbol</changelog>
  <changelog author="tchvatal@suse.com" date="1464696000">- Require touch in post phase bnc#982336</changelog>
  <changelog author="tchvatal@suse.com" date="1473249600">- Use ls . instead of * to avoid error when nothing is in alternatives
  directory</changelog>
  <changelog author="tchvatal@suse.com" date="1473249601">- Version update to 1.18.10:
  * Various few fixes, see changelog file in the package
  * Refresh patch update-alternatives-suse.patch
  * Remove patch dpkg-sparc.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1490616000">- Update to 1.18.23:
  * Various small fixes and memleaks removed
- Make sure to generate manpage
- Refresh patch update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502280000">- Silence the update-alternatives regen output wrt bsc#1050848
  it causes more confusion than benefits</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Use dbpath macro for locationg rpm state directory
- Require exactly same version of rpm we had when building to make
  sure dbpath matches</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Move update alternatives database to new location
- Update rpm requirements to avoid unnecessary builds</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
  no u-a version ever installed files explicitly into dbpath, but
  always hard specified /var/lib/rpm. The fact that RPM moved its
  database is irrelevant to update-alternatives. In case RPM moved
  it's database, our files are still accessible via the
  /var/lib/rpm symlink being put in place.
- Drop the arbitrary depenency on a specific rpm version: the idea
  was to ensure to have an rpm with the new dbpath location in
  place. For one, the dependency does not work as intended, and
  2nd, as the migration now happens explicitly from the old u-a
  admindir without relying on dbpath, is no longer needed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516104000">- Update to 1.19.0.4:
  * No changes in update-alternatives just match step with dpkg
- Drop patch 0001-In-case-of-equal-priority-rather-update.patch
  * Causes issues on too eagerly regenerating stuff bsc#1075971
  * Reason for this patch should no longer be needed as all python
    packages are singlespec
  * Also drop the post override</changelog>
  <changelog author="pgajdos@suse.com" date="1644580800">- break bash &lt;-&gt; update-alternatives cycle by coolo's rewrite
  of %post in lua [bsc#1195654]</changelog>
</package>
<package pkgid="6b8fa5db0c68cd65e7aa4f3b9b703af36d147cd947f3a617fa8ae808ac4c36ca" name="update-alternatives" arch="src">
  <version epoch="0" ver="1.19.0.4" rel="150000.4.4.1"/>
  <changelog author="tchvatal@suse.com" date="1399896000">- Use SUSE not SuSE.</changelog>
  <changelog author="p.drouand@gmail.com" date="1424174400">- Update to version 1.17.23
  + Use a matching group instead of ${^MATCH} in s/// in dselect build script.
  + Skip tar extractor tests if tar is not GNU tar &gt;= 1.27.
  + Reset the trigger cycle tracking on unsatisfied dependencies during
    trigger processing. Closes: bdo#771730
  + Fix out-of-bounds buffer read accesses when parsing field and trigger
    names or checking package ownership of conffiles and directories.
  + Add versioned Breaks on packages creating trigger cycles. Namely auctex,
    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
    gxine, hoogle, icecc, libjs-protoaculous, mcollective, pypy, wordpress
    and xfonts-traditional.
  + Update translations
- Remove unapplied patches; SLE11 support is disabled in project home
  + dpkg-pod2man-no-utf8.patch
  + dpkg-old-File-Path.patch
  + dpkg-old-Test-More.patch
- Remove obsolete patches
  * dpkg-ppc64le.diff
  * dpkg-archive_tar_format_gnu.patch
  * dpkg-archtable-suse.patch
- Rename updated patch
  pdate-alternatives-1.16.8-suse.patch &gt; pdate-alternatives-suse.patch
- Clean up a bit specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1427889600">- Update to 1.11.24:
  * Translation updates
  * Various small fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1427889601">- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1433419200">- Verion bump to 1.18.1:
  * Bump to latest upstream release
  * Plenty of fixes with too long changelog, see changelog file in
    documentation
  * Also fixes bnc#926749 CVE-2015-0840
  * Refresh patch:
    + update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1433505600">- Adjust to the new manpage location</changelog>
  <changelog author="tchvatal@suse.com" date="1458907200">- Update to the 1.18.4:
  * Rebase patch update-alternatives-suse.patch
  * Touch the gost file in post</changelog>
  <changelog author="tchvatal@suse.com" date="1459944000">- The logfile for update-alternatives is /var/log/alternatives.log
  so stop using update-alternatives.log file which is empty</changelog>
  <changelog author="tchvatal@suse.com" date="1459944001">- Fix bnc#969171 by updating even with equal priority
  * 0001-In-case-of-equal-priority-rather-update.patch
- Try to autorefresh all the alternatives in post in case some of
  them were broken</changelog>
  <changelog author="tchvatal@suse.com" date="1463140800">- Provide alternatives binary and alternatives = %{version} symbol</changelog>
  <changelog author="tchvatal@suse.com" date="1464696000">- Require touch in post phase bnc#982336</changelog>
  <changelog author="tchvatal@suse.com" date="1473249600">- Use ls . instead of * to avoid error when nothing is in alternatives
  directory</changelog>
  <changelog author="tchvatal@suse.com" date="1473249601">- Version update to 1.18.10:
  * Various few fixes, see changelog file in the package
  * Refresh patch update-alternatives-suse.patch
  * Remove patch dpkg-sparc.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1490616000">- Update to 1.18.23:
  * Various small fixes and memleaks removed
- Make sure to generate manpage
- Refresh patch update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502280000">- Silence the update-alternatives regen output wrt bsc#1050848
  it causes more confusion than benefits</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Use dbpath macro for locationg rpm state directory
- Require exactly same version of rpm we had when building to make
  sure dbpath matches</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Move update alternatives database to new location
- Update rpm requirements to avoid unnecessary builds</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
  no u-a version ever installed files explicitly into dbpath, but
  always hard specified /var/lib/rpm. The fact that RPM moved its
  database is irrelevant to update-alternatives. In case RPM moved
  it's database, our files are still accessible via the
  /var/lib/rpm symlink being put in place.
- Drop the arbitrary depenency on a specific rpm version: the idea
  was to ensure to have an rpm with the new dbpath location in
  place. For one, the dependency does not work as intended, and
  2nd, as the migration now happens explicitly from the old u-a
  admindir without relying on dbpath, is no longer needed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516104000">- Update to 1.19.0.4:
  * No changes in update-alternatives just match step with dpkg
- Drop patch 0001-In-case-of-equal-priority-rather-update.patch
  * Causes issues on too eagerly regenerating stuff bsc#1075971
  * Reason for this patch should no longer be needed as all python
    packages are singlespec
  * Also drop the post override</changelog>
  <changelog author="pgajdos@suse.com" date="1644580800">- break bash &lt;-&gt; update-alternatives cycle by coolo's rewrite
  of %post in lua [bsc#1195654]</changelog>
</package>
<package pkgid="908392e61a0da1c7728e1a9cd56a5966c178b05c0ff703c4247d31af2294fc46" name="update-alternatives" arch="x86_64">
  <version epoch="0" ver="1.19.0.4" rel="150000.4.4.1"/>
  <changelog author="p.drouand@gmail.com" date="1424174400">- Update to version 1.17.23
  + Use a matching group instead of ${^MATCH} in s/// in dselect build script.
  + Skip tar extractor tests if tar is not GNU tar &gt;= 1.27.
  + Reset the trigger cycle tracking on unsatisfied dependencies during
    trigger processing. Closes: bdo#771730
  + Fix out-of-bounds buffer read accesses when parsing field and trigger
    names or checking package ownership of conffiles and directories.
  + Add versioned Breaks on packages creating trigger cycles. Namely auctex,
    apt-cudf, ccache, cups, distcc, fusionforge-plugin-mediawiki, gap-core,
    gxine, hoogle, icecc, libjs-protoaculous, mcollective, pypy, wordpress
    and xfonts-traditional.
  + Update translations
- Remove unapplied patches; SLE11 support is disabled in project home
  + dpkg-pod2man-no-utf8.patch
  + dpkg-old-File-Path.patch
  + dpkg-old-Test-More.patch
- Remove obsolete patches
  * dpkg-ppc64le.diff
  * dpkg-archive_tar_format_gnu.patch
  * dpkg-archtable-suse.patch
- Rename updated patch
  pdate-alternatives-1.16.8-suse.patch &gt; pdate-alternatives-suse.patch
- Clean up a bit specfile</changelog>
  <changelog author="tchvatal@suse.com" date="1427889600">- Update to 1.11.24:
  * Translation updates
  * Various small fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1427889601">- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1433419200">- Verion bump to 1.18.1:
  * Bump to latest upstream release
  * Plenty of fixes with too long changelog, see changelog file in
    documentation
  * Also fixes bnc#926749 CVE-2015-0840
  * Refresh patch:
    + update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1433505600">- Adjust to the new manpage location</changelog>
  <changelog author="tchvatal@suse.com" date="1458907200">- Update to the 1.18.4:
  * Rebase patch update-alternatives-suse.patch
  * Touch the gost file in post</changelog>
  <changelog author="tchvatal@suse.com" date="1459944000">- The logfile for update-alternatives is /var/log/alternatives.log
  so stop using update-alternatives.log file which is empty</changelog>
  <changelog author="tchvatal@suse.com" date="1459944001">- Fix bnc#969171 by updating even with equal priority
  * 0001-In-case-of-equal-priority-rather-update.patch
- Try to autorefresh all the alternatives in post in case some of
  them were broken</changelog>
  <changelog author="tchvatal@suse.com" date="1463140800">- Provide alternatives binary and alternatives = %{version} symbol</changelog>
  <changelog author="tchvatal@suse.com" date="1464696000">- Require touch in post phase bnc#982336</changelog>
  <changelog author="tchvatal@suse.com" date="1473249600">- Use ls . instead of * to avoid error when nothing is in alternatives
  directory</changelog>
  <changelog author="tchvatal@suse.com" date="1473249601">- Version update to 1.18.10:
  * Various few fixes, see changelog file in the package
  * Refresh patch update-alternatives-suse.patch
  * Remove patch dpkg-sparc.diff</changelog>
  <changelog author="tchvatal@suse.com" date="1490616000">- Update to 1.18.23:
  * Various small fixes and memleaks removed
- Make sure to generate manpage
- Refresh patch update-alternatives-suse.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502280000">- Silence the update-alternatives regen output wrt bsc#1050848
  it causes more confusion than benefits</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Use dbpath macro for locationg rpm state directory
- Require exactly same version of rpm we had when building to make
  sure dbpath matches</changelog>
  <changelog author="mpluskal@suse.com" date="1511179200">- Move update alternatives database to new location
- Update rpm requirements to avoid unnecessary builds</changelog>
  <changelog author="dimstar@opensuse.org" date="1511352000">- Migrate u-a data from /var/lib/rpm instead of relying on dbpath:
  no u-a version ever installed files explicitly into dbpath, but
  always hard specified /var/lib/rpm. The fact that RPM moved its
  database is irrelevant to update-alternatives. In case RPM moved
  it's database, our files are still accessible via the
  /var/lib/rpm symlink being put in place.
- Drop the arbitrary depenency on a specific rpm version: the idea
  was to ensure to have an rpm with the new dbpath location in
  place. For one, the dependency does not work as intended, and
  2nd, as the migration now happens explicitly from the old u-a
  admindir without relying on dbpath, is no longer needed.</changelog>
  <changelog author="tchvatal@suse.com" date="1516104000">- Update to 1.19.0.4:
  * No changes in update-alternatives just match step with dpkg
- Drop patch 0001-In-case-of-equal-priority-rather-update.patch
  * Causes issues on too eagerly regenerating stuff bsc#1075971
  * Reason for this patch should no longer be needed as all python
    packages are singlespec
  * Also drop the post override</changelog>
  <changelog author="pgajdos@suse.com" date="1644580800">- break bash &lt;-&gt; update-alternatives cycle by coolo's rewrite
  of %post in lua [bsc#1195654]</changelog>
</package>
<package pkgid="90824837e9712bb036846034c757ba88b22f86bc92c55083565e7334cfc97e3b" name="util-linux" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="e7bcfc67bef28c519c70dd8624d95e9ff7e0629ee4f07032438c1d7bd745b28d" name="util-linux" arch="src">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="c3a42334455129c8db05f5fdca7725418bd54d2041d68ec1854ff838cd66c68b" name="util-linux" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="d5ee215e06b921776e11b81eed76a6d6369ab6a6a777eda6563f837551ac1b27" name="util-linux" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="15f89b24f236deab4a2be905ab28314f771df8c26ea30241d9903b5d41b42dc1" name="util-linux" arch="src">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="8e021edcc7cf8b2c9b37f6e5ad421725a63fe28624180db9ed6f451952f4dd95" name="util-linux" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="27423dcb8df13f028d309b0d2c02398a2b9876e257e0d53867d522ffe9109dc3" name="util-linux" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="15343fe8f9bec6b2070417c12e18e132ae2365971b948a4a8c7bb652fbce7345" name="util-linux" arch="src">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="ed90fc03fbd2c27a4a0971042459ec0f77d2b79bb453d6e1ba1845436420832a" name="util-linux" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
  <changelog author="david.anes@suse.com" date="1670587200">- Fix tests not passing when '@' character is in build path:
  Fixes rpmbuild %checks fail when @ in the directory path (bsc#1194038).
- Add util-linux-fix-tests-when-at-symbol-in-path.patch</changelog>
</package>
<package pkgid="86d7758f6159821baea8c521d70744c320967a9d728e8f255dcb94d97631f7fc" name="util-linux-systemd" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="4282d96b16943bef738a2e354bf09c5f4afdb8701e72d6200038f7b0c8de3a30" name="util-linux-systemd" arch="src">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="267b7f741cb5e47e01e1b8d59ec3fe8f9807ae4881bf04f07f6e4f11b15ba653" name="util-linux-systemd" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.23.1"/>
  <changelog author="lnussel@suse.de" date="1611576000">- s/--enable-vendordir/--with-vendordir/
- remove pam_securetty line again. As long as there is no agreement
  from pam side having it would fail openQA (boo#1033626)</changelog>
  <changelog author="sbrabec@suse.com" date="1611921600">- Do not require libeconf-devel on products without /usr/etc.</changelog>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
</package>
<package pkgid="2496a3d444ebf816bbabe150cc58c63ef544252851731a7b88c264a8f1886194" name="util-linux-systemd" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="663e7dc25ba8ceea479ec725e5b636684ebffa27d367e94f9cf10655ef246676" name="util-linux-systemd" arch="src">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="4a5b674e4c0477919d07c449c52059ddea5de447c7b38f0b91dc5c751ccbef2f" name="util-linux-systemd" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.28.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Build with libudev support to support non-root users
  (boo#1169006).
- Move findmnt and lsblk to util-linux-systemd, as they use libudev
  (bsc#1169006#c10).</changelog>
  <changelog author="sbrabec@suse.com" date="1612440001">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
</package>
<package pkgid="97e8e542e0800b96add44e0730f0f8e0e5d4ad8453e34c9c719c02c00ee5aabe" name="util-linux-systemd" arch="aarch64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
</package>
<package pkgid="748180c4a4c02e64fa7de41c4798b3d494391ff6f9f93a77a2db680e61f17ccf" name="util-linux-systemd" arch="src">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
</package>
<package pkgid="5a841284df7e1f5e3eae099e37a9461526c75d15f1ea820f494ba8842425ea91" name="util-linux-systemd" arch="x86_64">
  <version epoch="0" ver="2.36.2" rel="150300.4.32.1"/>
  <changelog author="sbrabec@suse.com" date="1612440000">- Merge package with SLE15 SP3 and openSUSE Leap 15.3:
  Obsoletes upstreamed patches:
- libblkid: Do not trigger CDROM autoclose (v2.35, bsc#1084671,
  util-linux-libblkid-cdrom-autoclose-1.patch,
  util-linux-libblkid-cdrom-autoclose-2.patch,
  util-linux-libblkid-cdrom-autoclose-3.patch).
- lscpu: avoid segfault on PowerPC systems with valid hardware
  configurations
  (v2.36.1, bsc#1175623, bsc#1178554, bsc#1178825,
  lscpu-avoid-segfault-on-PowerPC-systems-with-valid-h.patch)
- Fix for SG#57988, bsc#1174942 (v2.36):
  libmount-fix-mount-a-EBUSY-for-cifs.patch: Fix warning on mounts
  to CIFS with mount ?a.
- blockdev: Do not fail --report on kpartx-style partitions on
  multipath (v2.36,
  bsc#1168235, util-linux-blockdev-report-dm.patch).
- nologin: Add support for -c to prevent error from su -c
  (v2.35, bsc#1151708, util-linux-nologin-su-c.patch).
- Add libmount-Avoid-triggering-autofs-in-lookup_umount_fs.patch:
  Avoid triggering autofs in lookup_umount_fs_by_statfs
  (v2.36 boo#1168389)
- mount: fall back to device node name if /dev/mapper link not found
  (v2.34, bsc#1149911)
  * Add patch: util-linux-canonicalize-coverity-scan.patch
- De-duplicate fstrim -A properly (v2.34, bsc#1127701,
  util-linux-fstrim-A-1.patch, util-linux-fstrim-A-3.patch,
  util-linux-fstrim-A-4.patch).
- Do not trim read-only volumes
  (v2.34, boo#1106214, util-linux-fstrim-A-2.patch,
  util-linux-fstrim-A-4.patch).
- libmount: To prevent incorrect behavior, recognize more pseudofs
  and netfs (v2.34, bsc#1122417,
  util-linux-libmount-pseudofs.patch).
- agetty: Return previous response of agetty for special characters
  (v2.34, bsc#1085196, bsc#1125886,
  util-linux-agetty-smart-reload-13.patch,
  util-linux-agetty-smart-reload-14.patch).
- Fix problems in reading of login.defs values (v2.34, bsc#1121197,
  util-linux-login_defs-priority1.patch,
  util-linux-login_defs-priority2.patch,
  util-linux-login_defs-SYS_UID.patch).</changelog>
  <changelog author="jengelh@inai.de" date="1612872000">- Override GTKDOCIZE with /bin/true so we can run autoreconf
  without needing gtk-doc as a dependency.</changelog>
  <changelog author="sbrabec@suse.com" date="1612958400">- libmount: don't use "symfollow" for helpers on user mounts
  (boo#1181750, util-linux-libmount-dont-use-symfollow.patch)</changelog>
  <changelog author="sbrabec@suse.com" date="1613476800">- Update to version 2.36.2:
  * agetty: tty eol defaults to REPRINT
  * fsck.cramfs: fix fsck.cramfs crashes on blocksizes &gt; 4K
  * lib/caputils: add fall back for last cap using prctl.
  * lib/signames: change license to public domain
  * libfdisk:
  * (dos) fix last possible sector calculation
  * (script) ignore empty values for start and size
  * ignore 33553920 byte optimal I/O size
  * libmount:
  * add vboxsf, virtiofs to pseudo filesystems
  * do not canonicalize ZFS source dataset
  * don't use "symfollow" for helpers on user mounts (boo#1181750,
    obsoletes util-linux-libmount-dont-use-symfollow.patch)
  * fix /{etc,proc}/filesystems use
  * login: use full tty path for PAM_TTY
  * lsblk: read SCSI_IDENT_SERIAL also from udev
  * rfkill: stop execution when rfkill device cannot be opened
  * setpriv: allow using [-+]all for capabilities.
  * su: use full tty path for PAM_TTY
  * switch_root: check if mount point to move even exists
  * umount:
  * ignore --no-canonicalize,-c for non-root users
  * Show the 'r' option in the help menu
  * Code cleanups and documentation improvements.
  * Translation updates.</changelog>
  <changelog author="sbrabec@suse.com" date="1616155200">- ipcs: Avoid overflows (bsc#1178236,
  util-linux-ipcs-shmall-overflow-1.patch,
  util-linux-ipcs-shmall-overflow-2.patch).</changelog>
  <changelog author="tabraham@suse.com" date="1627387200">- blockdev: allow for larger values for start sector (bsc#1188507)
  blockdev-allow-for-larger-values-for-start-sector.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1633608000">- ipcutils: Avoid potential memory allocation overflow
  (bsc#1188921, CVE-2021-37600,
  util-linux-ipcutils-overflow-CVE-2021-37600.patch).
- Add bc to BuildRequires to run more complete testsuite,
  fix testsuite (bsc#1178236#c19,
  util-linux-ipcs-shmall-overflow-ts.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1639483200">- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).</changelog>
  <changelog author="sbrabec@suse.com" date="1639828800">- blockdev: Remove NBSP character in values (bsc#1188507#c31,
  blockdev-remove-nbsp.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1643025600">- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
  bsc#1194976,
  util-linux-libmount-check-fuse-umount-CVE-2021-3995.patch,
  util-linux-libmount-fix-deleted-suffix-CVE-2021-3996.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308800">- Fix "su -s" bash completion
  (bsc#1172427, util-linux-bash-completion-su-chsh-l.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646308801">- Make uuidd lock state file usable and time based UUIDs safe again
  (bsc#1194642, util-linux-uuidd-fix-lock-state.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1646395200">- Prevent root owning of /var/lib/libuuid/clock.txt
  (bsc#1194642, util-linux-uuidd-prevent-root-owning.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1647604800">- Extend cache in uuid_generate_time_generic() (bsc#1194642#c51,
  util-linux-libuuid-extend-cache.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072000">- agetty: Resolve tty name even if stdin is specified (bsc#1197178,
  util-linux-agetty-resolve-tty-if-stdin-is-specified.patch).
- libmount: When moving a mount point, update all sub mount entries
  in utab (bsc#1198731,
  util-linux-libmount-moving-mount-point-sub-mounts.patch,
  util-linux-libmount-fix-and-improve-utab-on-ms_move.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1656072001">- mesg: use only stat() to get the current terminal status
  (bsc#1200842, util-linux-mesg-use-only-stat.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1657627200">- su: Change owner and mode for pty (bsc#1200842,
  util-linux-login-move-generic-setting-to-ttyutils.patch,
  util-linux-su-change-owner-and-mode-for-pty.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1663588800">- libuuid improvements (bsc#1201959, PED-1150):
  * libuuid: Fix range when parsing UUIDs
    (util-linux-libuuid-uuid_parse-overrun.patch).
  * Improve cache handling for short running applications-increment
    the cache size over runtime
    (util-linux-libuuid-improve-cache-handling.patch).
  * Implement continuous clock handling for time based UUIDs
    (util-linux-libuuid-continuous-clock-handling.patch).
  * Check clock value from clock file to provide seamless libuuid
    update (util-linux-libuuid-check-clock-value.patch).</changelog>
  <changelog author="sbrabec@suse.com" date="1666094400">- Fix file conflict during upgrade (boo#1204211).</changelog>
  <changelog author="sbrabec@suse.com" date="1669896000">- libuuid continuous clock handling for time based UUIDs:
  Prevent use of the new libuuid ABI by uuidd %post before update
  of libuuid1 (bsc#1205646).
- util-linux-uuidd-prevent-root-owning.patch: Use chown --quiet
  to prevent error message if /var/lib/libuuid/clock.txt does not
  exist.</changelog>
</package>
<package pkgid="0c4fc9787ad1d1099eb5eb6f975108a3e6954384abe1b2a9b1e40e5805ee2443" name="vim" arch="src">
  <version epoch="0" ver="9.0.0313" rel="150000.5.25.1"/>
  <changelog author="tchvatal@suse.com" date="1516190400">- Sort with spec-cleaner
- Add conditional to build with python2 in order to build with py3
  only enviroment
- Convert dependencies to pkgconfig style</changelog>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
</package>
<package pkgid="1877d76255e12ac7f6f24acf53e52361c9005c9509c93e003b70f4b167ccf9be" name="vim" arch="src">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="ba54c02af20c5c78ac4380b81bba3a78bb3d4a7900ebf65b8eb7c2e10e396cc5" name="vim" arch="src">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="f5e151d408bbc41ae25938d4e4ecb7668a8a87e6f542e44c675c605bfbaa3d10" name="vim" arch="src">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="47aef9d6e8835e6acefc1a7bc4b731453207a264b27d7f7fd248cd526fd63cf1" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.0313" rel="150000.5.25.1"/>
  <changelog author="tchvatal@suse.com" date="1516190400">- Sort with spec-cleaner
- Add conditional to build with python2 in order to build with py3
  only enviroment
- Convert dependencies to pkgconfig style</changelog>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
</package>
<package pkgid="c7d13b7b72a00f7543f2fb5627e318623f88fd27abc6089646e98c6c542acdc0" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="668211e335f92e658fd169f37d4038436275573f3796de44fa8d03159c7263d3" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="36357e2ba9c1b00bb3e4a070f0b9933b0a2eb809ba47ec0c00665035e5f9620b" name="vim-data-common" arch="noarch">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="c69e81ba6bc481fb5c17d5d02859956b13b5246df19a5b3c9274ae297a9a0e75" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.0313" rel="150000.5.25.1"/>
  <changelog author="tchvatal@suse.com" date="1516190400">- Sort with spec-cleaner
- Add conditional to build with python2 in order to build with py3
  only enviroment
- Convert dependencies to pkgconfig style</changelog>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
</package>
<package pkgid="0244df341e5c7ff200770127edb24c91c7e506e0ca4afc01742cdebf9b2d0240" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.0313" rel="150000.5.25.1"/>
  <changelog author="tchvatal@suse.com" date="1516190400">- Sort with spec-cleaner
- Add conditional to build with python2 in order to build with py3
  only enviroment
- Convert dependencies to pkgconfig style</changelog>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
</package>
<package pkgid="c7176bd7cfc5708afa2a39b57fd40d237a2b003077b90f8acfb1e7af496c047a" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="97f48867c672998c803b9f5acc14f7a76137cbab206f5952cff5f0bc8db75d8e" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.0814" rel="150000.5.28.1"/>
  <changelog author="idonmez@suse.com" date="1516795200">- Make vim require vim-data bsc#1077352 bsc#1075541 bsc#1074790</changelog>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
</package>
<package pkgid="e177865df54cb83f848f9f9b3847b2413e56c29d1a0501a86f3583d9028a9fcb" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="92ce85ae2ad56484b46efb8f30031f2b04a18cb297b2b9d4fac6300450c36203" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.1040" rel="150000.5.31.1"/>
  <changelog author="idonmez@suse.com" date="1517400000">- Updated to revision 1442, fixes the following problems
  * Crash when calling term_start() with empty argument.
  * Crash when term_start() fails.
  * MS-Windows: vimtutor fails if %TMP% has special chars.
  * After ":copen" can't get the window-ID of the quickfix
    window. (FalacerSelene)
  * Illegal memory access after undo. (Dominique Pelle)
  * GTK: :promtfind does not put focus on text input. (Adam Novak)
  * Memory leak in test_arabic.
  * Not enough information about what Python version may work.
  * Pkg-config doesn't work with cross compiling.
  * Filetype detection test not updated for change.
  * If cscope fails a search Vim may hang.
  * Terminal window: some vterm responses are delayed.
  * Using ":undo 0" leaves undo in wrong state.
  * Using pointer before it is set.</changelog>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
</package>
<package pkgid="c81171abe024c24a43da12936f4769666edab1c5315193a3ced121ebb90ecea0" name="vim-small" arch="aarch64">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="494667535ca179ad637812e12a2cb0e3215ba2ba6951656d6d1754a55c0d9d43" name="vim-small" arch="x86_64">
  <version epoch="0" ver="9.0.1234" rel="150000.5.34.1"/>
  <changelog author="idonmez@suse.com" date="1518609600">- Split vim-data into vim-data-common package for low-disk usage
  scenarios bsc#1078722 bsc#1078554 bsc#1075541
- Make set mouse= default in suse.vimrc bsc#1079185 bsc#1078564
  bsc#1067890 bsc#1064068 bsc#1062691</changelog>
  <changelog author="idonmez@suse.com" date="1519128000">- Updated to revision 1525, fixes the following problems
  * Compiler complains about uninitialized variable. (Tony Mechelynck)
  * Missing -D_FILE_OFFSET_BITS=64 may cause problems if a library is compiled
    with it.
  * Cannot act on edits in the command line.
  * Acessing freed memory after window command in auto command. (gy741)
  * Still too many old style tests.
  * Segmentation fault when Ruby throws an exception inside :rubyfile command.
  * Slow redrawing with DirectX.
  * Endless loop when gui_mch_stop_blink() is called while blink_state is
    BLINK_OFF. (zdohnal)
  * It is difficult to set the python home directory properly for Python
    2.7 and 3.5 since both use $PYTHONHOME.
  * Terminal test fails on some systems. (jonathonf)
  * Terminal test fails on some slow terminals.
  * When in silent mode too much output is buffered.
  * If $SHELL contains a space then the default value of 'shell' is
    incorrect. (Matthew Horan)
  * Timer test on travis Mac is still flaky.
  * Clojure now supports a shebang line.
  * Filetype detection test does not check all scripts.
  * Cannot handle change of directory.
  * Missing file in patch.
  * Missing another file in patch.
  * Missing yet another file in patch.
  * Test fails without 'autochdir' option.
  * Completing directory after :find does not add slash.
  * Python2 and python3 detection not tested. (Matej Cepl)
  * Older GTK versions don't have gtk_entry_get_text_length().
  * Libvterm doesn't handle illegal byte sequence correctly.
  * Illegal memory access in del_bytes().
  * When package path is a symlink adding it to 'runtimepath' happens at
    the end.
  * Integer overflow when using regexp pattern. (geeknik)
  * On MS-Windows CursorIM highlighting no longer works.
  * MS-Windows: nsis installer is a bit slow.
  * MS-Windows: D&amp;D fails between 32 and 64 bit apps.
  * Visual C 2017 has multiple MSVCVER numbers.
  * Invalid memory access in read_redo(). (gy741)
  * Screen isn't always updated right away.
  * Redraw flicker when moving the mouse outside of terminal window.
  * Unnecessary condition for "len" being zero.
  * Insert mode completion state is confusing.
  * Patch missing change.
  * Clearing a pointer takes two lines.
  * Using feedkeys() does not work to test Insert mode completion. (Lifepillar)
  * Searchpair() might return an invalid value on timeout.
  * Reduntant conditions.
  * Weird autocmd may cause arglist to be changed recursively.
  * Accessing invalid memory with "it". (Dominique Pelle)
  * Test 14 fails.
  * Emacs tags no longer work. (zdohnal)
  * There is no easy way to get the global directory, esp. if some windows
    have a local directory.
  * Number of spell regions is spread out through the code.
  * The minimum width of the popup menu is hard coded.
  * Memory leak in balloon_split().
  * Completion items cannot be annotated.
  * No autocmd triggered in Insert mode with visible popup menu.
  * Having 'pumwidth' default to zero has no merit.
  * Clearing a pointer takes two lines.
  * Getting the jump list requires parsing the output of :jumps.
  * Getjumplist() returns duplicate entries. (lacygoill)
  * Out-of-memory situation not correctly handled. (Coverity)
  * Possible NULL pointer dereference. (Coverity)
  * Out-of-memory situation not correctly handled. (Coverity)
  * In out-of-memory situation character is not restored. (Coverity)
  * Access memory beyond end of string. (Coverity)
  * Win32: the screen may be cleared on startup.
  * Debugger can't break on a condition. (Charles Campbell)
  * New version of HP NonStop (Tandem) doesn't like the default header
    for setenv().
  * Timer test is a bit flaky.
  * The :drop command is not always available.
  * Test for failing drag-n-drop command no longer fails.
  * Cannot test if a command causes a beep.
  * Some code for the debugger watch expression is clumsy.
  * Warning for possibly using NULL pointer. (Coverity)
  * The jumplist is not always properly cleaned up.
  * Getting the list of changes is not easy.
  * BufWinEnter event fired when opening hidden terminal.
  * Errors for job options are not very specific.
  * Invalid memory acces with pattern using look-behind match. (Dominique
    Pelle)
  * Error messages suppressed after ":silent! try". (Ben Reilly)
  * Getchangelist() does not use argument as bufname().
  * Cursor is in the wrong line when using a WinBar in a Terminal window.
  * Shift-Tab does not work in a terminal window.
  * Popup menu is positioned in the wrong place. (Davit Samvelyan, Boris
    Staletic)
  * Cannot write and read terminal screendumps.
  * Compiler warnings for uninitialized variables. (Tony Mechelynck)
  * Using :wqa exits even if a job runs in a terminal window. (Jason Felice)</changelog>
  <changelog author="idonmez@suse.com" date="1519992000">- Recommend vim-data so that colors can work by default</changelog>
  <changelog author="idonmez@suse.com" date="1520251200">- Updated to revision 1568, fixes the following problems
  * No test using a screen dump yet.
  * Screen dump test fails on MS-Windows.
  * Dead code found.
  * Assert_equalfile() does not close file descriptors. (Coverity)
  * Dump test fails when using a shadow directory.
  * Cannot use 24 bit colors in MS-Windows console.
  * Compiler warnings without termguicolors feature.
  * Libterm doesn't support requesting fg and bg color.
  * C syntax test fails when using gvim
  * C syntax test still fails when using gvim.
  * Quotestar test is flaky when using the GUI.
  * Xxd does not skip NUL lines when using ebcdic.
  * Popupmenu is too far left when completion is long. (Linwei)
  * No test for the popup menu positioning.
  * Popup menu positioning fails with longer string.
  * synpat_T is taking too much memory.
  * Terminal screen dump does not include cursor position.
  * With 'termguicolors' Normal color doesn't work correctly.
  * When using 'termguicolors' SpellBad doesn't show.
  * Screen dumps not included in distribution.
  * Using feedkeys() in a terminal window may trigger mappings.
    (Charles Sheridan)
  * Undo in the options window makes it empty.
  * Screen dump test script not included in distribution.
  * Various small problems in test files.
  * Various small problems in source files.
  * On Mac 'maxmemtot' is set to a weird value.
  * May leak file descriptors when executing job.
  * Cannot see what digraph is used to insert a character.
  * Custom plugins loaded with --clean.
  * Build error for some combination of features.
  * May not parse the t_RS response correctly, resulting in wrong characters
    in the input stream.
  * printf() does not work with only one argument. (Daniel Hahler)
  * No right-click menu in a terminal.
  * Build failure without GUI.
  * Build failure without GUI on MS-Windows.
  * Crash with rust syntax highligting. (Edd Barrett)
  * The terminal debugger can't set a breakpoint with the mouse.
  * Timeout of getwinposx() can be too short. (lilydjwg)
  * Too many #ifdefs.
  * Can't build Mac version without GUI.
  * Too many #ifdefs.
  * Cannot build Win32 GUI without IME. (John Marriott)
  * Can't build on older Mac, header file is missing.</changelog>
  <changelog author="idonmez@suse.com" date="1520510400">- Switch to make -j1 clean to see if it fixes random build failures
  on Leap/SLE 15.</changelog>
  <changelog author="lnussel@suse.de" date="1521806400">- instead of explicitly unsetting mouse, remove it from the defaults in the
  first place (boo#1079185, vim-8.0.1568-defaults.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1522843200">- Pre-convert gvim icons, otherwise building vim depends on
  rsvg-convert -&gt; librsvg -&gt; cargo -&gt; Rust -&gt; LLVM
- Cleanup SVG icon, make lines pixel-grid aligned
- Correct RPM Group</changelog>
  <changelog author="idonmez@suse.com" date="1559822400">- Add source-check-sandbox.patch to fix CVE-2019-12735
  boo#1137443</changelog>
  <changelog author="lnussel@suse.de" date="1589457600">- introduce vim-small package with reduced requirements for small
  installations (boo#1166602).
- BuildRequire pkg-config(krb5) instead of krb5-mini to be able to
  build against Tumbleweed repo.</changelog>
  <changelog author="idonmez@suse.com" date="1590753600">- Add restrict-shell-commands.patch to disable using interfaces in
  restricted mode, fixes bsc#1172225 CVE-2019-20807</changelog>
  <changelog author="lnussel@suse.de" date="1593518400">- stop owning /etc/vimrc so the old, distro provided config actually
  gets removed. Leaving it around leads to a duplicated autocmd for
  * .spec, leading to spec file template inserted twice.
- own some dirs in vim-data-common so installation of vim-small
  doesn't leave not owned directories (boo#1173256).
- Add vi as slave to update-alternatives so that every package
  has a matching "vi" symlink (bsc#1174564, boo#1176549).</changelog>
  <changelog author="lnussel@suse.de" date="1613649600">- source correct suse.vimrc file (boo#1182324)</changelog>
  <changelog author="lnussel@suse.de" date="1614081600">- install suse vimrc in /usr (boo#1182324, vim-8.0.1568-globalvimrc.patch)</changelog>
  <changelog author="zbalogh@suse.com" date="1645185600">- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch</changelog>
  <changelog author="zbalogh@suse.com" date="1654776000">- Deleted patches:
  * restrict-shell-commands.patch
  * source-check-sandbox.patch
  * vim-8.0.1568-CVE-2021-3778.patch
  * vim-8.0.1568-CVE-2021-3796.patch
  * vim-8.0.1568-CVE-2021-3872.patch
  * vim-8.0.1568-CVE-2021-3927.patch
  * vim-8.0.1568-CVE-2021-3928.patch
  * vim-8.0.1568-CVE-2021-3984.patch
  * vim-8.0.1568-CVE-2021-4019.patch
  * vim-8.0.1568-CVE-2021-4193.patch
  * vim-8.0.1568-CVE-2021-46059.patch
  * vim-8.0.1568-CVE-2022-0319.patch
  * vim-8.0.1568-CVE-2022-0351.patch
  * vim-8.0.1568-CVE-2022-0361.patch
  * vim-8.0.1568-CVE-2022-0413.patch
  * vim-8.0.1568-globalvimrc.patch
- Added patches:
  * vim-8.1.0297-dump3.patch
  * vim-8.2.2411-globalvimrc.patch
  * disable-unreliable-tests-arch.patch
- Updated patches:
  * disable-unreliable-tests.patch
  * vim-7.3-filetype_changes.patch
  * vim-7.3-filetype_ftl.patch
  * vim-7.3-filetype_spec.patch
  * vim-7.3-gvimrc_fontset.patch
  * vim-7.3-help_tags.patch
  * vim-7.3-mktemp_tutor.patch
  * vim-7.3-name_vimrc.patch
  * vim-7.3-sh_is_bash.patch
  * vim-7.3-use_awk.patch
  * vim-7.4-disable_lang_no.patch
  * vim-7.4-filetype_apparmor.patch
  * vim-7.4-filetype_mine.patch
  * vim-7.4-highlight_fstab.patch
  * vim-8.0-ttytype-test.patch
  * vim-8.0.1568-defaults.patch
  * vim73-no-static-libpython.patch
- Updated to version 8.2 with patch level 5038, fixes the following problems
  * Fixing bsc#1191770 VUL-0: CVE-2021-3875: vim: heap-based buffer overflow
  * Fixing bsc#1192167 VUL-0: CVE-2021-3903: vim: heap-based buffer overflow
  * Fixing bsc#1192902 VUL-0: CVE-2021-3968: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192903 VUL-0: CVE-2021-3973: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1192904 VUL-0: CVE-2021-3974: vim: vim is vulnerable to Use
    After Free
  * Fixing bsc#1193466 VUL-1: CVE-2021-4069: vim: use-after-free in ex_open()
    in src/ex_docmd.c
  * Fixing bsc#1193905 VUL-0: CVE-2021-4136: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1194093 VUL-1: CVE-2021-4166: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194216 VUL-1: CVE-2021-4193: vim: vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1194217 VUL-0: CVE-2021-4192: vim: vulnerable to Use After Free
  * Fixing bsc#1194872 VUL-0: CVE-2022-0261: vim: Heap-based Buffer Overflow
    in vim prior to 8.2.
  * Fixing bsc#1194885 VUL-0: CVE-2022-0213: vim: vim is vulnerable to
    Heap-based Buffer Overflow
  * Fixing bsc#1195004 VUL-0: CVE-2022-0318: vim: Heap-based Buffer Overflow in
    vim prior to 8.2.
  * Fixing bsc#1195203 VUL-0: CVE-2022-0359: vim: heap-based buffer overflow in
    init_ccline() in ex_getln.c
  * Fixing bsc#1195354 VUL-0: CVE-2022-0407: vim: Heap-based Buffer Overflow in
    Conda vim prior to 8.2.
  * Fixing bsc#1198596 VUL-0: CVE-2022-1381: vim: global heap buffer overflow
    in skip_range
  * Fixing bsc#1199331 VUL-0: CVE-2022-1616: vim: Use after free in
    append_command
  * Fixing bsc#1199333 VUL-0: CVE-2022-1619: vim: Heap-based Buffer Overflow in
    function cmdline_erase_chars
  * Fixing bsc#1199334 VUL-0: CVE-2022-1620: vim: NULL Pointer Dereference in
    function vim_regexec_string
  * Fixing bsc#1199747 VUL-0: CVE-2022-1796: vim: Use After in
    find_pattern_in_path
  * Fixing bsc#1200010 VUL-0: CVE-2022-1897: vim: Out-of-bounds Write in vim
  * Fixing bsc#1200011 VUL-0: CVE-2022-1898: vim: Use After Free in vim prior
    to 8.2
  * Fixing bsc#1200012 VUL-0: CVE-2022-1927: vim: Buffer Over-read in vim prior
    to 8.2
  * Fixing bsc#1070955 VUL-1: CVE-2017-17087: vim: Sets the group ownership of a
    .swp file to the editor's primary group, which allows local users to obtain
    sensitive information
  * Fixing bsc#1194388 VUL-1: CVE-2022-0128: vim: vim is vulnerable to
    Out-of-bounds Read
  * Fixing bsc#1195332 VUL-1: CVE-2022-0392: vim: Heap-based Buffer Overflow
    in vim prior to 8.2
  * Fixing bsc#1196361 VUL-1: CVE-2022-0696: vim: NULL Pointer Dereference in
    vim prior to 8.2
  * Fixing bsc#1198748 VUL-1: CVE-2022-1420: vim: Out-of-range Pointer Offset
  * Fixing bsc#1199651 VUL-1: CVE-2022-1735: vim: heap buffer overflow
  * Fixing bsc#1199655 VUL-1: CVE-2022-1733: vim: Heap-based Buffer Overflow in
    cindent.c
  * Fixing bsc#1199693 VUL-1: CVE-2022-1771: vim: stack exhaustion in vim prior
    to 8.2.
  * Fixing bsc#1199745 VUL-1: CVE-2022-1785: vim: Out-of-bounds Write
  * Fixing bsc#1199936 VUL-1: CVE-2022-1851: vim: out of bounds read</changelog>
  <changelog author="zbalogh@suse.com" date="1661947200">- Updated to version 9.0 with patch level 0313, fixes the following problems
  * Fixing bsc#1200884 Vim: Error on startup
  * Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
  * Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
  * Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
  * Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
  * Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
  * Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
  * Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
  * Fixing bsc#1201620 PUBLIC SUSE Linux Enterprise Server 15 SP4 Basesystem zbalogh@suse.com NEW --- SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
  * Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
  * Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
  * Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
  * Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
  * Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
  * Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
  * Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
  * Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
  * Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
  * Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
  * Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
  * Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
  * Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
  * Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
  * Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
  * Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
  * Fixing bsc#1201154 VUL-1: CVE-2022-2257: vim: out of bounds read in msg_outtrans_special()
  * Fixing bsc#1201155 VUL-1: CVE-2022-2206: vim: out of bounds read in msg_outtrans_attr()
  * Fixing bsc#1201863 VUL-1: CVE-2022-2522: vim: out of bounds read via nested autocommand
  * Fixing bsc#1202046 VUL-1: CVE-2022-2571: vim: Heap-based Buffer Overflow related to ins_comp_get_next_word_or_line()
  * Fixing bsc#1202049 VUL-1: CVE-2022-2580: vim: Heap-based Buffer Overflow related to eval_string()
  * Fixing bsc#1202050 VUL-1: CVE-2022-2581: vim: Out-of-bounds Read related to cstrchr()
  * Fixing bsc#1202051 VUL-1: CVE-2022-2598: vim: Undefined Behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput()
  * Fixing bsc#1202420 VUL-1: CVE-2022-2817: vim: Use After Free in f_assert_fails()
  * Fixing bsc#1202421 VUL-1: CVE-2022-2816: vim: Out-of-bounds Read in check_vim9_unlet()
  * Fixing bsc#1202511 VUL-1: CVE-2022-2862: vim: use-after-free in compile_nested_function()
  * Fixing bsc#1202512 VUL-1: CVE-2022-2849: vim: Invalid memory access related to mb_ptr2len()
  * Fixing bsc#1202515 VUL-1: CVE-2022-2845: vim: Buffer Over-read related to display_dollar()
  * Fixing bsc#1202599 VUL-1: CVE-2022-2889: vim: use-after-free in find_var_also_in_script() in evalvars.c
  * Fixing bsc#1202687 VUL-1: CVE-2022-2923: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240
  * Fixing bsc#1202689 VUL-1: CVE-2022-2946: vim: use after free in function vim_vsnprintf_typval
  * Fixing bsc#1202862 VUL-1: CVE-2022-3016: vim: Use After Free in vim prior to 9.0.0285 Mon 12:00</changelog>
  <changelog author="zbalogh@suse.com" date="1669204800">- Updated to version 9.0 with patch level 0814, fixes the following problems
  * Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
  * Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
  * Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
  * Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
  * Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
  * Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
  * Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
  * Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
  * Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
  * Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
  * Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
  * Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
  * Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
  * Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
- ignore-flaky-test-failure.patch: Ignore failure of flaky tests
- disable-unreliable-tests-arch.patch: Removed
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.0313...v9.0.0814</changelog>
  <changelog author="zbalogh@suse.com" date="1671451200">- Updated to version 9.0 with patch level 1040, fixes the following security problems
  * Fixing bsc#1206028 VUL-0: CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742
  * Fixing bsc#1206071 VUL-0: CVE-2022-3520: vim: Heap-based Buffer Overflow
  * Fixing bsc#1206072 VUL-0: CVE-2022-3591: vim: Use After Free
  * Fixing bsc#1206075 VUL-0: CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882.
  * Fixing bsc#1206077 VUL-0: CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.
  * Fixing bsc#1205797 VUL-0: CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11
  * Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.814...v9.0.1040</changelog>
  <changelog author="zbalogh@suse.com" date="1674648000">- Updated to version 9.0 with patch level 1234, fixes the following security problems
  * Fixing bsc#1207396 VUL-0: CVE-2023-0433: vim: Heap-based Buffer Overflow in vim prior to 9.0.1225
  * Fixing bsc#1207162 VUL-1: CVE-2023-0288: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
  * Fixing bsc#1206868 VUL-1: CVE-2023-0054: vim: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
  * Fixing bsc#1206867 VUL-1: CVE-2023-0051: vim: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
  * Fixing bsc#1206866 VUL-1: CVE-2023-0049: vim: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.
- refreshed vim-7.4-highlight_fstab.patch
- for the complete list of changes see
  https://github.com/vim/vim/compare/v9.0.1040...v9.0.1234</changelog>
</package>
<package pkgid="00a2fa1461fccab0157db72c019e9ee1379b81e58863fe52d0550afac795a43a" name="wicked" arch="aarch64">
  <version epoch="0" ver="0.6.70" rel="150300.4.8.1"/>
  <changelog author="mt@suse.de" date="1540555200">- version 0.6.51
- wireless: fix eap peap auth mapping for wpa-supplicant (bsc#1026807)
- vxlan: fix to convert dst_port to network byte order</changelog>
  <changelog author="mt@suse.de" date="1542369600">- version 0.6.52
- wickedd: fix netdev detection bootstrap race (bsc#1107579)
- compat: fix ifcfg parsing crash if network/config is missed</changelog>
  <changelog author="rtorreromarijnissen@suse.de" date="1548331200">- version 0.6.53
- dhcp: request hostname/fqdn option in the tester (bsc#1118378)
- build: link with relro by default for binary hardening</changelog>
  <changelog author="mt@suse.de" date="1554465600">- version 0.6.54
- switch to use systemd notify and prevent event backlog at start
  by calling udevadm settle before starting wickedd (bsc#1118206)
- dhcp6: don't discard confirm reply without status (bsc#1127340)
- ethtool: set lro legacy flag and not txvlan (bsc#1123555)
- init memory before use in ioctl
- fsm: fix find pending worker loop segfault (boo#1106809)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1565784000">- version 0.6.55
- dhcp6: do not default to a /64 address prefix-length (bsc#1132280)
  Add an address-length aka DHCLIENT6_ADDRESS_LENGTH ifcfg option, which
  permits to specify explicit prefix-length to use for the DHCPv6 address
  and override detection using RA prefix info and a default to /128.
- time: use boot time for timer instead of real time (bsc#1129986)
- dhcp: Consistently log dhcp xid and enabled to log dhcp6 timings line.
- dhcp6: lower unexpected xid messages to debug level
- systemd: change to depend on udev settle service (bsc#1136034,bsc#1132774)
  Calling udevadm settle directly caused systemd to kill wicked services.
- bridge: honour ifcfg LLADDR and set link address (bsc#1042123,boo#1142670)
- rfkill: fix switch statement to check enum variable not a constant (bsc#1140117)
- man: ifcfg-ovs-bridge(5): recommend STARTMODE=nfsroot
- dhcp4: nullify defer timer pointer when timeout (openSUSE/wicked#798,bsc#1142214)
- dhcp4: fix to request routing options when custom options are used (bsc#1132326)
- testing: add ifbind.sh helper script allowing to test hotplugging</changelog>
  <changelog author="mt@suse.com" date="1567771200">- version 0.6.56
- dhcp6: initial support to request prefix for delegations (jsc#SLE-5936)
- dhcp6: set the noprefixroute address option (bsc#1132280)</changelog>
  <changelog author="mt@suse.com" date="1568894400">- version 0.6.57
- dhcp6: omit noprefixroute with address-length (bsc#1150972)
  Permit to assume that the address prefix-length override specified
  in the config is a valid on-link prefix length, to let the kernel
  create a route for this prefix.
- dhcp6: differentiated mode=auto resolving from RA (bsc#1150183)
  Fixed to not trigger to report an error when ipv6 RA is not
  available or the received RA disables dhcp while mode is set to
  auto, but to deliver a 'deferred' results.</changelog>
  <changelog author="mt@suse.com" date="1570190400">- version 0.6.60
- libwicked: fix versioning and packaging (bsc#1143182,bsc#1132977)
  shipping the internal helper library inside of the wicked package.</changelog>
  <changelog author="mt@suse.com" date="1576065600">- version 0.6.61
- dracut: add initial cmdline parsing as a config source
- address: don't check hwaddr length if parsing as ARPHRD_VOID
- utils: added find and insert var array utils, cleanup
- client: add show-policy command calling policy generation
- client: initial support to generate a basic policy directly
- client: cleanup convert and show-config commands</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1582718400">- version 0.6.62
- dhcp4: discard lease on client-id mismatch (CVE-2020-7217,bsc#1160906)
- dhcp4: free lease on response without message type (CVE-2020-7216,bsc#1160905)
- dhcp6: don't add free'd IA to ia_pd_list on T1&gt;T2 (CVE-2019-18903,bsc#1160904)
- dhcp6: fix use-after-free on option parsing failure (CVE-2019-18902,bsc#1160903)
- utils: don't reject NULL var array names/keys breaking wicked duid dump
- routes: schema fix to avoid not applying rto_min incl. new time format (bsc#1160939)
- systemd: order start wicked after network-pre.target and openvswitch.service start
- packaging: use pkgconfig(libsystemd) instead of systemd-devel
- misc bug fixes by Malte Kraus including undefined behaviour, memory access alignment
- corrections, use-after-free, missed initialization and format errors</changelog>
  <changelog author="mt@suse.com" date="1583323200">- version 0.6.63
- spec: fix old libwicked package provides/obsoletes (bsc#1165180)
- ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1601467200">- version 0.6.64
- avoid incomplete ifdown/timeout on route deletion error (bsc#1174099)
- dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770)
- wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082)
- team: fix schema to use correct hwaddr_policy property (boo#1171234)
- team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556)</changelog>
  <changelog author="mt@suse.com" date="1614859200">- version 0.6.65
- ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215)
- client: parse sysctl files in the correct order (bsc#1181186)
- ifup: fix for set up with unenslave from unconfigured master (boo#954329)
- rpm: prepare for new builds using usrmerged rpm macro (boo#1029961)
- rpm: Let wicked-service also provide service(network)
- cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815)
- dbus: add variant container, generic object-path and uint32 array macros</changelog>
  <changelog author="mt@suse.com" date="1617796800">- dhcp4: discover on reboot timeout after start-delay (bsc#1181812)
  [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
- dhcp6: request nis options on sle15 by default (bsc#1181812)
  [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1623758400">- version 0.6.66
- wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920)
  - support multiple networks configurations per interface
  - show connection status and scan-results (bsc#1160654)
  - corrected eap-tls,ttls cetificate handling and open vs. shared
    wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592)
  - cleanups and several other improvements, see changes
  - updated man ifcfg-wireless manual pages
- nanny: fix identify node owner exit condition
- schema: several xml-schema and dbus/property improvements
- utils: format/parse bitmap to array and string alternatives
- client: expose ethtool --get-permanent-address option
- removed sle15-sp3 patches included in the master sources (bsc#1181812)
  [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
  [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1633089600">- version 0.6.67
- dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750)
- logging: log reaped sub-process command and as debug, not error
- ifstatus: Don't show link as "up" without RUNNING flag set
- firewalld: Make the zone assignment permanent (boo#1189560)
- fsm: cleanup and improve ifconfig and ifpolicy access utils
- dbus: cleanup the dbus-service.h file and unused property macros
- cleanup: applied code-spell run typo corrections
- dracut: initial fixes and improved option handling (boo#1182227)</changelog>
  <changelog author="mt@suse.com" date="1636027200">- dbus: config files in /usr shouldn't be marked as config in spec</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1640088000">- version 0.6.68
- sysctl: process sysctl.d directories as in sysctl --system
- sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357)
- dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353)
- cleanup: warnings, time calculations and dhcp fixes (bsc#1188019)
- wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495)
- tuntap: avoid sysfs attr read error (bsc#1192311)
- ifstatus: fix warning of unexpected interface flag combination (bsc#1192164)</changelog>
  <changelog author="mt@suse.com" date="1642593600">- fsm: fix device rename via yast (bsc#1194392)
  Reset worker config instead to reject a NULL/empty config
  xml node -- introduced in wicked 0.6.67 by commit c2a0385.
  [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1666267200">- version 0.6.70
- build: Link as Position Independent Executable (bsc#1184124)
- dhcp4: Fix issues in reuse of last lease (bsc#1187655)
- dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307)
- dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b)
- dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03)
- dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924)
- team: Fix to configure port priority in teamd (bsc#1200505)
- firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950)
- wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931)
- wireless: Add support for WPA3 and PMF (bsc#1198894)
- wireless: Remove libiw dependencies (gh#openSUSE/wicked#910)
- client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919)
- client: Add release options to ifdown/ifreload (jsc#SLE-10249)
- dbus: Clear string array before append (gh#openSUSE/wicked#913)
- socket: Fix SEGV on heavy socket restart errors (bsc#1192508)
- systemd: Remove systemd-udev-settle dependency (bsc#1186787)
- version 0.6.69
- redfish: decode smbios and setup host interface
  Add initial support to decode the SMBIOS Management Controller Host
  Interface (Type 42) structure and expose it as wicked `firmware:redfish`
  configuration to setup a Host Network Interface (to the BMC) using the
  `Redfish over IP` protocol allowing access to the Redfish Service (via
  redfish-localhost in /etc/hosts) used to manage the computer system.
  Tech Preview (jsc#SLE-17762).
- buffer: fix size_t length downcast to uint, add guards to init functions
- wireless: fix to not expect colons in 64byte long wpa-psk hex hash string
- xml-schema: reference counting fix to not crash at exit on schema errors
- compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl,
  remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5.
- compat-suse: fix reading of sysctl addr_gen_mode to wrong variable
- auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429)
- removed obsolete patch included in the master sources (bsc#1194392)
  [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
</package>
<package pkgid="34fcb8593ac56e9ab366b464efbeef3293df054abafab560e8716c652ee86395" name="wicked" arch="src">
  <version epoch="0" ver="0.6.70" rel="150300.4.8.1"/>
  <changelog author="mt@suse.de" date="1540555200">- version 0.6.51
- wireless: fix eap peap auth mapping for wpa-supplicant (bsc#1026807)
- vxlan: fix to convert dst_port to network byte order</changelog>
  <changelog author="mt@suse.de" date="1542369600">- version 0.6.52
- wickedd: fix netdev detection bootstrap race (bsc#1107579)
- compat: fix ifcfg parsing crash if network/config is missed</changelog>
  <changelog author="rtorreromarijnissen@suse.de" date="1548331200">- version 0.6.53
- dhcp: request hostname/fqdn option in the tester (bsc#1118378)
- build: link with relro by default for binary hardening</changelog>
  <changelog author="mt@suse.de" date="1554465600">- version 0.6.54
- switch to use systemd notify and prevent event backlog at start
  by calling udevadm settle before starting wickedd (bsc#1118206)
- dhcp6: don't discard confirm reply without status (bsc#1127340)
- ethtool: set lro legacy flag and not txvlan (bsc#1123555)
- init memory before use in ioctl
- fsm: fix find pending worker loop segfault (boo#1106809)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1565784000">- version 0.6.55
- dhcp6: do not default to a /64 address prefix-length (bsc#1132280)
  Add an address-length aka DHCLIENT6_ADDRESS_LENGTH ifcfg option, which
  permits to specify explicit prefix-length to use for the DHCPv6 address
  and override detection using RA prefix info and a default to /128.
- time: use boot time for timer instead of real time (bsc#1129986)
- dhcp: Consistently log dhcp xid and enabled to log dhcp6 timings line.
- dhcp6: lower unexpected xid messages to debug level
- systemd: change to depend on udev settle service (bsc#1136034,bsc#1132774)
  Calling udevadm settle directly caused systemd to kill wicked services.
- bridge: honour ifcfg LLADDR and set link address (bsc#1042123,boo#1142670)
- rfkill: fix switch statement to check enum variable not a constant (bsc#1140117)
- man: ifcfg-ovs-bridge(5): recommend STARTMODE=nfsroot
- dhcp4: nullify defer timer pointer when timeout (openSUSE/wicked#798,bsc#1142214)
- dhcp4: fix to request routing options when custom options are used (bsc#1132326)
- testing: add ifbind.sh helper script allowing to test hotplugging</changelog>
  <changelog author="mt@suse.com" date="1567771200">- version 0.6.56
- dhcp6: initial support to request prefix for delegations (jsc#SLE-5936)
- dhcp6: set the noprefixroute address option (bsc#1132280)</changelog>
  <changelog author="mt@suse.com" date="1568894400">- version 0.6.57
- dhcp6: omit noprefixroute with address-length (bsc#1150972)
  Permit to assume that the address prefix-length override specified
  in the config is a valid on-link prefix length, to let the kernel
  create a route for this prefix.
- dhcp6: differentiated mode=auto resolving from RA (bsc#1150183)
  Fixed to not trigger to report an error when ipv6 RA is not
  available or the received RA disables dhcp while mode is set to
  auto, but to deliver a 'deferred' results.</changelog>
  <changelog author="mt@suse.com" date="1570190400">- version 0.6.60
- libwicked: fix versioning and packaging (bsc#1143182,bsc#1132977)
  shipping the internal helper library inside of the wicked package.</changelog>
  <changelog author="mt@suse.com" date="1576065600">- version 0.6.61
- dracut: add initial cmdline parsing as a config source
- address: don't check hwaddr length if parsing as ARPHRD_VOID
- utils: added find and insert var array utils, cleanup
- client: add show-policy command calling policy generation
- client: initial support to generate a basic policy directly
- client: cleanup convert and show-config commands</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1582718400">- version 0.6.62
- dhcp4: discard lease on client-id mismatch (CVE-2020-7217,bsc#1160906)
- dhcp4: free lease on response without message type (CVE-2020-7216,bsc#1160905)
- dhcp6: don't add free'd IA to ia_pd_list on T1&gt;T2 (CVE-2019-18903,bsc#1160904)
- dhcp6: fix use-after-free on option parsing failure (CVE-2019-18902,bsc#1160903)
- utils: don't reject NULL var array names/keys breaking wicked duid dump
- routes: schema fix to avoid not applying rto_min incl. new time format (bsc#1160939)
- systemd: order start wicked after network-pre.target and openvswitch.service start
- packaging: use pkgconfig(libsystemd) instead of systemd-devel
- misc bug fixes by Malte Kraus including undefined behaviour, memory access alignment
- corrections, use-after-free, missed initialization and format errors</changelog>
  <changelog author="mt@suse.com" date="1583323200">- version 0.6.63
- spec: fix old libwicked package provides/obsoletes (bsc#1165180)
- ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1601467200">- version 0.6.64
- avoid incomplete ifdown/timeout on route deletion error (bsc#1174099)
- dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770)
- wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082)
- team: fix schema to use correct hwaddr_policy property (boo#1171234)
- team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556)</changelog>
  <changelog author="mt@suse.com" date="1614859200">- version 0.6.65
- ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215)
- client: parse sysctl files in the correct order (bsc#1181186)
- ifup: fix for set up with unenslave from unconfigured master (boo#954329)
- rpm: prepare for new builds using usrmerged rpm macro (boo#1029961)
- rpm: Let wicked-service also provide service(network)
- cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815)
- dbus: add variant container, generic object-path and uint32 array macros</changelog>
  <changelog author="mt@suse.com" date="1617796800">- dhcp4: discover on reboot timeout after start-delay (bsc#1181812)
  [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
- dhcp6: request nis options on sle15 by default (bsc#1181812)
  [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1623758400">- version 0.6.66
- wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920)
  - support multiple networks configurations per interface
  - show connection status and scan-results (bsc#1160654)
  - corrected eap-tls,ttls cetificate handling and open vs. shared
    wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592)
  - cleanups and several other improvements, see changes
  - updated man ifcfg-wireless manual pages
- nanny: fix identify node owner exit condition
- schema: several xml-schema and dbus/property improvements
- utils: format/parse bitmap to array and string alternatives
- client: expose ethtool --get-permanent-address option
- removed sle15-sp3 patches included in the master sources (bsc#1181812)
  [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
  [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1633089600">- version 0.6.67
- dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750)
- logging: log reaped sub-process command and as debug, not error
- ifstatus: Don't show link as "up" without RUNNING flag set
- firewalld: Make the zone assignment permanent (boo#1189560)
- fsm: cleanup and improve ifconfig and ifpolicy access utils
- dbus: cleanup the dbus-service.h file and unused property macros
- cleanup: applied code-spell run typo corrections
- dracut: initial fixes and improved option handling (boo#1182227)</changelog>
  <changelog author="mt@suse.com" date="1636027200">- dbus: config files in /usr shouldn't be marked as config in spec</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1640088000">- version 0.6.68
- sysctl: process sysctl.d directories as in sysctl --system
- sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357)
- dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353)
- cleanup: warnings, time calculations and dhcp fixes (bsc#1188019)
- wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495)
- tuntap: avoid sysfs attr read error (bsc#1192311)
- ifstatus: fix warning of unexpected interface flag combination (bsc#1192164)</changelog>
  <changelog author="mt@suse.com" date="1642593600">- fsm: fix device rename via yast (bsc#1194392)
  Reset worker config instead to reject a NULL/empty config
  xml node -- introduced in wicked 0.6.67 by commit c2a0385.
  [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1666267200">- version 0.6.70
- build: Link as Position Independent Executable (bsc#1184124)
- dhcp4: Fix issues in reuse of last lease (bsc#1187655)
- dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307)
- dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b)
- dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03)
- dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924)
- team: Fix to configure port priority in teamd (bsc#1200505)
- firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950)
- wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931)
- wireless: Add support for WPA3 and PMF (bsc#1198894)
- wireless: Remove libiw dependencies (gh#openSUSE/wicked#910)
- client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919)
- client: Add release options to ifdown/ifreload (jsc#SLE-10249)
- dbus: Clear string array before append (gh#openSUSE/wicked#913)
- socket: Fix SEGV on heavy socket restart errors (bsc#1192508)
- systemd: Remove systemd-udev-settle dependency (bsc#1186787)
- version 0.6.69
- redfish: decode smbios and setup host interface
  Add initial support to decode the SMBIOS Management Controller Host
  Interface (Type 42) structure and expose it as wicked `firmware:redfish`
  configuration to setup a Host Network Interface (to the BMC) using the
  `Redfish over IP` protocol allowing access to the Redfish Service (via
  redfish-localhost in /etc/hosts) used to manage the computer system.
  Tech Preview (jsc#SLE-17762).
- buffer: fix size_t length downcast to uint, add guards to init functions
- wireless: fix to not expect colons in 64byte long wpa-psk hex hash string
- xml-schema: reference counting fix to not crash at exit on schema errors
- compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl,
  remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5.
- compat-suse: fix reading of sysctl addr_gen_mode to wrong variable
- auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429)
- removed obsolete patch included in the master sources (bsc#1194392)
  [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
</package>
<package pkgid="a13ec541d813ce00238770ff6347fdc0d417b6c0a35096439525e61ebeb17550" name="wicked" arch="x86_64">
  <version epoch="0" ver="0.6.70" rel="150300.4.8.1"/>
  <changelog author="mt@suse.de" date="1540555200">- version 0.6.51
- wireless: fix eap peap auth mapping for wpa-supplicant (bsc#1026807)
- vxlan: fix to convert dst_port to network byte order</changelog>
  <changelog author="mt@suse.de" date="1542369600">- version 0.6.52
- wickedd: fix netdev detection bootstrap race (bsc#1107579)
- compat: fix ifcfg parsing crash if network/config is missed</changelog>
  <changelog author="rtorreromarijnissen@suse.de" date="1548331200">- version 0.6.53
- dhcp: request hostname/fqdn option in the tester (bsc#1118378)
- build: link with relro by default for binary hardening</changelog>
  <changelog author="mt@suse.de" date="1554465600">- version 0.6.54
- switch to use systemd notify and prevent event backlog at start
  by calling udevadm settle before starting wickedd (bsc#1118206)
- dhcp6: don't discard confirm reply without status (bsc#1127340)
- ethtool: set lro legacy flag and not txvlan (bsc#1123555)
- init memory before use in ioctl
- fsm: fix find pending worker loop segfault (boo#1106809)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1565784000">- version 0.6.55
- dhcp6: do not default to a /64 address prefix-length (bsc#1132280)
  Add an address-length aka DHCLIENT6_ADDRESS_LENGTH ifcfg option, which
  permits to specify explicit prefix-length to use for the DHCPv6 address
  and override detection using RA prefix info and a default to /128.
- time: use boot time for timer instead of real time (bsc#1129986)
- dhcp: Consistently log dhcp xid and enabled to log dhcp6 timings line.
- dhcp6: lower unexpected xid messages to debug level
- systemd: change to depend on udev settle service (bsc#1136034,bsc#1132774)
  Calling udevadm settle directly caused systemd to kill wicked services.
- bridge: honour ifcfg LLADDR and set link address (bsc#1042123,boo#1142670)
- rfkill: fix switch statement to check enum variable not a constant (bsc#1140117)
- man: ifcfg-ovs-bridge(5): recommend STARTMODE=nfsroot
- dhcp4: nullify defer timer pointer when timeout (openSUSE/wicked#798,bsc#1142214)
- dhcp4: fix to request routing options when custom options are used (bsc#1132326)
- testing: add ifbind.sh helper script allowing to test hotplugging</changelog>
  <changelog author="mt@suse.com" date="1567771200">- version 0.6.56
- dhcp6: initial support to request prefix for delegations (jsc#SLE-5936)
- dhcp6: set the noprefixroute address option (bsc#1132280)</changelog>
  <changelog author="mt@suse.com" date="1568894400">- version 0.6.57
- dhcp6: omit noprefixroute with address-length (bsc#1150972)
  Permit to assume that the address prefix-length override specified
  in the config is a valid on-link prefix length, to let the kernel
  create a route for this prefix.
- dhcp6: differentiated mode=auto resolving from RA (bsc#1150183)
  Fixed to not trigger to report an error when ipv6 RA is not
  available or the received RA disables dhcp while mode is set to
  auto, but to deliver a 'deferred' results.</changelog>
  <changelog author="mt@suse.com" date="1570190400">- version 0.6.60
- libwicked: fix versioning and packaging (bsc#1143182,bsc#1132977)
  shipping the internal helper library inside of the wicked package.</changelog>
  <changelog author="mt@suse.com" date="1576065600">- version 0.6.61
- dracut: add initial cmdline parsing as a config source
- address: don't check hwaddr length if parsing as ARPHRD_VOID
- utils: added find and insert var array utils, cleanup
- client: add show-policy command calling policy generation
- client: initial support to generate a basic policy directly
- client: cleanup convert and show-config commands</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1582718400">- version 0.6.62
- dhcp4: discard lease on client-id mismatch (CVE-2020-7217,bsc#1160906)
- dhcp4: free lease on response without message type (CVE-2020-7216,bsc#1160905)
- dhcp6: don't add free'd IA to ia_pd_list on T1&gt;T2 (CVE-2019-18903,bsc#1160904)
- dhcp6: fix use-after-free on option parsing failure (CVE-2019-18902,bsc#1160903)
- utils: don't reject NULL var array names/keys breaking wicked duid dump
- routes: schema fix to avoid not applying rto_min incl. new time format (bsc#1160939)
- systemd: order start wicked after network-pre.target and openvswitch.service start
- packaging: use pkgconfig(libsystemd) instead of systemd-devel
- misc bug fixes by Malte Kraus including undefined behaviour, memory access alignment
- corrections, use-after-free, missed initialization and format errors</changelog>
  <changelog author="mt@suse.com" date="1583323200">- version 0.6.63
- spec: fix old libwicked package provides/obsoletes (bsc#1165180)
- ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1601467200">- version 0.6.64
- avoid incomplete ifdown/timeout on route deletion error (bsc#1174099)
- dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770)
- wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082)
- team: fix schema to use correct hwaddr_policy property (boo#1171234)
- team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556)</changelog>
  <changelog author="mt@suse.com" date="1614859200">- version 0.6.65
- ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215)
- client: parse sysctl files in the correct order (bsc#1181186)
- ifup: fix for set up with unenslave from unconfigured master (boo#954329)
- rpm: prepare for new builds using usrmerged rpm macro (boo#1029961)
- rpm: Let wicked-service also provide service(network)
- cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815)
- dbus: add variant container, generic object-path and uint32 array macros</changelog>
  <changelog author="mt@suse.com" date="1617796800">- dhcp4: discover on reboot timeout after start-delay (bsc#1181812)
  [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
- dhcp6: request nis options on sle15 by default (bsc#1181812)
  [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1623758400">- version 0.6.66
- wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920)
  - support multiple networks configurations per interface
  - show connection status and scan-results (bsc#1160654)
  - corrected eap-tls,ttls cetificate handling and open vs. shared
    wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592)
  - cleanups and several other improvements, see changes
  - updated man ifcfg-wireless manual pages
- nanny: fix identify node owner exit condition
- schema: several xml-schema and dbus/property improvements
- utils: format/parse bitmap to array and string alternatives
- client: expose ethtool --get-permanent-address option
- removed sle15-sp3 patches included in the master sources (bsc#1181812)
  [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
  [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1633089600">- version 0.6.67
- dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750)
- logging: log reaped sub-process command and as debug, not error
- ifstatus: Don't show link as "up" without RUNNING flag set
- firewalld: Make the zone assignment permanent (boo#1189560)
- fsm: cleanup and improve ifconfig and ifpolicy access utils
- dbus: cleanup the dbus-service.h file and unused property macros
- cleanup: applied code-spell run typo corrections
- dracut: initial fixes and improved option handling (boo#1182227)</changelog>
  <changelog author="mt@suse.com" date="1636027200">- dbus: config files in /usr shouldn't be marked as config in spec</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1640088000">- version 0.6.68
- sysctl: process sysctl.d directories as in sysctl --system
- sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357)
- dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353)
- cleanup: warnings, time calculations and dhcp fixes (bsc#1188019)
- wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495)
- tuntap: avoid sysfs attr read error (bsc#1192311)
- ifstatus: fix warning of unexpected interface flag combination (bsc#1192164)</changelog>
  <changelog author="mt@suse.com" date="1642593600">- fsm: fix device rename via yast (bsc#1194392)
  Reset worker config instead to reject a NULL/empty config
  xml node -- introduced in wicked 0.6.67 by commit c2a0385.
  [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1666267200">- version 0.6.70
- build: Link as Position Independent Executable (bsc#1184124)
- dhcp4: Fix issues in reuse of last lease (bsc#1187655)
- dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307)
- dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b)
- dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03)
- dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924)
- team: Fix to configure port priority in teamd (bsc#1200505)
- firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950)
- wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931)
- wireless: Add support for WPA3 and PMF (bsc#1198894)
- wireless: Remove libiw dependencies (gh#openSUSE/wicked#910)
- client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919)
- client: Add release options to ifdown/ifreload (jsc#SLE-10249)
- dbus: Clear string array before append (gh#openSUSE/wicked#913)
- socket: Fix SEGV on heavy socket restart errors (bsc#1192508)
- systemd: Remove systemd-udev-settle dependency (bsc#1186787)
- version 0.6.69
- redfish: decode smbios and setup host interface
  Add initial support to decode the SMBIOS Management Controller Host
  Interface (Type 42) structure and expose it as wicked `firmware:redfish`
  configuration to setup a Host Network Interface (to the BMC) using the
  `Redfish over IP` protocol allowing access to the Redfish Service (via
  redfish-localhost in /etc/hosts) used to manage the computer system.
  Tech Preview (jsc#SLE-17762).
- buffer: fix size_t length downcast to uint, add guards to init functions
- wireless: fix to not expect colons in 64byte long wpa-psk hex hash string
- xml-schema: reference counting fix to not crash at exit on schema errors
- compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl,
  remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5.
- compat-suse: fix reading of sysctl addr_gen_mode to wrong variable
- auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429)
- removed obsolete patch included in the master sources (bsc#1194392)
  [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
</package>
<package pkgid="4f411f0b53c223a6535fc798c519ff954ba9591869f94d071b7a6c3608fb83df" name="wicked-service" arch="aarch64">
  <version epoch="0" ver="0.6.70" rel="150300.4.8.1"/>
  <changelog author="mt@suse.de" date="1540555200">- version 0.6.51
- wireless: fix eap peap auth mapping for wpa-supplicant (bsc#1026807)
- vxlan: fix to convert dst_port to network byte order</changelog>
  <changelog author="mt@suse.de" date="1542369600">- version 0.6.52
- wickedd: fix netdev detection bootstrap race (bsc#1107579)
- compat: fix ifcfg parsing crash if network/config is missed</changelog>
  <changelog author="rtorreromarijnissen@suse.de" date="1548331200">- version 0.6.53
- dhcp: request hostname/fqdn option in the tester (bsc#1118378)
- build: link with relro by default for binary hardening</changelog>
  <changelog author="mt@suse.de" date="1554465600">- version 0.6.54
- switch to use systemd notify and prevent event backlog at start
  by calling udevadm settle before starting wickedd (bsc#1118206)
- dhcp6: don't discard confirm reply without status (bsc#1127340)
- ethtool: set lro legacy flag and not txvlan (bsc#1123555)
- init memory before use in ioctl
- fsm: fix find pending worker loop segfault (boo#1106809)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1565784000">- version 0.6.55
- dhcp6: do not default to a /64 address prefix-length (bsc#1132280)
  Add an address-length aka DHCLIENT6_ADDRESS_LENGTH ifcfg option, which
  permits to specify explicit prefix-length to use for the DHCPv6 address
  and override detection using RA prefix info and a default to /128.
- time: use boot time for timer instead of real time (bsc#1129986)
- dhcp: Consistently log dhcp xid and enabled to log dhcp6 timings line.
- dhcp6: lower unexpected xid messages to debug level
- systemd: change to depend on udev settle service (bsc#1136034,bsc#1132774)
  Calling udevadm settle directly caused systemd to kill wicked services.
- bridge: honour ifcfg LLADDR and set link address (bsc#1042123,boo#1142670)
- rfkill: fix switch statement to check enum variable not a constant (bsc#1140117)
- man: ifcfg-ovs-bridge(5): recommend STARTMODE=nfsroot
- dhcp4: nullify defer timer pointer when timeout (openSUSE/wicked#798,bsc#1142214)
- dhcp4: fix to request routing options when custom options are used (bsc#1132326)
- testing: add ifbind.sh helper script allowing to test hotplugging</changelog>
  <changelog author="mt@suse.com" date="1567771200">- version 0.6.56
- dhcp6: initial support to request prefix for delegations (jsc#SLE-5936)
- dhcp6: set the noprefixroute address option (bsc#1132280)</changelog>
  <changelog author="mt@suse.com" date="1568894400">- version 0.6.57
- dhcp6: omit noprefixroute with address-length (bsc#1150972)
  Permit to assume that the address prefix-length override specified
  in the config is a valid on-link prefix length, to let the kernel
  create a route for this prefix.
- dhcp6: differentiated mode=auto resolving from RA (bsc#1150183)
  Fixed to not trigger to report an error when ipv6 RA is not
  available or the received RA disables dhcp while mode is set to
  auto, but to deliver a 'deferred' results.</changelog>
  <changelog author="mt@suse.com" date="1570190400">- version 0.6.60
- libwicked: fix versioning and packaging (bsc#1143182,bsc#1132977)
  shipping the internal helper library inside of the wicked package.</changelog>
  <changelog author="mt@suse.com" date="1576065600">- version 0.6.61
- dracut: add initial cmdline parsing as a config source
- address: don't check hwaddr length if parsing as ARPHRD_VOID
- utils: added find and insert var array utils, cleanup
- client: add show-policy command calling policy generation
- client: initial support to generate a basic policy directly
- client: cleanup convert and show-config commands</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1582718400">- version 0.6.62
- dhcp4: discard lease on client-id mismatch (CVE-2020-7217,bsc#1160906)
- dhcp4: free lease on response without message type (CVE-2020-7216,bsc#1160905)
- dhcp6: don't add free'd IA to ia_pd_list on T1&gt;T2 (CVE-2019-18903,bsc#1160904)
- dhcp6: fix use-after-free on option parsing failure (CVE-2019-18902,bsc#1160903)
- utils: don't reject NULL var array names/keys breaking wicked duid dump
- routes: schema fix to avoid not applying rto_min incl. new time format (bsc#1160939)
- systemd: order start wicked after network-pre.target and openvswitch.service start
- packaging: use pkgconfig(libsystemd) instead of systemd-devel
- misc bug fixes by Malte Kraus including undefined behaviour, memory access alignment
- corrections, use-after-free, missed initialization and format errors</changelog>
  <changelog author="mt@suse.com" date="1583323200">- version 0.6.63
- spec: fix old libwicked package provides/obsoletes (bsc#1165180)
- ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1601467200">- version 0.6.64
- avoid incomplete ifdown/timeout on route deletion error (bsc#1174099)
- dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770)
- wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082)
- team: fix schema to use correct hwaddr_policy property (boo#1171234)
- team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556)</changelog>
  <changelog author="mt@suse.com" date="1614859200">- version 0.6.65
- ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215)
- client: parse sysctl files in the correct order (bsc#1181186)
- ifup: fix for set up with unenslave from unconfigured master (boo#954329)
- rpm: prepare for new builds using usrmerged rpm macro (boo#1029961)
- rpm: Let wicked-service also provide service(network)
- cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815)
- dbus: add variant container, generic object-path and uint32 array macros</changelog>
  <changelog author="mt@suse.com" date="1617796800">- dhcp4: discover on reboot timeout after start-delay (bsc#1181812)
  [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
- dhcp6: request nis options on sle15 by default (bsc#1181812)
  [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1623758400">- version 0.6.66
- wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920)
  - support multiple networks configurations per interface
  - show connection status and scan-results (bsc#1160654)
  - corrected eap-tls,ttls cetificate handling and open vs. shared
    wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592)
  - cleanups and several other improvements, see changes
  - updated man ifcfg-wireless manual pages
- nanny: fix identify node owner exit condition
- schema: several xml-schema and dbus/property improvements
- utils: format/parse bitmap to array and string alternatives
- client: expose ethtool --get-permanent-address option
- removed sle15-sp3 patches included in the master sources (bsc#1181812)
  [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
  [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1633089600">- version 0.6.67
- dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750)
- logging: log reaped sub-process command and as debug, not error
- ifstatus: Don't show link as "up" without RUNNING flag set
- firewalld: Make the zone assignment permanent (boo#1189560)
- fsm: cleanup and improve ifconfig and ifpolicy access utils
- dbus: cleanup the dbus-service.h file and unused property macros
- cleanup: applied code-spell run typo corrections
- dracut: initial fixes and improved option handling (boo#1182227)</changelog>
  <changelog author="mt@suse.com" date="1636027200">- dbus: config files in /usr shouldn't be marked as config in spec</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1640088000">- version 0.6.68
- sysctl: process sysctl.d directories as in sysctl --system
- sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357)
- dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353)
- cleanup: warnings, time calculations and dhcp fixes (bsc#1188019)
- wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495)
- tuntap: avoid sysfs attr read error (bsc#1192311)
- ifstatus: fix warning of unexpected interface flag combination (bsc#1192164)</changelog>
  <changelog author="mt@suse.com" date="1642593600">- fsm: fix device rename via yast (bsc#1194392)
  Reset worker config instead to reject a NULL/empty config
  xml node -- introduced in wicked 0.6.67 by commit c2a0385.
  [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1666267200">- version 0.6.70
- build: Link as Position Independent Executable (bsc#1184124)
- dhcp4: Fix issues in reuse of last lease (bsc#1187655)
- dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307)
- dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b)
- dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03)
- dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924)
- team: Fix to configure port priority in teamd (bsc#1200505)
- firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950)
- wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931)
- wireless: Add support for WPA3 and PMF (bsc#1198894)
- wireless: Remove libiw dependencies (gh#openSUSE/wicked#910)
- client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919)
- client: Add release options to ifdown/ifreload (jsc#SLE-10249)
- dbus: Clear string array before append (gh#openSUSE/wicked#913)
- socket: Fix SEGV on heavy socket restart errors (bsc#1192508)
- systemd: Remove systemd-udev-settle dependency (bsc#1186787)
- version 0.6.69
- redfish: decode smbios and setup host interface
  Add initial support to decode the SMBIOS Management Controller Host
  Interface (Type 42) structure and expose it as wicked `firmware:redfish`
  configuration to setup a Host Network Interface (to the BMC) using the
  `Redfish over IP` protocol allowing access to the Redfish Service (via
  redfish-localhost in /etc/hosts) used to manage the computer system.
  Tech Preview (jsc#SLE-17762).
- buffer: fix size_t length downcast to uint, add guards to init functions
- wireless: fix to not expect colons in 64byte long wpa-psk hex hash string
- xml-schema: reference counting fix to not crash at exit on schema errors
- compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl,
  remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5.
- compat-suse: fix reading of sysctl addr_gen_mode to wrong variable
- auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429)
- removed obsolete patch included in the master sources (bsc#1194392)
  [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
</package>
<package pkgid="7ea1fd0017aa6fd1ce3af1ae575a7272aff5c6c432d2004be6266a6f87e29e03" name="wicked-service" arch="x86_64">
  <version epoch="0" ver="0.6.70" rel="150300.4.8.1"/>
  <changelog author="mt@suse.de" date="1540555200">- version 0.6.51
- wireless: fix eap peap auth mapping for wpa-supplicant (bsc#1026807)
- vxlan: fix to convert dst_port to network byte order</changelog>
  <changelog author="mt@suse.de" date="1542369600">- version 0.6.52
- wickedd: fix netdev detection bootstrap race (bsc#1107579)
- compat: fix ifcfg parsing crash if network/config is missed</changelog>
  <changelog author="rtorreromarijnissen@suse.de" date="1548331200">- version 0.6.53
- dhcp: request hostname/fqdn option in the tester (bsc#1118378)
- build: link with relro by default for binary hardening</changelog>
  <changelog author="mt@suse.de" date="1554465600">- version 0.6.54
- switch to use systemd notify and prevent event backlog at start
  by calling udevadm settle before starting wickedd (bsc#1118206)
- dhcp6: don't discard confirm reply without status (bsc#1127340)
- ethtool: set lro legacy flag and not txvlan (bsc#1123555)
- init memory before use in ioctl
- fsm: fix find pending worker loop segfault (boo#1106809)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1565784000">- version 0.6.55
- dhcp6: do not default to a /64 address prefix-length (bsc#1132280)
  Add an address-length aka DHCLIENT6_ADDRESS_LENGTH ifcfg option, which
  permits to specify explicit prefix-length to use for the DHCPv6 address
  and override detection using RA prefix info and a default to /128.
- time: use boot time for timer instead of real time (bsc#1129986)
- dhcp: Consistently log dhcp xid and enabled to log dhcp6 timings line.
- dhcp6: lower unexpected xid messages to debug level
- systemd: change to depend on udev settle service (bsc#1136034,bsc#1132774)
  Calling udevadm settle directly caused systemd to kill wicked services.
- bridge: honour ifcfg LLADDR and set link address (bsc#1042123,boo#1142670)
- rfkill: fix switch statement to check enum variable not a constant (bsc#1140117)
- man: ifcfg-ovs-bridge(5): recommend STARTMODE=nfsroot
- dhcp4: nullify defer timer pointer when timeout (openSUSE/wicked#798,bsc#1142214)
- dhcp4: fix to request routing options when custom options are used (bsc#1132326)
- testing: add ifbind.sh helper script allowing to test hotplugging</changelog>
  <changelog author="mt@suse.com" date="1567771200">- version 0.6.56
- dhcp6: initial support to request prefix for delegations (jsc#SLE-5936)
- dhcp6: set the noprefixroute address option (bsc#1132280)</changelog>
  <changelog author="mt@suse.com" date="1568894400">- version 0.6.57
- dhcp6: omit noprefixroute with address-length (bsc#1150972)
  Permit to assume that the address prefix-length override specified
  in the config is a valid on-link prefix length, to let the kernel
  create a route for this prefix.
- dhcp6: differentiated mode=auto resolving from RA (bsc#1150183)
  Fixed to not trigger to report an error when ipv6 RA is not
  available or the received RA disables dhcp while mode is set to
  auto, but to deliver a 'deferred' results.</changelog>
  <changelog author="mt@suse.com" date="1570190400">- version 0.6.60
- libwicked: fix versioning and packaging (bsc#1143182,bsc#1132977)
  shipping the internal helper library inside of the wicked package.</changelog>
  <changelog author="mt@suse.com" date="1576065600">- version 0.6.61
- dracut: add initial cmdline parsing as a config source
- address: don't check hwaddr length if parsing as ARPHRD_VOID
- utils: added find and insert var array utils, cleanup
- client: add show-policy command calling policy generation
- client: initial support to generate a basic policy directly
- client: cleanup convert and show-config commands</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1582718400">- version 0.6.62
- dhcp4: discard lease on client-id mismatch (CVE-2020-7217,bsc#1160906)
- dhcp4: free lease on response without message type (CVE-2020-7216,bsc#1160905)
- dhcp6: don't add free'd IA to ia_pd_list on T1&gt;T2 (CVE-2019-18903,bsc#1160904)
- dhcp6: fix use-after-free on option parsing failure (CVE-2019-18902,bsc#1160903)
- utils: don't reject NULL var array names/keys breaking wicked duid dump
- routes: schema fix to avoid not applying rto_min incl. new time format (bsc#1160939)
- systemd: order start wicked after network-pre.target and openvswitch.service start
- packaging: use pkgconfig(libsystemd) instead of systemd-devel
- misc bug fixes by Malte Kraus including undefined behaviour, memory access alignment
- corrections, use-after-free, missed initialization and format errors</changelog>
  <changelog author="mt@suse.com" date="1583323200">- version 0.6.63
- spec: fix old libwicked package provides/obsoletes (bsc#1165180)
- ipv6: support to apply stable secret ifsysctl (jsc#SLE-6960)</changelog>
  <changelog author="rtorreromarijnissen@suse.com" date="1601467200">- version 0.6.64
- avoid incomplete ifdown/timeout on route deletion error (bsc#1174099)
- dhcp4: add DHCLIENT_CREATE_CID to ifcfg (jsc#SLE-15770)
- wicked: fixes to ifreload on port changes (bsc#1168155,bsc#1172082)
- team: fix schema to use correct hwaddr_policy property (boo#1171234)
- team: enable ipv6 on ports when nsna_ping linkwatch is used (bsc#959556)</changelog>
  <changelog author="mt@suse.com" date="1614859200">- version 0.6.65
- ifconfig: differentiate if to re-trigger dad on address updates (bsc#1177215)
- client: parse sysctl files in the correct order (bsc#1181186)
- ifup: fix for set up with unenslave from unconfigured master (boo#954329)
- rpm: prepare for new builds using usrmerged rpm macro (boo#1029961)
- rpm: Let wicked-service also provide service(network)
- cleanup: remove obsolete use-nanny=false (gh#openSUSE/wicked#815)
- dbus: add variant container, generic object-path and uint32 array macros</changelog>
  <changelog author="mt@suse.com" date="1617796800">- dhcp4: discover on reboot timeout after start-delay (bsc#1181812)
  [+ 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
- dhcp6: request nis options on sle15 by default (bsc#1181812)
  [+ 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1623758400">- version 0.6.66
- wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920)
  - support multiple networks configurations per interface
  - show connection status and scan-results (bsc#1160654)
  - corrected eap-tls,ttls cetificate handling and open vs. shared
    wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592)
  - cleanups and several other improvements, see changes
  - updated man ifcfg-wireless manual pages
- nanny: fix identify node owner exit condition
- schema: several xml-schema and dbus/property improvements
- utils: format/parse bitmap to array and string alternatives
- client: expose ethtool --get-permanent-address option
- removed sle15-sp3 patches included in the master sources (bsc#1181812)
  [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
  [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]</changelog>
  <changelog author="mt@suse.com" date="1633089600">- version 0.6.67
- dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750)
- logging: log reaped sub-process command and as debug, not error
- ifstatus: Don't show link as "up" without RUNNING flag set
- firewalld: Make the zone assignment permanent (boo#1189560)
- fsm: cleanup and improve ifconfig and ifpolicy access utils
- dbus: cleanup the dbus-service.h file and unused property macros
- cleanup: applied code-spell run typo corrections
- dracut: initial fixes and improved option handling (boo#1182227)</changelog>
  <changelog author="mt@suse.com" date="1636027200">- dbus: config files in /usr shouldn't be marked as config in spec</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1640088000">- version 0.6.68
- sysctl: process sysctl.d directories as in sysctl --system
- sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357)
- dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353)
- cleanup: warnings, time calculations and dhcp fixes (bsc#1188019)
- wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495)
- tuntap: avoid sysfs attr read error (bsc#1192311)
- ifstatus: fix warning of unexpected interface flag combination (bsc#1192164)</changelog>
  <changelog author="mt@suse.com" date="1642593600">- fsm: fix device rename via yast (bsc#1194392)
  Reset worker config instead to reject a NULL/empty config
  xml node -- introduced in wicked 0.6.67 by commit c2a0385.
  [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1666267200">- version 0.6.70
- build: Link as Position Independent Executable (bsc#1184124)
- dhcp4: Fix issues in reuse of last lease (bsc#1187655)
- dhcp6: Add option to refresh lease (jsc#SLE-9492,jsc#SLE-24307)
- dhcp6: Remove address before release (USGv6 DHCPv6_1_2_07b)
- dhcp6: Ignore lease release status (USGv6 DHCPv6_1_2_07e,1_3_03)
- dhcp6: Consider ppp interfaces supported (gh#openSUSE/wicked#924)
- team: Fix to configure port priority in teamd (bsc#1200505)
- firewall-ext: No config change on ifdown (bsc#1201053,bsc#118950)
- wireless: Fix SEGV on supplicant restart (gh#openSUSE/wicked#931)
- wireless: Add support for WPA3 and PMF (bsc#1198894)
- wireless: Remove libiw dependencies (gh#openSUSE/wicked#910)
- client: Fix SEGV on empty xpath results (gh#openSUSE/wicked#919)
- client: Add release options to ifdown/ifreload (jsc#SLE-10249)
- dbus: Clear string array before append (gh#openSUSE/wicked#913)
- socket: Fix SEGV on heavy socket restart errors (bsc#1192508)
- systemd: Remove systemd-udev-settle dependency (bsc#1186787)
- version 0.6.69
- redfish: decode smbios and setup host interface
  Add initial support to decode the SMBIOS Management Controller Host
  Interface (Type 42) structure and expose it as wicked `firmware:redfish`
  configuration to setup a Host Network Interface (to the BMC) using the
  `Redfish over IP` protocol allowing access to the Redfish Service (via
  redfish-localhost in /etc/hosts) used to manage the computer system.
  Tech Preview (jsc#SLE-17762).
- buffer: fix size_t length downcast to uint, add guards to init functions
- wireless: fix to not expect colons in 64byte long wpa-psk hex hash string
- xml-schema: reference counting fix to not crash at exit on schema errors
- compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl,
  remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5.
- compat-suse: fix reading of sysctl addr_gen_mode to wrong variable
- auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429)
- removed obsolete patch included in the master sources (bsc#1194392)
  [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]</changelog>
</package>
<package pkgid="e3cc79275f06a0bc13fd1676e84eb242cd35de74a83dc179b4d741349451dc78" name="wpa_supplicant" arch="aarch64">
  <version epoch="0" ver="2.9" rel="4.33.1"/>
  <changelog author="kbabioch@suse.com" date="1539259200">- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch:
  Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).</changelog>
  <changelog author="kbabioch@suse.com" date="1539345600">- Added wpa-supplicant-log-file-permission.patch: Fixes the default file
  permissions of the debug log file to more sane values, i.e. it is no longer
  world-readable (bsc#1098854).
- Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with
  O_CLOEXEC, which will prevent file descriptor leaking to child processes
  (bsc#1098854).</changelog>
  <changelog author="ro@suse.de" date="1539604800">- compile eapol_test binary to allow testing via radius proxy and server
  (note: this does not match CONFIG_EAPOL_TEST which sets -Werror
  and activates an assert call inside the code of wpa_supplicant)
  (bsc#1111873), (fate#326725)
- add patch to fix wrong operator precedence in ieee802_11.c
  wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
- add patch to avoid redefinition of __bitwise macro
  wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1539691200">- Renamed patches:
  - wpa-supplicant-log-file-permission.patch -&gt; wpa_supplicant-log-file-permission.patch
  - wpa-supplicant-log-file-cloexec.patch -&gt; wpa_supplicant-log-file-cloexec.patch
- wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag
- Enabled timestamps in log files (bsc#1080798)</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1541160000">- Refresh spec-file: add %license tag.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1564401600">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Change URL and Source0 to actual project homepage.
  * Remove macro %{?systemd_requires} and rm (not needed).
  * Add %autopatch macro.
  * Add %make_build macro.
- Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1).
- Changed service-files for start after network (systemd-networkd).</changelog>
  <changelog author="tchvatal@suse.com" date="1572868800">- Update to 2.9 release:
  * SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * EAP-pwd changes
  - disable use of groups using Brainpool curves
  - allow the set of groups to be configured (eap_pwd_groups)
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * fixed FT-EAP initial mobility domain association using PMKSA caching
    (disabled by default for backwards compatibility; can be enabled
    with ft_eap_pmksa_caching=1)
  * fixed a regression in OpenSSL 1.1+ engine loading
  * added validation of RSNE in (Re)Association Response frames
  * fixed DPP bootstrapping URI parser of channel list
  * extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  * extended ca_cert_blob to support PEM format
  * improved robustness of P2P Action frame scheduling
  * added support for EAP-SIM/AKA using anonymous@realm identity
  * fixed Hotspot 2.0 credential selection based on roaming consortium
    to ignore credentials without a specific EAP method
  * added experimental support for EAP-TEAP peer (RFC 7170)
  * added experimental support for EAP-TLS peer with TLS v1.3
  * fixed a regression in WMM parameter configuration for a TDLS peer
  * fixed a regression in operation with drivers that offload 802.1X
    4-way handshake
  * fixed an ECDH operation corner case with OpenSSL
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only groups 19, 20, 21
    (i.e., disable groups 25 and 26) and disable all unsuitable groups
    completely based on REVmd changes
  - do not regenerate PWE unnecessarily when the AP uses the
    anti-clogging token mechanisms
  - fixed some association cases where both SAE and FT-SAE were enabled
    on both the station and the selected AP
  - started to prefer FT-SAE over SAE AKM if both are enabled
  - started to prefer FT-SAE over FT-PSK if both are enabled
  - fixed FT-SAE when SAE PMKSA caching is used
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  - verify server scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,
    CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  - SAE/EAP-pwd side-channel attack update
    [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  * Hotspot 2.0 changes
  - do not indicate release number that is higher than the one
    AP supports
  - added support for release number 3
  - enable PMF automatically for network profiles created from
    credentials
  * fixed OWE network profile saving
  * fixed DPP network profile saving
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and network profile parameter ocv=1)
  * added Multi-AP backhaul STA support
  * fixed build with LibreSSL
  * number of MKA/MACsec fixes and extensions
  * extended domain_match and domain_suffix_match to allow list of values
  * fixed dNSName matching in domain_match and domain_suffix_match when
    using wolfSSL
  * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
    are enabled
  * extended nl80211 Connect and external authentication to support
    SAE, FT-SAE, FT-EAP-SHA384
  * fixed KEK2 derivation for FILS+FT
  * extended client_cert file to allow loading of a chain of PEM
    encoded certificates
  * extended beacon reporting functionality
  * extended D-Bus interface with number of new properties
  * fixed a regression in FT-over-DS with mac80211-based drivers
  * OpenSSL: allow systemwide policies to be overridden
  * extended driver flags indication for separate 802.1X and PSK
    4-way handshake offload capability
  * added support for random P2P Device/Interface Address use
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
  * extended domain_match and domain_suffix_match to allow list of values
  * added a RSN workaround for misbehaving PMF APs that advertise
    IGTK/BIP KeyID using incorrect byte order
  * fixed PTK rekeying with FILS and FT
  * fixed WPA packet number reuse with replayed messages and key
    reinstallation
    [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
    CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
    CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
  * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
    [https://w1.fi/security/2018-1/] (CVE-2018-14526)
  * added support for FILS (IEEE 802.11ai) shared key authentication
  * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
    and transition mode defined by WFA)
  * added support for DPP (Wi-Fi Device Provisioning Protocol)
  * added support for RSA 3k key case with Suite B 192-bit level
  * fixed Suite B PMKSA caching not to update PMKID during each 4-way
    handshake
  * fixed EAP-pwd pre-processing with PasswordHashHash
  * added EAP-pwd client support for salted passwords
  * fixed a regression in TDLS prohibited bit validation
  * started to use estimated throughput to avoid undesired signal
    strength based roaming decision
  * MACsec/MKA:
  - new macsec_linux driver interface support for the Linux
    kernel macsec module
  - number of fixes and extensions
  * added support for external persistent storage of PMKSA cache
    (PMKSA_GET/PMKSA_ADD control interface commands; and
    MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
  * fixed mesh channel configuration pri/sec switch case
  * added support for beacon report
  * large number of other fixes, cleanup, and extensions
  * added support for randomizing local address for GAS queries
    (gas_rand_mac_addr parameter)
  * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
  * added option for using random WPS UUID (auto_uuid=1)
  * added SHA256-hash support for OCSP certificate matching
  * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
  * fixed a regression in RSN pre-authentication candidate selection
  * added option to configure allowed group management cipher suites
    (group_mgmt network profile parameter)
  * removed all PeerKey functionality
  * fixed nl80211 AP and mesh mode configuration regression with
    Linux 4.15 and newer
  * added ap_isolate configuration option for AP mode
  * added support for nl80211 to offload 4-way handshake into the driver
  * added support for using wolfSSL cryptographic library
  * SAE
  - added support for configuring SAE password separately of the
    WPA2 PSK/passphrase
  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
    for SAE;
    note: this is not backwards compatible, i.e., both the AP and
    station side implementations will need to be update at the same
    time to maintain interoperability
  - added support for Password Identifier
  - fixed FT-SAE PMKID matching
  * Hotspot 2.0
  - added support for fetching of Operator Icon Metadata ANQP-element
  - added support for Roaming Consortium Selection element
  - added support for Terms and Conditions
  - added support for OSEN connection in a shared RSN BSS
  - added support for fetching Venue URL information
  * added support for using OpenSSL 1.1.1
  * FT
  - disabled PMKSA caching with FT since it is not fully functional
  - added support for SHA384 based AKM
  - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
    BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
  - fixed additional IE inclusion in Reassociation Request frame when
    using FT protocol
- Drop merged patches:
  * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
  * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
  * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
  * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
  * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
  * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
  * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
  * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
  * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
  * wpa_supplicant-bnc-1099835-fix-private-key-password.patch
  * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
  * wpa_supplicant-log-file-permission.patch
  * wpa_supplicant-log-file-cloexec.patch
  * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
  * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch
- Rebase patches:
  * wpa_supplicant-getrandom.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1582891200">- Adjust the service to start after network.target wrt bsc#1165266</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1585224000">- Change wpa_supplicant.service to ensure wpa_supplicant gets started before
  network. Fix WLAN config on boot with wicked. (boo#1166933)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1585224001">- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)</changelog>
  <changelog author="bwiedemann@suse.com" date="1587124800">- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920)
- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1587643200">- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
  (bsc#1150934)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600776000">- Enable SAE support(jsc#SLE-14992).</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1600776001">- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build</changelog>
  <changelog author="sp1ritCS@protonmail.com" date="1601985600">- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size
  (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1612440000">- Add CVE-2021-0326.patch -- P2P group information processing vulnerability
  (bsc#1181777)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614427200">- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability
  (bsc#1182805)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614772800">- Fix systemd device ready dependencies in wpa_supplicant@.service file.
  (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1617710400">- Add CVE-2021-30004.patch -- forging attacks may occur because
  AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
  (bsc#1184348)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1644494400">- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch,
  CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch
  SAE/EAP-pwd side-channel attack update 2
  (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)</changelog>
</package>
<package pkgid="eda2714b141df8a5b58fc6f2986205f639bd1cb549e20def7dd9bdaed3bff304" name="wpa_supplicant" arch="src">
  <version epoch="0" ver="2.9" rel="4.33.1"/>
  <changelog author="kbabioch@suse.com" date="1539259200">- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch:
  Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).</changelog>
  <changelog author="kbabioch@suse.com" date="1539345600">- Added wpa-supplicant-log-file-permission.patch: Fixes the default file
  permissions of the debug log file to more sane values, i.e. it is no longer
  world-readable (bsc#1098854).
- Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with
  O_CLOEXEC, which will prevent file descriptor leaking to child processes
  (bsc#1098854).</changelog>
  <changelog author="ro@suse.de" date="1539604800">- compile eapol_test binary to allow testing via radius proxy and server
  (note: this does not match CONFIG_EAPOL_TEST which sets -Werror
  and activates an assert call inside the code of wpa_supplicant)
  (bsc#1111873), (fate#326725)
- add patch to fix wrong operator precedence in ieee802_11.c
  wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
- add patch to avoid redefinition of __bitwise macro
  wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1539691200">- Renamed patches:
  - wpa-supplicant-log-file-permission.patch -&gt; wpa_supplicant-log-file-permission.patch
  - wpa-supplicant-log-file-cloexec.patch -&gt; wpa_supplicant-log-file-cloexec.patch
- wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag
- Enabled timestamps in log files (bsc#1080798)</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1541160000">- Refresh spec-file: add %license tag.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1564401600">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Change URL and Source0 to actual project homepage.
  * Remove macro %{?systemd_requires} and rm (not needed).
  * Add %autopatch macro.
  * Add %make_build macro.
- Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1).
- Changed service-files for start after network (systemd-networkd).</changelog>
  <changelog author="tchvatal@suse.com" date="1572868800">- Update to 2.9 release:
  * SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * EAP-pwd changes
  - disable use of groups using Brainpool curves
  - allow the set of groups to be configured (eap_pwd_groups)
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * fixed FT-EAP initial mobility domain association using PMKSA caching
    (disabled by default for backwards compatibility; can be enabled
    with ft_eap_pmksa_caching=1)
  * fixed a regression in OpenSSL 1.1+ engine loading
  * added validation of RSNE in (Re)Association Response frames
  * fixed DPP bootstrapping URI parser of channel list
  * extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  * extended ca_cert_blob to support PEM format
  * improved robustness of P2P Action frame scheduling
  * added support for EAP-SIM/AKA using anonymous@realm identity
  * fixed Hotspot 2.0 credential selection based on roaming consortium
    to ignore credentials without a specific EAP method
  * added experimental support for EAP-TEAP peer (RFC 7170)
  * added experimental support for EAP-TLS peer with TLS v1.3
  * fixed a regression in WMM parameter configuration for a TDLS peer
  * fixed a regression in operation with drivers that offload 802.1X
    4-way handshake
  * fixed an ECDH operation corner case with OpenSSL
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only groups 19, 20, 21
    (i.e., disable groups 25 and 26) and disable all unsuitable groups
    completely based on REVmd changes
  - do not regenerate PWE unnecessarily when the AP uses the
    anti-clogging token mechanisms
  - fixed some association cases where both SAE and FT-SAE were enabled
    on both the station and the selected AP
  - started to prefer FT-SAE over SAE AKM if both are enabled
  - started to prefer FT-SAE over FT-PSK if both are enabled
  - fixed FT-SAE when SAE PMKSA caching is used
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  - verify server scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,
    CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  - SAE/EAP-pwd side-channel attack update
    [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  * Hotspot 2.0 changes
  - do not indicate release number that is higher than the one
    AP supports
  - added support for release number 3
  - enable PMF automatically for network profiles created from
    credentials
  * fixed OWE network profile saving
  * fixed DPP network profile saving
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and network profile parameter ocv=1)
  * added Multi-AP backhaul STA support
  * fixed build with LibreSSL
  * number of MKA/MACsec fixes and extensions
  * extended domain_match and domain_suffix_match to allow list of values
  * fixed dNSName matching in domain_match and domain_suffix_match when
    using wolfSSL
  * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
    are enabled
  * extended nl80211 Connect and external authentication to support
    SAE, FT-SAE, FT-EAP-SHA384
  * fixed KEK2 derivation for FILS+FT
  * extended client_cert file to allow loading of a chain of PEM
    encoded certificates
  * extended beacon reporting functionality
  * extended D-Bus interface with number of new properties
  * fixed a regression in FT-over-DS with mac80211-based drivers
  * OpenSSL: allow systemwide policies to be overridden
  * extended driver flags indication for separate 802.1X and PSK
    4-way handshake offload capability
  * added support for random P2P Device/Interface Address use
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
  * extended domain_match and domain_suffix_match to allow list of values
  * added a RSN workaround for misbehaving PMF APs that advertise
    IGTK/BIP KeyID using incorrect byte order
  * fixed PTK rekeying with FILS and FT
  * fixed WPA packet number reuse with replayed messages and key
    reinstallation
    [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
    CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
    CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
  * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
    [https://w1.fi/security/2018-1/] (CVE-2018-14526)
  * added support for FILS (IEEE 802.11ai) shared key authentication
  * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
    and transition mode defined by WFA)
  * added support for DPP (Wi-Fi Device Provisioning Protocol)
  * added support for RSA 3k key case with Suite B 192-bit level
  * fixed Suite B PMKSA caching not to update PMKID during each 4-way
    handshake
  * fixed EAP-pwd pre-processing with PasswordHashHash
  * added EAP-pwd client support for salted passwords
  * fixed a regression in TDLS prohibited bit validation
  * started to use estimated throughput to avoid undesired signal
    strength based roaming decision
  * MACsec/MKA:
  - new macsec_linux driver interface support for the Linux
    kernel macsec module
  - number of fixes and extensions
  * added support for external persistent storage of PMKSA cache
    (PMKSA_GET/PMKSA_ADD control interface commands; and
    MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
  * fixed mesh channel configuration pri/sec switch case
  * added support for beacon report
  * large number of other fixes, cleanup, and extensions
  * added support for randomizing local address for GAS queries
    (gas_rand_mac_addr parameter)
  * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
  * added option for using random WPS UUID (auto_uuid=1)
  * added SHA256-hash support for OCSP certificate matching
  * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
  * fixed a regression in RSN pre-authentication candidate selection
  * added option to configure allowed group management cipher suites
    (group_mgmt network profile parameter)
  * removed all PeerKey functionality
  * fixed nl80211 AP and mesh mode configuration regression with
    Linux 4.15 and newer
  * added ap_isolate configuration option for AP mode
  * added support for nl80211 to offload 4-way handshake into the driver
  * added support for using wolfSSL cryptographic library
  * SAE
  - added support for configuring SAE password separately of the
    WPA2 PSK/passphrase
  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
    for SAE;
    note: this is not backwards compatible, i.e., both the AP and
    station side implementations will need to be update at the same
    time to maintain interoperability
  - added support for Password Identifier
  - fixed FT-SAE PMKID matching
  * Hotspot 2.0
  - added support for fetching of Operator Icon Metadata ANQP-element
  - added support for Roaming Consortium Selection element
  - added support for Terms and Conditions
  - added support for OSEN connection in a shared RSN BSS
  - added support for fetching Venue URL information
  * added support for using OpenSSL 1.1.1
  * FT
  - disabled PMKSA caching with FT since it is not fully functional
  - added support for SHA384 based AKM
  - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
    BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
  - fixed additional IE inclusion in Reassociation Request frame when
    using FT protocol
- Drop merged patches:
  * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
  * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
  * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
  * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
  * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
  * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
  * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
  * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
  * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
  * wpa_supplicant-bnc-1099835-fix-private-key-password.patch
  * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
  * wpa_supplicant-log-file-permission.patch
  * wpa_supplicant-log-file-cloexec.patch
  * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
  * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch
- Rebase patches:
  * wpa_supplicant-getrandom.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1582891200">- Adjust the service to start after network.target wrt bsc#1165266</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1585224000">- Change wpa_supplicant.service to ensure wpa_supplicant gets started before
  network. Fix WLAN config on boot with wicked. (boo#1166933)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1585224001">- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)</changelog>
  <changelog author="bwiedemann@suse.com" date="1587124800">- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920)
- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1587643200">- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
  (bsc#1150934)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600776000">- Enable SAE support(jsc#SLE-14992).</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1600776001">- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build</changelog>
  <changelog author="sp1ritCS@protonmail.com" date="1601985600">- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size
  (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1612440000">- Add CVE-2021-0326.patch -- P2P group information processing vulnerability
  (bsc#1181777)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614427200">- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability
  (bsc#1182805)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614772800">- Fix systemd device ready dependencies in wpa_supplicant@.service file.
  (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1617710400">- Add CVE-2021-30004.patch -- forging attacks may occur because
  AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
  (bsc#1184348)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1644494400">- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch,
  CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch
  SAE/EAP-pwd side-channel attack update 2
  (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)</changelog>
</package>
<package pkgid="cb69726a5bb89c7bdef531ef808b4e68f70a567af597aadf8b3208be76d9e4bf" name="wpa_supplicant" arch="x86_64">
  <version epoch="0" ver="2.9" rel="4.33.1"/>
  <changelog author="kbabioch@suse.com" date="1539259200">- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch:
  Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).</changelog>
  <changelog author="kbabioch@suse.com" date="1539345600">- Added wpa-supplicant-log-file-permission.patch: Fixes the default file
  permissions of the debug log file to more sane values, i.e. it is no longer
  world-readable (bsc#1098854).
- Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with
  O_CLOEXEC, which will prevent file descriptor leaking to child processes
  (bsc#1098854).</changelog>
  <changelog author="ro@suse.de" date="1539604800">- compile eapol_test binary to allow testing via radius proxy and server
  (note: this does not match CONFIG_EAPOL_TEST which sets -Werror
  and activates an assert call inside the code of wpa_supplicant)
  (bsc#1111873), (fate#326725)
- add patch to fix wrong operator precedence in ieee802_11.c
  wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
- add patch to avoid redefinition of __bitwise macro
  wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch</changelog>
  <changelog author="kbabioch@suse.com" date="1539691200">- Renamed patches:
  - wpa-supplicant-log-file-permission.patch -&gt; wpa_supplicant-log-file-permission.patch
  - wpa-supplicant-log-file-cloexec.patch -&gt; wpa_supplicant-log-file-cloexec.patch
- wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag
- Enabled timestamps in log files (bsc#1080798)</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1541160000">- Refresh spec-file: add %license tag.</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1564401600">- Refresh spec-file via spec-cleaner and manual optimizations.
  * Change URL and Source0 to actual project homepage.
  * Remove macro %{?systemd_requires} and rm (not needed).
  * Add %autopatch macro.
  * Add %make_build macro.
- Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1).
- Changed service-files for start after network (systemd-networkd).</changelog>
  <changelog author="tchvatal@suse.com" date="1572868800">- Update to 2.9 release:
  * SAE changes
  - disable use of groups using Brainpool curves
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * EAP-pwd changes
  - disable use of groups using Brainpool curves
  - allow the set of groups to be configured (eap_pwd_groups)
  - improved protection against side channel attacks
    [https://w1.fi/security/2019-6/]
  * fixed FT-EAP initial mobility domain association using PMKSA caching
    (disabled by default for backwards compatibility; can be enabled
    with ft_eap_pmksa_caching=1)
  * fixed a regression in OpenSSL 1.1+ engine loading
  * added validation of RSNE in (Re)Association Response frames
  * fixed DPP bootstrapping URI parser of channel list
  * extended EAP-SIM/AKA fast re-authentication to allow use with FILS
  * extended ca_cert_blob to support PEM format
  * improved robustness of P2P Action frame scheduling
  * added support for EAP-SIM/AKA using anonymous@realm identity
  * fixed Hotspot 2.0 credential selection based on roaming consortium
    to ignore credentials without a specific EAP method
  * added experimental support for EAP-TEAP peer (RFC 7170)
  * added experimental support for EAP-TLS peer with TLS v1.3
  * fixed a regression in WMM parameter configuration for a TDLS peer
  * fixed a regression in operation with drivers that offload 802.1X
    4-way handshake
  * fixed an ECDH operation corner case with OpenSSL
  * SAE changes
  - added support for SAE Password Identifier
  - changed default configuration to enable only groups 19, 20, 21
    (i.e., disable groups 25 and 26) and disable all unsuitable groups
    completely based on REVmd changes
  - do not regenerate PWE unnecessarily when the AP uses the
    anti-clogging token mechanisms
  - fixed some association cases where both SAE and FT-SAE were enabled
    on both the station and the selected AP
  - started to prefer FT-SAE over SAE AKM if both are enabled
  - started to prefer FT-SAE over FT-PSK if both are enabled
  - fixed FT-SAE when SAE PMKSA caching is used
  - reject use of unsuitable groups based on new implementation guidance
    in REVmd (allow only FFC groups with prime &gt;= 3072 bits and ECC
    groups with prime &gt;= 256)
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
  * EAP-pwd changes
  - minimize timing and memory use differences in PWE derivation
    [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
  - verify server scalar/element
    [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498,
    CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
  - fix message reassembly issue with unexpected fragment
    [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
  - enforce rand,mask generation rules more strictly
  - fix a memory leak in PWE derivation
  - disallow ECC groups with a prime under 256 bits (groups 25, 26, and
    27)
  - SAE/EAP-pwd side-channel attack update
    [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
  * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
  * Hotspot 2.0 changes
  - do not indicate release number that is higher than the one
    AP supports
  - added support for release number 3
  - enable PMF automatically for network profiles created from
    credentials
  * fixed OWE network profile saving
  * fixed DPP network profile saving
  * added support for RSN operating channel validation
    (CONFIG_OCV=y and network profile parameter ocv=1)
  * added Multi-AP backhaul STA support
  * fixed build with LibreSSL
  * number of MKA/MACsec fixes and extensions
  * extended domain_match and domain_suffix_match to allow list of values
  * fixed dNSName matching in domain_match and domain_suffix_match when
    using wolfSSL
  * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both
    are enabled
  * extended nl80211 Connect and external authentication to support
    SAE, FT-SAE, FT-EAP-SHA384
  * fixed KEK2 derivation for FILS+FT
  * extended client_cert file to allow loading of a chain of PEM
    encoded certificates
  * extended beacon reporting functionality
  * extended D-Bus interface with number of new properties
  * fixed a regression in FT-over-DS with mac80211-based drivers
  * OpenSSL: allow systemwide policies to be overridden
  * extended driver flags indication for separate 802.1X and PSK
    4-way handshake offload capability
  * added support for random P2P Device/Interface Address use
  * extended PEAP to derive EMSK to enable use with ERP/FILS
  * extended WPS to allow SAE configuration to be added automatically
    for PSK (wps_cred_add_sae=1)
  * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS)
  * extended domain_match and domain_suffix_match to allow list of values
  * added a RSN workaround for misbehaving PMF APs that advertise
    IGTK/BIP KeyID using incorrect byte order
  * fixed PTK rekeying with FILS and FT
  * fixed WPA packet number reuse with replayed messages and key
    reinstallation
    [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078,
    CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082,
    CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)
  * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant
    [https://w1.fi/security/2018-1/] (CVE-2018-14526)
  * added support for FILS (IEEE 802.11ai) shared key authentication
  * added support for OWE (Opportunistic Wireless Encryption, RFC 8110;
    and transition mode defined by WFA)
  * added support for DPP (Wi-Fi Device Provisioning Protocol)
  * added support for RSA 3k key case with Suite B 192-bit level
  * fixed Suite B PMKSA caching not to update PMKID during each 4-way
    handshake
  * fixed EAP-pwd pre-processing with PasswordHashHash
  * added EAP-pwd client support for salted passwords
  * fixed a regression in TDLS prohibited bit validation
  * started to use estimated throughput to avoid undesired signal
    strength based roaming decision
  * MACsec/MKA:
  - new macsec_linux driver interface support for the Linux
    kernel macsec module
  - number of fixes and extensions
  * added support for external persistent storage of PMKSA cache
    (PMKSA_GET/PMKSA_ADD control interface commands; and
    MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case)
  * fixed mesh channel configuration pri/sec switch case
  * added support for beacon report
  * large number of other fixes, cleanup, and extensions
  * added support for randomizing local address for GAS queries
    (gas_rand_mac_addr parameter)
  * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel
  * added option for using random WPS UUID (auto_uuid=1)
  * added SHA256-hash support for OCSP certificate matching
  * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure
  * fixed a regression in RSN pre-authentication candidate selection
  * added option to configure allowed group management cipher suites
    (group_mgmt network profile parameter)
  * removed all PeerKey functionality
  * fixed nl80211 AP and mesh mode configuration regression with
    Linux 4.15 and newer
  * added ap_isolate configuration option for AP mode
  * added support for nl80211 to offload 4-way handshake into the driver
  * added support for using wolfSSL cryptographic library
  * SAE
  - added support for configuring SAE password separately of the
    WPA2 PSK/passphrase
  - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection
    for SAE;
    note: this is not backwards compatible, i.e., both the AP and
    station side implementations will need to be update at the same
    time to maintain interoperability
  - added support for Password Identifier
  - fixed FT-SAE PMKID matching
  * Hotspot 2.0
  - added support for fetching of Operator Icon Metadata ANQP-element
  - added support for Roaming Consortium Selection element
  - added support for Terms and Conditions
  - added support for OSEN connection in a shared RSN BSS
  - added support for fetching Venue URL information
  * added support for using OpenSSL 1.1.1
  * FT
  - disabled PMKSA caching with FT since it is not fully functional
  - added support for SHA384 based AKM
  - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128,
    BIP-GMAC-256 in addition to previously supported BIP-CMAC-128
  - fixed additional IE inclusion in Reassociation Request frame when
    using FT protocol
- Drop merged patches:
  * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch
  * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch
  * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch
  * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch
  * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch
  * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch
  * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch
  * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch
  * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch
  * wpa_supplicant-bnc-1099835-fix-private-key-password.patch
  * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch
  * wpa_supplicant-log-file-permission.patch
  * wpa_supplicant-log-file-cloexec.patch
  * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch
  * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch
- Rebase patches:
  * wpa_supplicant-getrandom.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1582891200">- Adjust the service to start after network.target wrt bsc#1165266</changelog>
  <changelog author="ilya@ilya.pp.ua" date="1585224000">- Change wpa_supplicant.service to ensure wpa_supplicant gets started before
  network. Fix WLAN config on boot with wicked. (boo#1166933)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1585224001">- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)</changelog>
  <changelog author="bwiedemann@suse.com" date="1587124800">- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920)
- Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1587643200">- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass
  (bsc#1150934)</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600776000">- Enable SAE support(jsc#SLE-14992).</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1600776001">- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build</changelog>
  <changelog author="sp1ritCS@protonmail.com" date="1601985600">- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size
  (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1612440000">- Add CVE-2021-0326.patch -- P2P group information processing vulnerability
  (bsc#1181777)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614427200">- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability
  (bsc#1182805)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1614772800">- Fix systemd device ready dependencies in wpa_supplicant@.service file.
  (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1617710400">- Add CVE-2021-30004.patch -- forging attacks may occur because
  AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c
  (bsc#1184348)</changelog>
  <changelog author="cfamullaconrad@suse.com" date="1644494400">- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch,
  CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch
  SAE/EAP-pwd side-channel attack update 2
  (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)</changelog>
</package>
<package pkgid="18a34230abb66a54dcfce111a510ea0ca320e70f8245f5b0aacecda06bee3d73" name="xen" arch="src">
  <version epoch="0" ver="4.14.5_04" rel="150300.3.32.1"/>
  <changelog author="carnold@suse.com" date="1631016000">- bsc#1189632 - VUL-0: CVE-2021-28701: xen: Another race in
  XENMAPSPACE_grant_table handling (XSA-384)
  xsa384.patch
- Upstream bug fixes (bsc#1027519)
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6128a856-gnttab-radix-tree-node-init.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch (Replaces
    credit2-avoid-picking-a-spurious-idle-unit-when-caps-are-used.patch)
  6126339d-AMD-IOMMU-global-ER-extending.patch (Replaces xsa378-1.patch)
  6126344f-AMD-IOMMU-unity-map-handling.patch (Replaces xsa378-2.patch)
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch (Replaces xsa378-3.patch)
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch (Replaces xsa378-4.patch)
  6126349a-AMD-IOMMU-rearrange-reassignment.patch (Replaces xsa378-5.patch)
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch (Replaces xsa378-6.patch)
  612634c3-x86-p2m-introduce-p2m_is_special.patch (Replaces xsa378-7.patch)
  612634dc-x86-p2m-guard-identity-mappings.patch (Replaces xsa378-8.patch)
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch (Replaces xsa379.patch)
  6126350a-gnttab-release-mappings-preemption.patch (Replaces xsa380-1.patch
  6126351f-gnttab-replace-mapkind.patch (Replaces xsa380-2.patch)
  6126353d-gnttab-get-status-frames-array-capacity.patch (Replaces xsa382.patch)
  61263553-Arm-restrict-maxmem-for-dom0less.patch (Replaces xsa383.patch)</changelog>
  <changelog author="carnold@suse.com" date="1631534400">- Update to Xen 4.14.3 bug fix release (bsc#1027519)
  xen-4.14.3-testing-src.tar.bz2
- Drop patches contained in new tarball
  608676f2-VT-d-register-based-invalidation-optional.patch
  60a27288-x86emul-gas-2-36-test-harness-build.patch
  60af933d-x86-gcc11-hypervisor-build.patch
  60afe616-x86-CPUID-rework-HLE-and-RTM-handling.patch
  60afe617-x86-TSX-minor-cleanup-and-improvements.patch
  60afe618-x86-TSX-deprecate-vpmu=rtm-abort.patch
  60be0e24-credit2-pick-runnable-unit.patch
  60be0e42-credit2-per-entity-load-tracking-when-continuing.patch
  60be3097-x86-CPUID-fix-HLE-and-RTM-handling-again.patch
  60bf9e19-Arm-create-dom0less-domUs-earlier.patch
  60bf9e1a-Arm-boot-modules-scrubbing.patch
  60bf9e1b-VT-d-size-qinval-queue-dynamically.patch
  60bf9e1c-AMD-IOMMU-size-command-buffer-dynamically.patch
  60bf9e1d-VT-d-eliminate-flush-related-timeouts.patch
  60bf9e1e-x86-spec-ctrl-protect-against-SCSB.patch
  60bf9e1f-x86-spec-ctrl-mitigate-TAA-after-S3.patch
  60bfa904-AMD-IOMMU-wait-for-command-slot.patch
  60bfa906-AMD-IOMMU-drop-command-completion-timeout.patch
  60c0bf86-x86-TSX-cope-with-deprecation.patch
  60c8a7ac-x86-vpt-fully-init-timers-before-enlisting.patch
  60c8de6e-osdep_xenforeignmemory_map-prototype.patch
  60d49689-VT-d-undo-device-mappings-upon-error.patch
  60d496b9-VT-d-adjust-domid-map-updating-on-unmap.patch
  60d496d6-VT-d-clear_fault_bits-should-clear-all.patch
  60d496ee-VT-d-dont-lose-errors-on-multi-IOMMU-flush.patch
  60d5c6df-IOMMU-PCI-dont-let-domain-cleanup-continue.patch
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6126339d-AMD-IOMMU-global-ER-extending.patch
  6126344f-AMD-IOMMU-unity-map-handling.patch
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch
  6126349a-AMD-IOMMU-rearrange-reassignment.patch
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch
  612634c3-x86-p2m-introduce-p2m_is_special.patch
  612634dc-x86-p2m-guard-identity-mappings.patch
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch
  6126350a-gnttab-release-mappings-preemption.patch
  6126351f-gnttab-replace-mapkind.patch
  6126353d-gnttab-get-status-frames-array-capacity.patch
  61263553-Arm-restrict-maxmem-for-dom0less.patch
  6128a856-gnttab-radix-tree-node-init.patch
  xsa384.patch</changelog>
  <changelog author="carnold@suse.com" date="1633521600">- bsc#1191363 - VUL-0: CVE-2021-28702: xen: PCI devices with RMRRs
  not deassigned correctly (XSA-386)
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1633953600">- Upstream bug fixes (bsc#1027519)
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch</changelog>
  <changelog author="carnold@suse.com" date="1636545600">- bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their
  designated memory limit (XSA-385)
  xsa385.patch
- bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708:
  xen: PoD operations on misaligned GFNs (XSA-388)
  xsa388-1.patch
  xsa388-2.patch
- bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues
  with partially successful P2M updates on x86 (XSA-389)
  xsa389.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1638187200">- Upstream bug fixes (bsc#1027519)
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
- Drop xsa patches in favor of upstream versions
  xsa385.patch
  xsa388-1.patch
  xsa388-2.patch
  xsa389.patch</changelog>
  <changelog author="jfehlig@suse.com" date="1641297600">- Collect active VM config files in the supportconfig plugin
  xen-supportconfig</changelog>
  <changelog author="jbeulich@suse.com" date="1641816000">- bsc#1193447 - Slow execution of hvmloader+ovmf when VM contains an sriov device
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
- Upstream bug fixes (bsc#1027519)
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch</changelog>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
</package>
<package pkgid="74f11a3a72f09c9e1e218275a7ae32da5b720e343654cebb6fdb2b4eeda7e408" name="xen" arch="src">
  <version epoch="0" ver="4.14.5_06" rel="150300.3.35.1"/>
  <changelog author="carnold@suse.com" date="1636545600">- bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their
  designated memory limit (XSA-385)
  xsa385.patch
- bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708:
  xen: PoD operations on misaligned GFNs (XSA-388)
  xsa388-1.patch
  xsa388-2.patch
- bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues
  with partially successful P2M updates on x86 (XSA-389)
  xsa389.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1638187200">- Upstream bug fixes (bsc#1027519)
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
- Drop xsa patches in favor of upstream versions
  xsa385.patch
  xsa388-1.patch
  xsa388-2.patch
  xsa389.patch</changelog>
  <changelog author="jfehlig@suse.com" date="1641297600">- Collect active VM config files in the supportconfig plugin
  xen-supportconfig</changelog>
  <changelog author="jbeulich@suse.com" date="1641816000">- bsc#1193447 - Slow execution of hvmloader+ovmf when VM contains an sriov device
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
- Upstream bug fixes (bsc#1027519)
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch</changelog>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660651200">- bsc#1185104 - VUL-0: CVE-2021-28689: xen: x86: Speculative
  vulnerabilities with bare (non-shim) 32-bit PV guests (XSA-370)
  Part of already released 4.14.5 tarball</changelog>
  <changelog author="jbeulich@suse.com" date="1662638400">- bsc#1197081 - dom0 fails to boot with constrained vcpus and nodes
  62f4cfee-sched-setup-dom0-vCPU-affinity-once.patch
- Upstream bug fixes (bsc#1027519)
  62d65105-x86-spec-ctrl-MD_CLEAR-reporting.patch
  62d807c1-x86-suppress-MMX.patch
  62ecfc08-VMX-use-IST-RSB-protection.patch
  62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch
  62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch
  62f523da-AMD-setup_force_cpu_cap-BSP-only.patch
- bsc#1200762 - VUL-0: CVE-2022-26365,CVE-2022-33740,
  CVE-2022-33741,CVE-2022-33742: xen: Linux disk/nic frontends data
  leaks (XSA-403)
  xsa403.patch
- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  62dfe40a-x86-mm-gpt-TLB-flush-condition.patch
- Drop patch replaced by upstream version
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
</package>
<package pkgid="29d25726e9ce9832120b2be1382d2e61114e03215817adb376b9fdbac0e35dbb" name="xen" arch="src">
  <version epoch="0" ver="4.14.5_08" rel="150300.3.40.1"/>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660651200">- bsc#1185104 - VUL-0: CVE-2021-28689: xen: x86: Speculative
  vulnerabilities with bare (non-shim) 32-bit PV guests (XSA-370)
  Part of already released 4.14.5 tarball</changelog>
  <changelog author="jbeulich@suse.com" date="1662638400">- bsc#1197081 - dom0 fails to boot with constrained vcpus and nodes
  62f4cfee-sched-setup-dom0-vCPU-affinity-once.patch
- Upstream bug fixes (bsc#1027519)
  62d65105-x86-spec-ctrl-MD_CLEAR-reporting.patch
  62d807c1-x86-suppress-MMX.patch
  62ecfc08-VMX-use-IST-RSB-protection.patch
  62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch
  62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch
  62f523da-AMD-setup_force_cpu_cap-BSP-only.patch
- bsc#1200762 - VUL-0: CVE-2022-26365,CVE-2022-33740,
  CVE-2022-33741,CVE-2022-33742: xen: Linux disk/nic frontends data
  leaks (XSA-403)
  xsa403.patch
- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  62dfe40a-x86-mm-gpt-TLB-flush-condition.patch
- Drop patch replaced by upstream version
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699201">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-10.patch (correction)</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
</package>
<package pkgid="83f1397c9ac2a09059f3aa212e4de2b2e36e13dbe338e16d904a2e80e71c29c6" name="xen" arch="src">
  <version epoch="0" ver="4.14.5_10" rel="150300.3.45.1"/>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660651200">- bsc#1185104 - VUL-0: CVE-2021-28689: xen: x86: Speculative
  vulnerabilities with bare (non-shim) 32-bit PV guests (XSA-370)
  Part of already released 4.14.5 tarball</changelog>
  <changelog author="jbeulich@suse.com" date="1662638400">- bsc#1197081 - dom0 fails to boot with constrained vcpus and nodes
  62f4cfee-sched-setup-dom0-vCPU-affinity-once.patch
- Upstream bug fixes (bsc#1027519)
  62d65105-x86-spec-ctrl-MD_CLEAR-reporting.patch
  62d807c1-x86-suppress-MMX.patch
  62ecfc08-VMX-use-IST-RSB-protection.patch
  62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch
  62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch
  62f523da-AMD-setup_force_cpu_cap-BSP-only.patch
- bsc#1200762 - VUL-0: CVE-2022-26365,CVE-2022-33740,
  CVE-2022-33741,CVE-2022-33742: xen: Linux disk/nic frontends data
  leaks (XSA-403)
  xsa403.patch
- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  62dfe40a-x86-mm-gpt-TLB-flush-condition.patch
- Drop patch replaced by upstream version
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699201">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-10.patch (correction)</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671624000">- Upstream bug fixes (bsc#1027519)
  63624fa6-xenstored-call-remove_domid_from_perm-for-special.patch
  637b5f4f-efifb-ignore-invalid.patch
  63a03e28-x86-high-freq-TSC-overflow.patch
- Re-order some patches back into their proper upstream sequence.</changelog>
</package>
<package pkgid="b409c4bab05bbcf5ec6da0803559bee444491b5b10a1ef1c8c1c62faabc3b82d" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.14.5_04" rel="150300.3.32.1"/>
  <changelog author="carnold@suse.com" date="1631016000">- bsc#1189632 - VUL-0: CVE-2021-28701: xen: Another race in
  XENMAPSPACE_grant_table handling (XSA-384)
  xsa384.patch
- Upstream bug fixes (bsc#1027519)
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6128a856-gnttab-radix-tree-node-init.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch (Replaces
    credit2-avoid-picking-a-spurious-idle-unit-when-caps-are-used.patch)
  6126339d-AMD-IOMMU-global-ER-extending.patch (Replaces xsa378-1.patch)
  6126344f-AMD-IOMMU-unity-map-handling.patch (Replaces xsa378-2.patch)
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch (Replaces xsa378-3.patch)
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch (Replaces xsa378-4.patch)
  6126349a-AMD-IOMMU-rearrange-reassignment.patch (Replaces xsa378-5.patch)
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch (Replaces xsa378-6.patch)
  612634c3-x86-p2m-introduce-p2m_is_special.patch (Replaces xsa378-7.patch)
  612634dc-x86-p2m-guard-identity-mappings.patch (Replaces xsa378-8.patch)
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch (Replaces xsa379.patch)
  6126350a-gnttab-release-mappings-preemption.patch (Replaces xsa380-1.patch
  6126351f-gnttab-replace-mapkind.patch (Replaces xsa380-2.patch)
  6126353d-gnttab-get-status-frames-array-capacity.patch (Replaces xsa382.patch)
  61263553-Arm-restrict-maxmem-for-dom0less.patch (Replaces xsa383.patch)</changelog>
  <changelog author="carnold@suse.com" date="1631534400">- Update to Xen 4.14.3 bug fix release (bsc#1027519)
  xen-4.14.3-testing-src.tar.bz2
- Drop patches contained in new tarball
  608676f2-VT-d-register-based-invalidation-optional.patch
  60a27288-x86emul-gas-2-36-test-harness-build.patch
  60af933d-x86-gcc11-hypervisor-build.patch
  60afe616-x86-CPUID-rework-HLE-and-RTM-handling.patch
  60afe617-x86-TSX-minor-cleanup-and-improvements.patch
  60afe618-x86-TSX-deprecate-vpmu=rtm-abort.patch
  60be0e24-credit2-pick-runnable-unit.patch
  60be0e42-credit2-per-entity-load-tracking-when-continuing.patch
  60be3097-x86-CPUID-fix-HLE-and-RTM-handling-again.patch
  60bf9e19-Arm-create-dom0less-domUs-earlier.patch
  60bf9e1a-Arm-boot-modules-scrubbing.patch
  60bf9e1b-VT-d-size-qinval-queue-dynamically.patch
  60bf9e1c-AMD-IOMMU-size-command-buffer-dynamically.patch
  60bf9e1d-VT-d-eliminate-flush-related-timeouts.patch
  60bf9e1e-x86-spec-ctrl-protect-against-SCSB.patch
  60bf9e1f-x86-spec-ctrl-mitigate-TAA-after-S3.patch
  60bfa904-AMD-IOMMU-wait-for-command-slot.patch
  60bfa906-AMD-IOMMU-drop-command-completion-timeout.patch
  60c0bf86-x86-TSX-cope-with-deprecation.patch
  60c8a7ac-x86-vpt-fully-init-timers-before-enlisting.patch
  60c8de6e-osdep_xenforeignmemory_map-prototype.patch
  60d49689-VT-d-undo-device-mappings-upon-error.patch
  60d496b9-VT-d-adjust-domid-map-updating-on-unmap.patch
  60d496d6-VT-d-clear_fault_bits-should-clear-all.patch
  60d496ee-VT-d-dont-lose-errors-on-multi-IOMMU-flush.patch
  60d5c6df-IOMMU-PCI-dont-let-domain-cleanup-continue.patch
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6126339d-AMD-IOMMU-global-ER-extending.patch
  6126344f-AMD-IOMMU-unity-map-handling.patch
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch
  6126349a-AMD-IOMMU-rearrange-reassignment.patch
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch
  612634c3-x86-p2m-introduce-p2m_is_special.patch
  612634dc-x86-p2m-guard-identity-mappings.patch
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch
  6126350a-gnttab-release-mappings-preemption.patch
  6126351f-gnttab-replace-mapkind.patch
  6126353d-gnttab-get-status-frames-array-capacity.patch
  61263553-Arm-restrict-maxmem-for-dom0less.patch
  6128a856-gnttab-radix-tree-node-init.patch
  xsa384.patch</changelog>
  <changelog author="carnold@suse.com" date="1633521600">- bsc#1191363 - VUL-0: CVE-2021-28702: xen: PCI devices with RMRRs
  not deassigned correctly (XSA-386)
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1633953600">- Upstream bug fixes (bsc#1027519)
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch</changelog>
  <changelog author="carnold@suse.com" date="1636545600">- bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their
  designated memory limit (XSA-385)
  xsa385.patch
- bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708:
  xen: PoD operations on misaligned GFNs (XSA-388)
  xsa388-1.patch
  xsa388-2.patch
- bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues
  with partially successful P2M updates on x86 (XSA-389)
  xsa389.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1638187200">- Upstream bug fixes (bsc#1027519)
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
- Drop xsa patches in favor of upstream versions
  xsa385.patch
  xsa388-1.patch
  xsa388-2.patch
  xsa389.patch</changelog>
  <changelog author="jfehlig@suse.com" date="1641297600">- Collect active VM config files in the supportconfig plugin
  xen-supportconfig</changelog>
  <changelog author="jbeulich@suse.com" date="1641816000">- bsc#1193447 - Slow execution of hvmloader+ovmf when VM contains an sriov device
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
- Upstream bug fixes (bsc#1027519)
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch</changelog>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
</package>
<package pkgid="c3076ef63df2700281d6a51e2670b5209d6683cab3caf4ded913172e2ec8d6ee" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.14.5_06" rel="150300.3.35.1"/>
  <changelog author="carnold@suse.com" date="1636545600">- bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their
  designated memory limit (XSA-385)
  xsa385.patch
- bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708:
  xen: PoD operations on misaligned GFNs (XSA-388)
  xsa388-1.patch
  xsa388-2.patch
- bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues
  with partially successful P2M updates on x86 (XSA-389)
  xsa389.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1638187200">- Upstream bug fixes (bsc#1027519)
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
- Drop xsa patches in favor of upstream versions
  xsa385.patch
  xsa388-1.patch
  xsa388-2.patch
  xsa389.patch</changelog>
  <changelog author="jfehlig@suse.com" date="1641297600">- Collect active VM config files in the supportconfig plugin
  xen-supportconfig</changelog>
  <changelog author="jbeulich@suse.com" date="1641816000">- bsc#1193447 - Slow execution of hvmloader+ovmf when VM contains an sriov device
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
- Upstream bug fixes (bsc#1027519)
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch</changelog>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660651200">- bsc#1185104 - VUL-0: CVE-2021-28689: xen: x86: Speculative
  vulnerabilities with bare (non-shim) 32-bit PV guests (XSA-370)
  Part of already released 4.14.5 tarball</changelog>
  <changelog author="jbeulich@suse.com" date="1662638400">- bsc#1197081 - dom0 fails to boot with constrained vcpus and nodes
  62f4cfee-sched-setup-dom0-vCPU-affinity-once.patch
- Upstream bug fixes (bsc#1027519)
  62d65105-x86-spec-ctrl-MD_CLEAR-reporting.patch
  62d807c1-x86-suppress-MMX.patch
  62ecfc08-VMX-use-IST-RSB-protection.patch
  62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch
  62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch
  62f523da-AMD-setup_force_cpu_cap-BSP-only.patch
- bsc#1200762 - VUL-0: CVE-2022-26365,CVE-2022-33740,
  CVE-2022-33741,CVE-2022-33742: xen: Linux disk/nic frontends data
  leaks (XSA-403)
  xsa403.patch
- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  62dfe40a-x86-mm-gpt-TLB-flush-condition.patch
- Drop patch replaced by upstream version
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
</package>
<package pkgid="0f16c722c60122120a458a910f1e256a8850e340d13880e35c930c91e55d56ee" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.14.5_08" rel="150300.3.40.1"/>
  <changelog author="carnold@suse.com" date="1641988800">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output (see also bsc#1194267)
  libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
  libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch</changelog>
  <changelog author="carnold@suse.com" date="1642075200">- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
  xsa393.patch
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
  xsa394.patch
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
  xsa395.patch</changelog>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660651200">- bsc#1185104 - VUL-0: CVE-2021-28689: xen: x86: Speculative
  vulnerabilities with bare (non-shim) 32-bit PV guests (XSA-370)
  Part of already released 4.14.5 tarball</changelog>
  <changelog author="jbeulich@suse.com" date="1662638400">- bsc#1197081 - dom0 fails to boot with constrained vcpus and nodes
  62f4cfee-sched-setup-dom0-vCPU-affinity-once.patch
- Upstream bug fixes (bsc#1027519)
  62d65105-x86-spec-ctrl-MD_CLEAR-reporting.patch
  62d807c1-x86-suppress-MMX.patch
  62ecfc08-VMX-use-IST-RSB-protection.patch
  62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch
  62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch
  62f523da-AMD-setup_force_cpu_cap-BSP-only.patch
- bsc#1200762 - VUL-0: CVE-2022-26365,CVE-2022-33740,
  CVE-2022-33741,CVE-2022-33742: xen: Linux disk/nic frontends data
  leaks (XSA-403)
  xsa403.patch
- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  62dfe40a-x86-mm-gpt-TLB-flush-condition.patch
- Drop patch replaced by upstream version
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699201">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-10.patch (correction)</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
</package>
<package pkgid="bb1c8a3b17689039d40c53bf4f85de5fdca467aa1bea7b663b6b1277e4cb9db1" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.14.5_10" rel="150300.3.45.1"/>
  <changelog author="carnold@suse.com" date="1643803200">- Update to Xen 4.14.4 bug fix release (bsc#1027519)
  xen-4.14.4-testing-src.tar.bz2
- Drop patches contained in new tarball
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
  61655b5a-AMD-IOMMU-hidden-devices-flush.patch
  616d66bd-x86-HVM-cleanup-after-failed-viridian_vcpu_init.patch
  616e7cfe-x86-paging-restrict-paddr-width-reported.patch
  618289da-x86-shstk-fix-with-XPTI-active.patch
  619b7ac9-harden-assign_pages.patch
  619b8cb0-x86-PoD-misaligned-GFNs.patch
  619b8cb1-x86-PoD-intermediate-page-orders.patch
  619b8cb2-x86-P2M-set-partial-success.patch
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  xsa393.patch
  xsa394.patch
  xsa395.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1644408000">- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
  Replace
    libxl-dont-try-to-free-a-NULL-list-of-vcpus.patch
    libxl-dont-touch-nr_vcpus_out-if-listing-vcpus-and-returning-NULL.patch
  by upstream backport
    61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
- Upstream bug fixes (bsc#1027519)
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1647345600">- bsc#1196915 - VUL-0: CVE-2022-0001, CVE-2022-0002,CVE-2021-26401:
  xen: BHB speculation issues (XSA-398)
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch</changelog>
  <changelog author="carnold@suse.com" date="1649073600">- bsc#1197423 - VUL-0: CVE-2022-26356: xen: Racy interactions
  between dirty vram tracking and paging log dirty hypercalls
  (XSA-397)
  xsa397.patch
- bsc#1197425 - VUL-0: CVE-2022-26357: xen: race in VT-d domain ID
  cleanup (XSA-399)
  xsa399.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1649419200">- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch</changelog>
  <changelog author="carnold@suse.com" date="1649851200">- Update to Xen 4.14.5 bug fix release (bsc#1027519)
  xen-4.14.5-testing-src.tar.bz2
- Drop patches contained in new tarball
  60782745-x86-AMD-split-LFENCE-setup.patch
  6081bae4-x86-cpuid-LFENCE-always-serialising.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1653998400">- Upstream bug fixes (bsc#1027519)
  625fca42-VT-d-reserved-CAP-ND.patch
  627549d6-IO-shutdown-race.patch
- bsc#1199965 - VUL-0: EMBARGOED: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  xsa401-1.patch
  xsa401-2.patch
- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1654689600">- bsc#1199966 - VUL-0: EMBARGOED: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  fix xsa402-5.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  xsa408.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1657886400">- bsc#1199965 - VUL-0: CVE-2022-26362: xen: Race condition
  in typeref acquisition
  62a1e594-x86-clean-up-_get_page_type.patch
  62a1e5b0-x86-ABAC-race-in-_get_page_type.patch
- bsc#1199966 - VUL-0: CVE-2022-26363,CVE-2022-26364: xen:
  Insufficient care with non-coherent mappings
  62a1e5d2-x86-introduce-_PAGE_-for-mem-types.patch
  62a1e5f0-x86-dont-change-cacheability-of-directmap.patch
  62a1e60e-x86-split-cache_flush-out-of-cache_writeback.patch
  62a1e62b-x86-AMD-work-around-CLFLUSH-ordering.patch
  62a1e649-x86-track-and-flush-non-coherent.patch
- bsc#1200549 VUL-0: CVE-2022-21123,CVE-2022-21125,CVE-2022-21166:
  xen: x86: MMIO Stale Data vulnerabilities (XSA-404)
  62ab0fab-x86-spec-ctrl-VERW-flushing-runtime-cond.patch
  62ab0fac-x86-spec-ctrl-enum-for-MMIO-Stale-Data.patch
  62ab0fad-x86-spec-ctrl-add-unpriv-mmio.patch
- bsc#1201469 - VUL-0: CVE-2022-23816,CVE-2022-23825,CVE-2022-29900:
  xen: retbleed - arbitrary speculative code execution with return
  instructions (XSA-407)
  62cc31ee-cmdline-extend-parse_boolean.patch
  62cc31ef-x86-spec-ctrl-fine-grained-cmdline-subopts.patch
  62cd91d0-x86-spec-ctrl-rework-context-switching.patch
  62cd91d1-x86-spec-ctrl-rename-SCF_ist_wrmsr.patch
  62cd91d2-x86-spec-ctrl-rename-opt_ibpb.patch
  62cd91d3-x86-spec-ctrl-rework-SPEC_CTRL_ENTRY_FROM_INTR_IST.patch
  62cd91d4-x86-spec-ctrl-IBPB-on-entry.patch
  62cd91d5-x86-cpuid-BTC_NO-enum.patch
  62cd91d6-x86-spec-ctrl-enable-Zen2-chickenbit.patch
  62cd91d7-x86-spec-ctrl-mitigate-Branch-Type-Confusion.patch
- Upstream bug fixes (bsc#1027519)
  62bdd840-x86-spec-ctrl-only-adjust-idle-with-legacy-IBRS.patch
  62bdd841-x86-spec-ctrl-knobs-for-STIBP-and-PSFD.patch
- Drop patches replaced by upstream versions
  xsa401-1.patch
  xsa401-2.patch
  xsa402-1.patch
  xsa402-2.patch
  xsa402-3.patch
  xsa402-4.patch
  xsa402-5.patch</changelog>
  <changelog author="ohering@suse.de" date="1659009600">- bsc#1167608, bsc#1201631 - fix built-in default of max_event_channels
  A previous change to the built-in default had a logic error,
  effectively restoring the upstream limit of 1023 channels per domU.
  Fix the logic to calculate the default based on the number of vcpus.
  adjust libxl.max_event_channels.patch</changelog>
  <changelog author="carnold@suse.com" date="1660651200">- bsc#1185104 - VUL-0: CVE-2021-28689: xen: x86: Speculative
  vulnerabilities with bare (non-shim) 32-bit PV guests (XSA-370)
  Part of already released 4.14.5 tarball</changelog>
  <changelog author="jbeulich@suse.com" date="1662638400">- bsc#1197081 - dom0 fails to boot with constrained vcpus and nodes
  62f4cfee-sched-setup-dom0-vCPU-affinity-once.patch
- Upstream bug fixes (bsc#1027519)
  62d65105-x86-spec-ctrl-MD_CLEAR-reporting.patch
  62d807c1-x86-suppress-MMX.patch
  62ecfc08-VMX-use-IST-RSB-protection.patch
  62f27ebd-x86-expose-more-MSR_ARCH_CAPS-to-hwdom.patch
  62f51e16-x86-spec-ctrl-enum-PBRSB_NO.patch
  62f523da-AMD-setup_force_cpu_cap-BSP-only.patch
- bsc#1200762 - VUL-0: CVE-2022-26365,CVE-2022-33740,
  CVE-2022-33741,CVE-2022-33742: xen: Linux disk/nic frontends data
  leaks (XSA-403)
  xsa403.patch
- bsc#1201394 - VUL-0: CVE-2022-33745: xen: insufficient TLB flush
  for x86 PV guests in shadow mode (XSA-408)
  62dfe40a-x86-mm-gpt-TLB-flush-condition.patch
- Drop patch replaced by upstream version
  xsa408.patch</changelog>
  <changelog author="carnold@suse.com" date="1664366400">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  xsa411.patch</changelog>
  <changelog author="carnold@suse.com" date="1666180800">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-01.patch
  xsa326-02.patch
  xsa326-03.patch
  xsa326-04.patch
  xsa326-05.patch
  xsa326-06.patch
  xsa326-07.patch
  xsa326-08.patch
  xsa326-09.patch
  xsa326-10.patch
  xsa326-11.patch
  xsa326-12.patch
  xsa326-13.patch
  xsa326-14.patch
  xsa326-15.patch
  xsa326-16.patch
- bsc#1204485 - VUL-0: CVE-2022-42309: xen: Xenstore: Guests can
  crash xenstored (XSA-414)
  xsa414.patch
- bsc#1204487 - VUL-0: CVE-2022-42310: xen: Xenstore: Guests can
  create orphaned Xenstore nodes (XSA-415)
  xsa415.patch
- bsc#1204488 - VUL-0: CVE-2022-42319: xen: Xenstore: Guests can
  cause Xenstore to not free temporary memory (XSA-416)
  xsa416.patch
- bsc#1204489 - VUL-0: CVE-2022-42320: xen: Xenstore: Guests can
  get access to Xenstore nodes of deleted domains (XSA-417)
  xsa417.patch
- bsc#1204490 - VUL-0: CVE-2022-42321: xen: Xenstore: Guests can
  crash xenstored via exhausting the stack (XSA-418)
  xsa418-01.patch
  xsa418-02.patch
  xsa418-03.patch
  xsa418-04.patch
  xsa418-05.patch
  xsa418-06.patch
- bsc#1204494 - VUL-0: CVE-2022-42322,CVE-2022-42323: xen:
  Xenstore: cooperating guests can create arbitrary numbers of
  nodes (XSA-419)
  xsa419-01.patch
  xsa419-02.patch
  xsa419-03.patch
- bsc#1204496 - VUL-0: CVE-2022-42325,CVE-2022-42326: xen:
  Xenstore: Guests can create arbitray number of nodes via
  transactions (XSA-421)
  xsa421-01.patch
  xsa421-02.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699200">- bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may
  take excessively long (XSA-410)
  63455f82-Arm-P2M-prevent-adding-mapping-when-dying.patch
  63455fa8-Arm-P2M-preempt-when-freeing-intermediate.patch
  63455fc3-x86-p2m_teardown-allow-skip-root-pt-removal.patch
  63455fe4-x86-HAP-monitor-table-error-handling.patch
  63456000-x86-tolerate-sh_set_toplevel_shadow-failure.patch
  6345601d-x86-tolerate-shadow_prealloc-failure.patch
  6345603a-x86-P2M-refuse-new-alloc-for-dying.patch
  63456057-x86-P2M-truly-free-paging-pool-for-dying.patch
  63456075-x86-P2M-free-paging-pool-preemptively.patch
  63456090-x86-p2m_teardown-preemption.patch
- bcs#1203804 - VUL-0: CVE-2022-33747: xen: unbounded memory consumption
  for 2nd-level page tables on ARM systems (XSA-409)
  63456175-libxl-per-arch-extra-default-paging-memory.patch
  63456177-Arm-construct-P2M-pool-for-guests.patch
  6345617a-Arm-XEN_DOMCTL_shadow_op.patch
  6345617c-Arm-take-P2M-pages-P2M-pool.patch
- bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in
  transitive grant copy handling (XSA-411)
  634561aa-gnttab-locking-on-transitive-copy-error-path.patch
- Upstream bug fixes (bsc#1027519)
  6306185f-x86-XSTATE-CPUID-subleaf-1-EBX.patch
  6346e404-VMX-correct-error-handling-in-vmx_create_vmcs.patch
  6351095c-Arm-rework-p2m_init.patch
  6351096a-Arm-P2M-populate-pages-for-GICv2-mapping.patch
  635274c0-EFI-dont-convert-runtime-mem-to-RAM.patch
  635665fb-sched-fix-restore_vcpu_affinity.patch
  63569723-x86-shadow-replace-bogus-assertions.patch
- Drop patches replaced by upstream versions:
  xsa410-01.patch
  xsa410-02.patch
  xsa410-03.patch
  xsa410-04.patch
  xsa410-05.patch
  xsa410-06.patch
  xsa410-07.patch
  xsa410-08.patch
  xsa410-09.patch
  xsa410-10.patch
  xsa411.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1666699201">- bsc#1204482 - VUL-0: CVE-2022-42311, CVE-2022-42312,
  CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,
  CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let
  xenstored run out of memory (XSA-326)
  xsa326-10.patch (correction)</changelog>
  <changelog author="carnold@suse.com" date="1666958400">- bsc#1193923 - VUL-1: xen: Frontends vulnerable to backends
  (XSA-376)
  61dd5f64-limit-support-statement-for-Linux-and-Windows-frontends.patch</changelog>
  <changelog author="carnold@suse.com" date="1668081600">- bsc#1205209 - VUL-0: CVE-2022-23824: xen: x86: Multiple
  speculative security issues (XSA-422)
  636a9130-x86-spec-ctrl-Enumeration-for-IBPB_RET.patch
  636a9130-x86-spec-ctrl-Mitigate-IBPB-not-flushing-the-RSB-RAS.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1671624000">- Upstream bug fixes (bsc#1027519)
  63624fa6-xenstored-call-remove_domid_from_perm-for-special.patch
  637b5f4f-efifb-ignore-invalid.patch
  63a03e28-x86-high-freq-TSC-overflow.patch
- Re-order some patches back into their proper upstream sequence.</changelog>
</package>
<package pkgid="fa9041df098776f0f62e67a57757690cb67a7140d7b6d0feea3fcab28b46e755" name="xmlsec1" arch="src">
  <version epoch="0" ver="1.2.28" rel="150100.7.11.1"/>
  <changelog author="mvyskocil@suse.com" date="1389096000">- Initial packaging of xmlsec1 for SUSE</changelog>
  <changelog author="astieger@suse.com" date="1441281600">- update to 1.2.20:
  * fix a number of miscellaneous bugs
  * update expired or soon-to-be-expired certificates in test suite</changelog>
  <changelog author="tchvatal@suse.com" date="1464177600">- Version update to 1.2.22 (fate#320861):
  * see the ChangeLog for most detailed output
  * openssl 1.1 support
  * Few features from libreoffice for integrated
  * Run the testsuite</changelog>
  <changelog author="tchvatal@suse.com" date="1480334400">- Version update to 1.2.23:
  * Full support for OpenSSL 1.1.0
  * Several other small fixes</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1490270400">- Fixed dependencies with libraries (bsc#1012246):
  * libxmlsec1-openssl.so
  * libxmlsec1-gcrypt.so
  * libxmlsec1-gnutls.so
  * libxmlsec1-nss.so</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1492689600">- Version update to 1.2.24:
  * Added ECDSA-SHA1, ECDSA-SHA256, ECDSA-SHA512 support
  for xmlsec-nss.
  * Fixed XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS
  handling.
  * Disabled external entities loading by xmlsec utility app by
  default to prevent XXE attacks.
  * Improved OpenSSL version and features detection.
  * Cleaned up, simplified, and standardized internal error
  reporting.
  * Fixed a few Coverity-discovered bugs.
  * Marked as deprecated all the functions in xmlsec/soap.h file
  and a couple other functions no longer required by xmlsec.
  These functions will be removed in the future releases.
  * Several other small fixes (see commit log for more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1512043200">- Version update to 1.2.25:
  * Various small fixes
  * Coverity cleanups
  * Removed support for old openssl</changelog>
  <changelog author="vmiklos@collabora.co.uk" date="1528200000">- Version update to 1.2.26:
  * Added xmlsec-mscng module based on Microsoft Cryptography API: Next
    Generation
  * Added support for GOST 2012 and fixed CryptoPro CSP provider for GOST R
    34.10-2001 in xmlsec-mscrypto
  * Added LibreSSL 2.7 support
  * Upgraded documentation build process to support the latest gtk-doc</changelog>
  <changelog author="kallan@suse.com" date="1534248000">- Fixed (bsc#1104876).  Added: Requires: %{libname} = %{version} to each module
  in the spec file. This will ensure that when one of the modules is installed
  the corresponding version of libxmlsec1-1 will also be installed/upgraded.</changelog>
  <changelog author="tchvatal@suse.com" date="1534420800">- Add rplintrc to avoid bogus errors:
  * xmlsec1-rpmlintrc</changelog>
  <changelog author="tchvatal@suse.com" date="1540987200">- Version update to 1.2.27:
  * Added AES-GCM support for OpenSSL and MSCNG (snargit).
  * Added DSA-SHA256 and ECDSA-SHA384 support for NSS (vmiklos).
  * Added RSA-OAEP support for MSCNG (vmiklos).
  * Continuous build integration in Travis and Appveyor.
  * Several other small fixes (more details).</changelog>
  <changelog author="tchvatal@suse.com" date="1540987201">- Drop the gnutls backend as based on the tests it is quite borked:
  * We still have nss and openssl backend for people to use</changelog>
  <changelog author="tchvatal@suse.com" date="1544184000">- Make sure to recommend at least one backend when you install
  just xmlsec1</changelog>
  <changelog author="tchvatal@suse.com" date="1556193600">- Update to 1.2.28:
  * Added BoringSSL support (chenbd).
  * Added gnutls-3.6.x support (alonbl).
  * Added DSA and ECDSA key size getter for MSCNG (vmiklos).
  * Added --enable-mans configuration option (alonbl).
  * Added coninuous build integration for MacOSX (vmiklos).
  * Several other small fixes (more details).</changelog>
</package>
<package pkgid="7861f3e3fec8685c7e6fa13f6f90fa09548d615ce410fd46431647d451a93a78" name="zlib" arch="src">
  <version epoch="0" ver="1.2.11" rel="150000.3.33.1"/>
  <changelog author="mpluskal@suse.com" date="1496318400">- Add gpg signature
- Re-enable profiling</changelog>
  <changelog author="kah0922@gmail.com" date="1497268800">- Added 32bit minizip support</changelog>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
</package>
<package pkgid="db5d7bf995d81deb680da3862166c540baef0594aa00d1bc5b6728961e7984fa" name="zlib" arch="src">
  <version epoch="0" ver="1.2.11" rel="150000.3.36.1"/>
  <changelog author="kah0922@gmail.com" date="1497268800">- Added 32bit minizip support</changelog>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
</package>
<package pkgid="36733dfb40cfce77605db71d242093abe70dcc4be4901fd8b2a2251c8fd99fc6" name="zlib" arch="src">
  <version epoch="0" ver="1.2.11" rel="150000.3.39.1"/>
  <changelog author="tchvatal@suse.com" date="1526385600">- Add patch to safeguard against negative values in uInt bsc#1071321:
  * 0001-Do-not-try-to-store-negative-values-in-unsigned-int.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1529496000">- Add patch for fate#325307 zlib speedup on power8:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1552996800">- Try to safely abort if we get NULL ptr bsc#1110304 bsc#1129576:
  * zlib-power8-fate325307.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559822400">- Add patchset for s390 improvements jsc#SLE-5807 bsc#1136717:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Do not enable the previous patchset on s390 but just s390x
  bsc#1137624</changelog>
  <changelog author="mliska@suse.cz" date="1562068800">- Use FAT LTO objects in order to provide proper static library.</changelog>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="kstreitova@suse.com" date="1614859200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1638532800">- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- CVE-2018-25032: Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1660219200">- Fix heap-based buffer over-read or buffer overflow in inflate via
  large gzip header extra field (bsc#1202175, CVE-2022-37434,
  CVE-2022-37434-extra-header-1.patch,
  CVE-2022-37434-extra-header-2.patch).</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Fix bsc#1203652, inflate() does not update strm.adler if DFLTCC is used
  * bsc1203652.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1671710400">- Follow up fix for bsc#1203652 due to libxml2 breakage
  * bsc1203652-2.patch</changelog>
</package>
<package pkgid="9f9a414e08c66a1582bf0cec5f626ec1ec72a45a01fb4195dd69fbb22b0a27cf" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="3059952e3e3967edf626754a972cb10d3dd7a3ec7e5426303063b79d95e8c139" name="zypper" arch="src">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="972c7d7233db73947e54a887164140df4e010430e5e57a7b76240f14c552ead4" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="aafd7f743e08cd0ddb5718f6209f8826dc38a3119d2f875405275d8d256e75cf" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
<package pkgid="ddcff01d80a0008dac7f866df53de4cc9a32e28e0ee287aa61146a4aa0339ef7" name="zypper" arch="src">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
<package pkgid="cd31db4bd83b3506026264c721c985a2ec0eebc3dc3276e4e70990a25f0f3029" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
<package pkgid="2ee2671b3d93e44de5bb44a7bc51f66392c3c2a2dec2d9e63ace56f88e328d6a" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.55" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
</package>
<package pkgid="df03e002b9e36e338850f21e7548063519d62d2e82800dba2f6cec66b097b243" name="zypper" arch="src">
  <version epoch="0" ver="1.14.55" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
</package>
<package pkgid="b3b11cfca7dc84109c1e25de72dbd1e050c24752c21714be142c8dea1a15c9a1" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.55" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
</package>
<package pkgid="8b2477bae201390c6fc58af8adf2a8f3380f723b6f5f8d9631aa1526c1e90167" name="zypper" arch="aarch64">
  <version epoch="0" ver="1.14.57" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
</package>
<package pkgid="4e4453703da7359ee128385d338cef098d1f6031acc71b5542dbd8cd5364bec8" name="zypper" arch="src">
  <version epoch="0" ver="1.14.57" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
</package>
<package pkgid="d85cde6fd29bb56b5233626dd63832acbcffad9491cc5db20a0f1a9581828778" name="zypper" arch="x86_64">
  <version epoch="0" ver="1.14.57" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
</package>
<package pkgid="73cec69f509ba0c0a90703c15a9db44ff6cabd5bfc68052a5c912b515b2f2086" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.52" rel="150200.30.2"/>
  <changelog author="ma@suse.de" date="1574942400">- Introduce purge-kernels command (bsc#1155198)
  Adds a new zypper command to cleanup all obsolete kernels as
  configured by the user.
- Request root privs for zypper addlocale and removelocale.
- Load only target resolvables for removelocale.
- Load only target resolvables for zypper rm (bsc#1157377)
- Fix broken search by filelist (bsc#1135114 )
- zypper-log: Replace python by a bash script (fixes#304,
  fixes#306, bsc#1156158)
- locales: do not sort out requested locales which are not
  available (bsc#1155678)
- list_patches_by_issue: rewrite table output and add xml output
  (bsc#1154805)
  Prevent listing duplicate matches in tables. XML result is
  provided within the new &lt;list-patches-byissue&gt; element.
- list-patches: XML add patch &lt;issue-date&gt; and &lt;issue-list&gt;
  (bsc#1154805)
- Fix zypper lp --cve/bugzilla/issue options (bsc#1155298)
- Always execute commit when adding/removing locales (fixes
  bsc#1155205)
- man page: fix description of --table-style,-s (bsc#1154804)
- Provide reverse search in zypper (fixes #214)
  This patch adds a new set of switches to zypper to support
  searching reverse dependencies for a package or a set of packages.
- BuildRequires:  libzypp-devel &gt;= 17.16.1.
- version 1.14.33</changelog>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
</package>
<package pkgid="5b305c27ffee3fd0fb4cd75f6086bc74173e2b9f9d3d16016501e728fa5d4b0a" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.53" rel="150200.33.1"/>
  <changelog author="ma@suse.de" date="1582286400">- Do not allow the abbreviation of cli arguments (bsc#1164543)
- accoring to according in all translation files.
- Always show exception history if available.
- Use default package cache location for temporary repos (bsc#1130873)
- version 1.14.34</changelog>
  <changelog author="ma@suse.de" date="1584705600">- Tag 'retracted' patch status in info and list-patches (jsc#SLE-8770)
- Tag 'R'etracted items in search tabes status columns (jsc#SLE-8770)
- Relax 'Do not allow the abbreviation of cli arguments' in
  legacy distibutions (bsc#1164543)
- Correctly detect ambigous switch abbreviations (bsc#1165573)
- zypper-aptitude: don't supplement zypper.
  supplementing zypper means zypper-aptitude gets installed by
  default and pulls in perl. Neither is desired on small systems.
- BuildRequires:  libzypp-devel &gt;= 17.23.2.
- version 1.14.35</changelog>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
</package>
<package pkgid="42de4c2a5dfbf7c6edc0b3cee72e57f09d272e2fdc01e4333843cd902dc8b6c0" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.55" rel="150200.36.1"/>
  <changelog author="ma@suse.de" date="1586779200">- Reformat manpages to workaround asciidoctor shortcomings
  (bsc#1154803, bsc#1167122, bsc#1168990)
- Remove undocumented rug legacy stuff.
- Remove 'using namespace std;' (bsc#1166610)
- patch table: Add 'Since' column if history data are available
  (jsc#SLE-5116)
- version 1.14.36</changelog>
  <changelog author="bzeller@suse.de" date="1592222400">- Print switch abbrev warning to stderr (bsc#1172925)
- Fix typo in man page (bsc#1169947)
- version 1.14.37</changelog>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
</package>
<package pkgid="c05ca59892a3a10a9c245a4b772e2a9775ee6baba58da2e78f18540bf65dd3d9" name="zypper-needs-restarting" arch="noarch">
  <version epoch="0" ver="1.14.57" rel="150200.39.1"/>
  <changelog author="ma@suse.de" date="1598616000">- Directly list subcommands in 'zypper help' (bsc#1165424)
- man: enhance description of the global package cache (bsc#1175592)
- Remove extern C block wrapping augeas.h as it breaks the build
  on Arch Linux.
- Point out that plaindir repos do not follow symlinks (bsc#1174561)
- Fix help command for list-patches
- man: Point out that plain rpm packages are not downloaded to the
  global package cache (bsc#1173273)
- version 1.14.38</changelog>
  <changelog author="ma@suse.de" date="1600430400">- Use new testcase API in libzypp.
- BuildRequires:  libzypp-devel &gt;= 17.25.0.
- help: prevent 'whatis' from writing to stderr (bsc#1176712)
- wp: point out that command is aliased to a search command and
  searches case-insensitive (jsc#SLE-16271)
- version 1.14.39</changelog>
  <changelog author="ma@suse.de" date="1601035200">- info: Assume descriptions starting with '&lt;p&gt;' are richtext
  (bsc#935885)
- version 1.14.40</changelog>
  <changelog author="ma@suse.de" date="1606478400">- Avoid translated text in xml attributes ( fixes #361 )
- BuildRequires:  libzypp-devel &gt;= 17.25.3.
  Adapt to new LoadTestcase API.
- version 1.14.41</changelog>
  <changelog author="ma@suse.de" date="1610452800">- Fix source-download commnds help (bsc#1180663)
- man: Recommend to use the --non-interactive global option
  rather than the command option -y (bsc#1179816)
- Extend apt packagemap (fixes #366)
- --quitet: Fix install summary to write nothing if there's
  nothing todo (bsc#1180077)
- Prefer /run over /var/run.
- version 1.14.42</changelog>
  <changelog author="ma@suse.de" date="1614168000">- doc: give more details about creating versioned package locks
  (bsc#1181622)
- man: Document synonymously used patch categories (bsc#1179847)
- version 1.14.43</changelog>
  <changelog author="ma@suse.de" date="1619784000">- Rephrase needs-rebooting help and messages.
  Try to point out that the need to reboot was not necessarily
  triggered by the current transaction.
- man page: Recommend the needs-rebooting command to test whether
  a system reboot is suggested.
- patch: Let a patch's reboot-needed flag overrule included packages
  (bsc#1183268)
- Quickfix setting "openSUSE_Tumbleweed" as default platform for
  "MicroOS" (bsc#1153687)
  This fixes the guessed platform for "obs://&lt;project&gt;/" URLs.
- Protect against strict/relaxed user umask via sudo (bsc#1183589)
- zypper-log: protect against thread name indicators in a log.
- xml summary: add solvables repository alias (bsc#1182372)
- version 1.14.44</changelog>
  <changelog author="ma@suse.de" date="1622635200">- Add hints to 'trust GPG key' prompt.
- Add report when receiving new package signing keys from a
  trusted repo (bsc#1184326)
- Added translation using Weblate (Kabyle)
- version 1.14.45</changelog>
  <changelog author="ma@suse.de" date="1623326400">- Link all executables with -pie (bsc#1186447)
- Tag PTF packages in the status column (bsc#1186503)
  Like retracted packages, a program temporary fix must be
  explicitly selected and will otherwise not be considered in
  dependency resolution.
- BuildRequires:  libzypp-devel &gt;= 17.26.1.
- version 1.14.46</changelog>
  <changelog author="ma@suse.de" date="1625140800">- Quick fix obs:// platform guessing for Leap (bsc#1187425)
- man: point out more clearly that patches update affected
  packages to the latest version (bsc#1187466)
- version 1.14.47</changelog>
  <changelog author="ma@suse.de" date="1627473600">- Support new reports for singletrans rpm commit.
- BuildRequires:  libzypp-devel &gt;= 17.27.1.
  For lock/query comments.
- Prompt: choose exact match if prompt options are not prefix
  free (bsc#1188156)
- Install summary: Show new and removed packages closer to the
  prompt (fixes #403)
  These packages are usually more interesting than the updated
  ones. In case of doubt less scrolling is needed to see them.
- Add need reboot/restart hint to XML install summary
  (bsc#1188435)
- Add comment option for lock command (fixes #388).
- version 1.14.48</changelog>
  <changelog author="ma@suse.de" date="1630670400">- Avoid calling 'su' to detect a too restrictive sudo user umask
  (bsc#1186602)
- Fix typo in German translation (fixes #395)
- BuildRequires:  libzypp-devel &gt;= 17.28.3.
- version 1.14.49</changelog>
  <changelog author="ma@suse.de" date="1634558400">- Fix compiler warning.
- zypper.conf: New option whether to collect subcommands found in
  $PATH (fixes #379)
  +[subcommand] i
  +
  +##  Whether to look for subcommands in $PATH
  +##
  +## If a subcommand is not found in the zypper_execdir, the wrapper
  +## will look in the rest of your $PATH for it. Thus, it's possible
  +## to write local zypper extensions that don't live in system space.
  +## See section SUBCOMMANDS in the zypper manpage.
  +##
  +## Valid values: boolean
  +## Default value: yes
  +##
  +# seachSubcommandInPath = yes.
- help subcommand: show path of command found in $PATH.
- version 1.14.50</changelog>
  <changelog author="ma@suse.de" date="1640260800">- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel &gt;= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51</changelog>
  <changelog author="ma@suse.de" date="1645704000">- info: print the packages upstream URL if available (fixes #426)
- info: Fix SEGV with not installed PTFs (bsc#1196317)
- Don't prevent less restrictive umasks (bsc#1195999)
- version 1.14.52</changelog>
  <changelog author="ma@suse.de" date="1655294400">- Basic JobReport for "cmdout/monitor".
- versioncmp: if verbose, also print the edition 'parts' which are
  compared.
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally (fixes #433)
- Honor the NO_COLOR environment variable when auto-detecting
  whether to use color (fixes #432)
- Define table columns which should be sorted natural [case
  insensitive] (fixes #391, closes #396, fixes #424)
- lr/ls: Use highlight color on name and alias as well.
- version 1.14.53</changelog>
  <changelog author="ma@suse.de" date="1657022400">- Fix building with GCC 13 (fixes #448)
- Put signing key supplying repository name in quotes.
- version 1.14.54</changelog>
  <changelog author="ma@suse.de" date="1658318400">- lr: Allow shortening the Name column if table is wider than the
  terminal (bsc#1201638)
- Don't accepts install/remove modifier without argument
  (bsc#1201576)
- zypper-download: Set correct ExitInfoCode when failing to
  resolve argument.
- zypper-download: Handle unresolvable arguments as error.
  This commit changes zypper-download such that it behaves more
  consistent to zypper-install when an argument can't be resolved.
- version 1.14.55</changelog>
  <changelog author="ma@suse.de" date="1662120000">- UsrEtc: Store logrotate files in %{_distconfdir} if defined
  (fixes #441, fixes #444)
- Remove unneeded code to compute the PPP status.
  Since libzypp 17.23.0 the PPP status is auto established. No
  extra solver run is needed.
- Make sure 'up' respects solver related CLI options (bsc#1201972)
- Fix tests to use locale "C.UTF-8" rather than "en_US".
- Fix man page (fixes #451)
- version 1.14.56</changelog>
  <changelog author="ma@suse.de" date="1664971200">- BuildRequires:  libzypp-devel &gt;= 17.31.2.
- Fix --[no]-allow-vendor-change feedback in install command
  (bsc#1201972)
- version 1.14.57</changelog>
</package>
</otherdata>